From arc-probe
Locates functions in x64 binaries by tracing LEA instructions that reference known strings like error messages, UI labels, or log output, via string search and disassembly.
npx claudepluginhub vzco/arc-probe --plugin arc-probeThis skill uses the workspace's default tool permissions.
Find a function by tracing from a known string to the code that references it.
Finds strings in process memory, traces xrefs to referencing functions via LEA instructions, analyzes and labels them—automates IDA string search workflow for reverse engineering.
Find and list functions in binaries by name, address, regex, or byte pattern. Use for binary analysis, locating specific functions, or enumerating matches.
Share bugs, ideas, or general feedback.
Find a function by tracing from a known string to the code that references it.
text (required): The string to search for (error message, debug text, UI label, etc.)module (optional): Module to search inAlmost every function references at least one string — error messages, log output, assert text, format strings, UI labels. Strings live in .rdata (read-only data) and code loads their address via LEA reg, [RIP+offset]. Finding that LEA instruction puts you inside the function.
Find the string:
probe_strings_find text=<text> module=<module> max=5
Note the exact address of the string. If multiple matches, pick the one in the expected module.
Find code references to it:
probe_strings_xref address=<string_addr> module=<module> max=10
Returns addresses of LEA instructions that load this string's address. Each one is a code location that uses this string.
Disassemble each reference site:
probe_disassemble address=<ref_addr - 0x20> count=20
Start a few bytes before the LEA to see context. You want to find:
Find the function prologue — scan backwards from the LEA: Look for these patterns (in order of likelihood):
push rbx ; 53
sub rsp, 0x?? ; 48 83 EC ??
push rbp ; 55
mov rbp, rsp ; 48 8B EC or 48 89 E5
mov [rsp+8], rbx ; 48 89 5C 24 08
push rdi ; 57
sub rsp, 0x?? ; 48 83 EC ??
The first instruction after a ret or int3 (0xCC padding) is usually the start of the next function.
Disassemble the full function:
probe_disassemble_function address=<function_start>
Generate a signature:
probe_generate_signature address=<function_start>
Test it: probe_test_signature address=<function_start>
Report:
String: "Player took %d damage"
Address: 0x7FFB22EA4098 (client.dll + 0x1914098, .rdata)
Referenced by:
0x7FFB2194FE75 (client.dll + 0x3BFE75) — lea rcx, [rip+0x15D421C]
Function: 0x7FFB2194FE40 (client.dll + 0x3BFE40)
Signature: 48 89 5C 24 08 57 48 83 EC 20 ...
0x7FFB21EBE2D0 (client.dll + 0x92E2D0) — lea rdx, [rip+0x1585DC1]
Function: 0x7FFB21EBE280 (client.dll + 0x92E280)
Different function — likely the UI display handler
strings find is case-sensitive--wide flagprobe_find_value type=string value=<text> to search heap/stack.CRT$XCU section (static constructors)strings xref scans for common LEA patterns but might miss unusual encodings