detect-params

Infer Windows x64 function parameters from prologues and register usage.

15|4|Updated Mar 7, 2026
One-click install
npx skills add https://github.com/vzco/arc-probe --skill detect-params
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: detect-params
Source: https://github.com/vzco/arc-probe/tree/main/plugins/arc-probe/skills/detect-params
Command: npx skills add https://github.com/vzco/arc-probe --skill detect-params

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyze Windows x64 binaries to reveal function parameter counts, types, and calling conventions by inspecting prologues and register usage.

Core Features & Use Cases

  • Infer parameter count and types from function prologues and register usage.
  • Detect this pointer and adjust signatures accordingly for member functions.
  • Generate a canonical C-style signature for documentation, validation, and reverse engineering scenarios.

Quick Start

Provide the function start address in hex to begin analysis and receive the inferred parameter signature.

Frequently Asked Questions about detect-params

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I infer function parameters from an x64 binary prologue?

To infer function parameters from an x64 prologue, analyze saved registers and the first usage of argument registers to determine parameter count, types, and calling convention. This reveals the function signature directly from binary code.

Can I detect a this pointer in x64 disassembly?

Yes, you can detect a this pointer during x64 disassembly by analyzing register usage in the function prologue. Identifying the this pointer allows you to adjust the inferred signature accordingly for member functions.

What is the best way to determine the calling convention of a Windows x64 function?

Determining the calling convention of a Windows x64 function involves inspecting the prologue and tracking argument register usage. This analysis identifies parameter count and types, producing a canonical C-style signature.

How do I start inferring a function signature from a binary address?

You start inferring a function signature by providing the function start address in hex. The analysis processes the prologue and register usage to produce the inferred parameter signature and stack-passed argument guidance.

Does prologue analysis work for functions with stack-passed arguments?

Prologue analysis provides guidance for stack-passed arguments by validating against cross-references at call sites. While it infers register-based parameters from the prologue, stack arguments require checking cross-reference validation.