skills.rest
eaglefly628
eaglefly628COMMUNITY
Explore all skills by this author →
GitHub

ghidra-aob-extraction

Extract AOB byte-pattern signatures from Ghidra binaries and map them to game targets.

Updated Mar 16, 2026
Search Tags:#reverse engineering#binary analysis#ghidra#mcp http#aob signatures#pattern attribution#game targeting
One-click install
npx skills add https://github.com/eaglefly628/captureAIshi --skill ghidra-aob-extraction
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ghidra-aob-extraction
Source: https://github.com/eaglefly628/captureAIshi/tree/main/.claude/skills/ghidra-aob-extraction
Command: npx skills add https://github.com/eaglefly628/captureAIshi --skill ghidra-aob-extraction

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you extract Array-of-Bytes (AOB) signatures from a Ghidra-loaded binary and reliably attribute each pattern to the specific games the binary targets, including correct handling of shared vs per-game registration logic.

Core Features & Use Cases

  • GhidraMCP-powered extraction workflow: Uses the Ghidra HTTP/MCP bridge to enumerate strings, locate AOB registration wrappers, and decompile registrar functions.
  • Game-aware pattern attribution: Detects game identifiers not only from process-name literals but also from runtime string-compare call arguments, then parses control-flow (brace scope, labels, and OR-branches) to prevent cross-game leakage.
  • Structured output catalog: Produces a per-game JSON structure that includes pattern variants and function registration provenance, with engine/context metadata and purpose classification.

Quick Start

Use the ghidra-aob-extraction skill to extract AOB_NAME patterns from the currently open Ghidra binary using the GhidraMCP endpoint on http://127.0.0.1:8080/.

Frequently Asked Questions about ghidra-aob-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract AOB signatures from a binary in Ghidra and map them to specific games?▼

You can extract AOB signatures using a GhidraMCP HTTP bridge to locate registration wrappers and decompile registrar functions. It attributes byte-patterns to games by parsing control-flow and runtime string-compare arguments.

How does Ghidra attribute AOB byte-patterns to the correct game targets?▼

AOB byte-pattern attribution detects game identifiers from process-name literals and runtime string-compare arguments. It then parses control-flow, including brace scope and OR-branches, to prevent pattern leakage across different game branches.

Do I need a running GhidraMCP HTTP service to extract array-of-bytes patterns?▼

Yes, extracting array-of-bytes patterns requires a reachable GhidraMCP HTTP service or MCP tools. You also need decompilation-enabled analysis active in Ghidra to process the binary and attribute the signatures correctly.

Can I use Ghidra to extract AOB signatures for unlocker or trainer binaries?▼

Yes, this Ghidra extraction workflow supports reverse-engineering unlockers, trainers, and IGCS-style binaries. It handles AOB registration via wrapper calls and game routing using runtime process-name comparisons.

Why does my AOB signature extraction leak shared registrations across game branches?▼

AOB signature extraction leaks shared registrations across game branches when brace-aware parsing is not applied. Correct attribution requires parsing control-flow, brace scope, labels, and OR-branches to isolate per-game registration logic.

Related Skills

Explore More Software Engineering Skills→
gmh5225gmh5225
3.3k

mobile-security

Guide mobile game security research for Android and iOS with reverse engineering and protection analysis.

Community
Advanced
ViewableGravyViewableGravy

engine-plugins

Create and register modular plugins within the Better ECS engine.

Community
Intermediate
0xeb0xeb
2

bnsql

Query Binary Ninja databases with SQL to interrogate functions, xrefs, and strings.

Community
Advanced
hzqsthzqst
60

generate-signature-for-function

Generate and validate hex byte signatures for functions using IDA Pro MCP.

Community
Advanced