What problem does it solve? When a binary is updated and its symbols or PDB files are unavailable, previously completed reverse-engineering work is lost, forcing analysts to redo hours of manual analysis. This Skill migrates function names, global variables, vtable offsets, and struct members from an old, symbolized build to a new, stripped build at very low cost. ## Core Features & Use Cases - LLM-Based Structured Comparison: Compares disassembly and pseudocode of matching functions between two versions using a fixed prompt template, returning a strict YAML mapping of five symbol types (calls, vcalls, function pointers, globals, struct offsets). - Batch Symbol Migration: Applies parsed YAML results back into the new-version IDA database via rename and comment operations, then iterates using migrated functions as new anchors. - Anchor Selection Strategy: Guides selection of reliable anchors (exported functions, string references, constants) to bootstrap the comparison between versions. - Use Case: You have full symbols for ntoskrnl.exe build 10.0.26100.2000 but Microsoft pulled the PDB for build 10.0.26100.2605. Use this Skill to derive the new addresses of non-exported functions like PspSetCreateProcessNotifyRoutine in minutes instead of re-reversing the kernel. ## Quick Start Ask the agent to migrate the symbols from your old IDB to the new binary version using the binary-diff workflow, starting from a shared exported function as the anchor.
