# Rev Symbol

Restore function symbols by analyzing code patterns, strings, constants, and...

- Repository: https://github.com/P4nda0s/reverse-skills (2339 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-05-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add P4nda0s/reverse-skills --skill rev-symbol -g -a claude-code -y`
Codex: `npx skills add P4nda0s/reverse-skills --skill rev-symbol -g -a codex -y`
Cursor: `npx skills add P4nda0s/reverse-skills --skill rev-symbol -g -a cursor -y`
Gemini CLI: `npx skills add P4nda0s/reverse-skills --skill rev-symbol -g -a gemini-cli -y`

## Description

Restore function symbols by analyzing code patterns, strings, constants, and cross-references

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# rev-symbol - Symbol Recovery

Analyze function code characteristics to recover/identify function symbols and names.

## Pre-check

**Determine which IDA access method is available:**

**Option A, IDA Pro MCP (preferred if connected):**
Check if the IDA Pro MCP server is connected (look for an active `ida-pro` or equivalent MCP connection). If connected, you can query IDA directly via MCP tools, no exported files needed. Proceed with the analysis using MCP.

**Option B, IDA-NO-MCP exported data:**
If MCP is not connected, check if IDA-NO-MCP exported data exists in the current directory:

1. Check if `decompile/` directory exists
2. Check if there are `.c` files inside

If neither MCP nor exported data is available, prompt the user:
```
No IDA access method detected. Choose one of the following:

Option A, IDA Pro MCP (recommended):
  Connect the IDA Pro MCP server so Claude can query IDA directly.

Option B, IDA-NO-MCP export:
  1. Download plugin: https://github.com/P4nda0s/IDA-NO-MCP
  2. Copy INP.py to IDA plugins directory
  3. Press Ctrl-Shift-E in IDA to export
  4. Open the exported directory with Claude Code
```

---

## Export Directory Structure

```
./
├── decompile/              # Decompiled C code directory
│   ├── 0x401000.c          # One file per function, named by hex address
│   ├── 0x401234.c
│   └── ...
├── decompile_failed.txt    # Failed decompilation list
├── decompile_skipped.txt   # Skipped functions list
├── strings.txt             # String table (address, length, type, content)
├── imports.txt             # Import table (address:function_name)
├── exports.txt             # Export table (address:function_name)
└── memory/                 # Memory hexdump (1MB chunks)
```

## Function File Format (decompile/*.c)

Each `.c` file contains function metadata comments and decompiled code:

The rest: https://github.com/P4nda0s/reverse-skills/blob/HEAD/skills/rev-symbol/SKILL.md