From arc-probe
Locates functions in target processes by string references, RTTI patterns, behavior via hardware breakpoints, or disassembly. Useful for reverse engineering without symbols.
npx claudepluginhub vzco/arc-probe --plugin arc-probeThis skill uses the workspace's default tool permissions.
Locate a function in the target process by its behavior or string references.
Locates functions in x64 binaries by tracing LEA instructions that reference known strings like error messages, UI labels, or log output, via string search and disassembly.
Find and list functions in binaries by name, address, regex, or byte pattern. Use for binary analysis, locating specific functions, or enumerating matches.
Share bugs, ideas, or general feedback.
Locate a function in the target process by its behavior or string references.
description (required): Natural language description of the function to find (e.g., "the function that handles player damage", "where the chat message is processed")module (optional): Module to search in (narrows the search)Identify search strategy based on the description:
String-based search (most common path):
a. Think about what strings the function might reference (error messages, log output, format strings, UI text)
b. Call probe_pattern_scan or probe_find_value (experimental) with type "string" to find the string in the module's data section
c. Note the string's address
d. Search for LEA instructions that reference the string address:
48 8D ?? ?? ?? ?? ?? (LEA reg, [rip+disp32]) or 4C 8D ?? ?? ?? ?? ??
e. For each reference found, disassemble the surrounding code with probe_disassemble
f. Walk backwards to find the function prologue (push rbp / sub rsp pattern)RTTI-based search (for known class methods):
a. Pattern scan for the class name string .?AV<ClassName>@@
b. Find the TypeDescriptor, then the Complete Object Locator, then the vtable
c. Dump the vtable to enumerate virtual functions
d. Disassemble each vtable entry to find the target method
Behavior-based search (for data-touching functions):
a. Identify what memory address the function reads or writes
b. Set a hardware breakpoint on that address: probe_hwbp_set with type "w" or "rw"
c. Trigger the behavior in the application
d. Read the breakpoint registers to get the RIP of the writing instruction
e. Disassemble the function containing that instruction
Validate the result:
a. Disassemble the full function with probe_disassemble_function
b. Check that it references the expected strings, calls expected APIs, or touches expected data
c. Generate a signature with probe_generate_signature for future reference
d. Test the signature with probe_test_signature to confirm it's unique
Report:
Function: <description>
Address: 0x7FF612345678
Module: target.dll + 0x5678
Size: ~0x1A0 bytes
Signature: 48 89 5C 24 08 57 48 83 EC 20 48 8B D9 E8 ?? ?? ?? ??
References: "error message string" at +0x42
Calls: SubFunction at 0x7FF612346000