skills.rest
vzco
vzcoOFFICIAL
Explore all skills by this author →
GitHub

trace-string-to-function

Trace memory-resident strings to referencing functions and generate GUI labels.

15|4|Updated Mar 7, 2026
Search Tags:#analysis#memory#trace#gui#disassembly#string#xref
One-click install
npx skills add https://github.com/vzco/arc-probe --skill trace-string-to-function
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: trace-string-to-function
Source: https://github.com/vzco/arc-probe/tree/main/plugins/arc-probe/skills/trace-string-to-function
Command: npx skills add https://github.com/vzco/arc-probe --skill trace-string-to-function

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Given a string the user knows exists in the target process memory, find it and trace cross-references to the code that uses it, then label everything in the GUI to accelerate reverse engineering.

Core Features & Use Cases

  • String search: locate string literals in memory (.rdata) and track their usage.
  • Cross-reference tracing: map LEA/MOV references to the functions that reference the string.
  • GUI labeling: annotate identified functions and calls for quick inspection and analysis.
  • Use Case: Analysts investigating a crash or hard-to-reproduce bug can quickly identify the functions that reference a known error string.

Quick Start

Use the string-trace workflow with probe.exe to locate a known string, map its xrefs, and label the corresponding functions in the GUI.

Frequently Asked Questions about trace-string-to-function

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace a string in memory to the functions that reference it?▼

To trace a string in memory, this Skill locates the literal in the target process, maps its LEA/MOV cross-references, and identifies the functions that reference it for automated GUI labeling.

What is the best way to find cross-references for a known error string during reverse engineering?▼

Finding cross-references for a known error string is done by searching memory-resident string literals, mapping their xrefs to code paths, and generating function labels in the GUI to accelerate reverse engineering.

Can I automate function labeling in the GUI by searching for string literals?▼

Yes, you can automate function labeling in the GUI by searching for string literals in memory, tracing their cross-references, and applying generated labels to the identified functions and call graphs.

How do I map LEA and MOV references to functions that use a specific string?▼

You can map LEA and MOV references by locating the target string in memory, tracing its cross-references to find the instructions that load or move it, and identifying the parent functions.

Does this string tracing approach work for investigating crashes using hard-to-reproduce error strings?▼

Yes, this string tracing approach works for investigating crashes by locating known error strings in memory and quickly identifying the functions and code paths that reference them.

Related Skills

Explore More Software Engineering Skills→
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
not-matthiasnot-matthias
9

rizin-analysis

Analyze binary code with Rizin and Radare2 to reveal functions, CFGs, and disassembly.

Community
Advanced
marcosd4hmarcosd4h
17

callgraph-tracer

Trace cross-module function call chains across DeepExtractIDA databases and output JSON or Mermaid diagrams.

Community
Advanced
bianhaifeng789-huebianhaifeng789-hue

vulnerable-secret

Extracts secrets from vulnerable ELF binaries using static and dynamic analysis techniques.

Community
Intermediate