reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/skills/binary-diff/references/prompt-template.md

@@ -0,0 +1,173 @@
+# Symbol Migration Prompt Template
+
+## 标准比对 Prompt（直接复制使用）
+
+```text
+I have disassembly outputs and procedure code of the same function.
+
+This is the function for reference:
+
+**Disassembly for Reference**
+```c
+{disasm_for_reference}
+```
+
+**Procedure code for Reference**
+```c
+{procedure_for_reference}
+```
+
+This is the function you need to reverse-engineering:
+
+**Disassembly to reverse-engineering**
+```c
+{disasm_code}
+```
+
+**Procedure code to reverse-engineering**
+```c
+{procedure}
+```
+
+What you need to do is to collect all references to "{symbol_name_list}" in the function you need to reverse-engineering and output those references as YAML.
+
+Example:
+```yaml
+found_vcall:
+  - insn_va: '0x180777700'
+    insn_disasm: call [rax+68h]
+    vfunc_offset: '0x68'
+    func_name: ILoopMode_OnLoopActivate
+
+found_call:
+  - insn_va: '0x180888800'
+    insn_disasm: call sub_180999900
+    func_name: CLoopMode_RegisterEventMapInternal
+
+found_funcptr:
+  - insn_va: '0x180666600'
+    insn_disasm: lea rdx, sub_15BC910
+    funcptr_name: CLoopMode_OnClientPollNetworking
+
+found_gv:
+  - insn_va: '0x180444400'
+    insn_disasm: mov rcx, cs:qword_180666600
+    gv_name: g_pNetworkMessages
+
+found_struct_offset:
+  - insn_va: '0x1801BA12A'
+    insn_disasm: mov rcx, [r14+58h]
+    offset: '0x58'
+    size: 8
+    struct_name: CResourceService
+    member_name: m_pEntitySystem
+```
+
+If nothing found, output an empty YAML. DO NOT output anything other than the desired YAML. DO NOT collect unrelated symbols.
+```
+
+## 变量填充说明
+
+| 变量 | 来源 | 获取方式 |
+|------|------|---------|
+| `{disasm_for_reference}` | 旧版 IDA | `idapro_disasm(addr="函数名")` |
+| `{procedure_for_reference}` | 旧版 IDA | `idapro_decompile(addr="函数名")` |
+| `{disasm_code}` | 新版 IDA | `idapro_disasm(addr="对应地址")` |
+| `{procedure}` | 新版 IDA | `idapro_decompile(addr="对应地址")` |
+| `{symbol_name_list}` | 旧版提取 | 从 reference 代码中提取所有非 sub_/loc_ 的符号名 |
+
+## 批量调用脚本骨架（Python）
+
+```python
+import yaml
+import httpx
+import json
+from pathlib import Path
+
+PROMPT_TEMPLATE = open("prompt-template.txt").read()
+
+def migrate_function(ref_disasm, ref_procedure, target_disasm, target_procedure, symbols, api_url, api_key, model="deepseek-chat"):
+    prompt = PROMPT_TEMPLATE.format(
+        disasm_for_reference=ref_disasm,
+        procedure_for_reference=ref_procedure,
+        disasm_code=target_disasm,
+        procedure=target_procedure,
+        symbol_name_list=", ".join(symbols)
+    )
+    
+    resp = httpx.post(api_url, json={
+        "model": model,
+        "messages": [{"role": "user", "content": prompt}],
+        "temperature": 0
+    }, headers={"Authorization": f"Bearer {api_key}"}, timeout=60)
+    
+    content = resp.json()["choices"][0]["message"]["content"]
+    
+    # 提取 YAML 块
+    if "```yaml" in content:
+        yaml_str = content.split("```yaml")[1].split("```")[0]
+    elif "```" in content:
+        yaml_str = content.split("```")[1].split("```")[0]
+    else:
+        yaml_str = content
+    
+    return yaml.safe_load(yaml_str)
+
+
+def apply_results(results, ida_session):
+    """将解析后的 YAML 结果应用到 IDA"""
+    if not results:
+        return
+    
+    renames = []
+    comments = []
+    
+    if "found_call" in results:
+        for item in results["found_call"]:
+            # 从 insn_disasm 中提取 call target
+            # call sub_XXXXXXX → 提取 sub_XXXXXXX 的地址
+            renames.append({"addr": item["insn_va"], "name": item["func_name"], "type": "call_target"})
+    
+    if "found_funcptr" in results:
+        for item in results["found_funcptr"]:
+            renames.append({"addr": item["insn_va"], "name": item["funcptr_name"], "type": "funcptr_target"})
+    
+    if "found_gv" in results:
+        for item in results["found_gv"]:
+            renames.append({"addr": item["insn_va"], "name": item["gv_name"], "type": "gv"})
+    
+    if "found_vcall" in results:
+        for item in results["found_vcall"]:
+            comments.append({
+                "addr": item["insn_va"],
+                "comment": f"vcall: {item['func_name']} @ +{item['vfunc_offset']}"
+            })
+    
+    if "found_struct_offset" in results:
+        for item in results["found_struct_offset"]:
+            comments.append({
+                "addr": item["insn_va"],
+                "comment": f"{item['struct_name']}.{item['member_name']} @ +{item['offset']}"
+            })
+    
+    return {"renames": renames, "comments": comments}
+```
+
+## API 配置建议
+
+```yaml
+# 默认用 DeepSeek（便宜）
+default:
+  api_url: "https://api.deepseek.com/v1/chat/completions"
+  model: "deepseek-chat"
+  
+# 超大函数回退到 GPT
+fallback:
+  api_url: "https://api.openai.com/v1/chat/completions"
+  model: "gpt-4o"
+
+# 或者用 Claude
+alternative:
+  api_url: "https://api.anthropic.com/v1/messages"
+  model: "claude-sonnet-4-20250514"
+```