「dll」の検索結果

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis

日本語の概要は準備中です。原文の説明を表示しています。

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

日本語の概要は準備中です。原文の説明を表示しています。

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CDecoyProjectile_Create factory in CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the decoy projectile spawn factory. It is a non-virtual, direct-call static factory found via the entity classname string "decoy_projectile" it references (excluding the RTTI class string "CDecoyProjectile"). Emits a unique IDA-style byte signature and a func YAML. Mirrors the find-CDecoyProjectile_Create.py preprocessor (xref_strings FULLMATCH:decoy_projectile). Trigger: CDecoyProjectile_Create, CDecoyProjectile::Create, decoy projectile Create

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPointScript_OnCustomHudClicked in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the local gamedata entry "CCSPointScript_OnCustomHudClicked" (symbol CCSPointScript_OnCustomHudClicked). The gamedata consumer stores a BYTE SIGNATURE for this entry - ALWAYS emit the func schema (func_sig), never vfunc fields. The function may be virtual; locating it via the owning class vtable (RTTI) is a fine strategy, but once found, read its head bytes and emit func_sig. Locate via cross-references, distinctive constants/strings, callers of related symbols, or vtable slots; verify by decompilation before committing. Trigger: CCSPointScript_OnCustomHudClicked, CCSPointScript_OnCustomHudClicked

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayerInventory::m_pSOCache in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CCSPlayerInventory::m_pSOCache" (symbol CCSPlayerInventory_m_pSOCache). This is a STRUCT MEMBER OFFSET (schema netvar). Resolve the CCSPlayerInventory class layout via the schema system; m_pSOCache is the CGCClientSharedObjectCache pointer member. Cross-check: CCSPlayerInventory methods load this pointer and pass it to CGCClientSharedObjectCache methods (the GetItemInLoadout shortlist is a strong caller-side witness). Trigger: CCSPlayerInventory_m_pSOCache, CCSPlayerInventory::m_pSOCache

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CCSPlayerPawn_SnapViewAngles function in CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the non-virtual SnapViewAngles method, anchored on the "setang" console-command usage string and its non-teleport call branch. Emits a unique IDA-style byte signature and a func YAML. Trigger: CCSPlayerPawn_SnapViewAngles, SnapViewAngles

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayerInventory::SendInventoryUpdateEvent in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CCSPlayerInventory::SendInventoryUpdateEvent" (symbol CCSPlayerInventory_SendInventoryUpdateEvent). Shortlist via functions constructing the inventory-full-update usermessage/event around m_pSOCache contents for the owning controller. The body packs the SO cache snapshot and sends it via the GC/usermessage path. Cross-check with callers in inventory-dirty flows (weapon paint mutations). Trigger: CCSPlayerInventory_SendInventoryUpdateEvent, CCSPlayerInventory::SendInventoryUpdateEvent

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayerPawn::SetEyeAngles in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the local gamedata entry "CCSPlayerPawn::SetEyeAngles" (symbol CCSPlayerPawn_SetEyeAngles). This is a non-virtual function - emit a byte signature (func_sig), not an offset. Locate it via cross-references, distinctive constants/strings in its body, or callers of related symbols; verify by decompilation before committing to a candidate. Trigger: CCSPlayerPawn_SetEyeAngles, CCSPlayerPawn::SetEyeAngles

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CCSPlayerPawn_SnapEyeAngles function in CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the non-virtual SnapEyeAngles method. It is the one caller of the shared apply helper (CCSPlayerPawn_ApplyEyeAngleNetworkChange) that is NOT CCSPlayerPawn_SnapViewAngles. Emits a unique IDA-style byte signature and a func YAML. Mirrors the find-CCSPlayerPawn_SnapEyeAngles.py preprocessor (xref_funcs apply-helper, exclude_funcs SnapViewAngles). Trigger: CCSPlayerPawn_SnapEyeAngles, SnapEyeAngles

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayerPawn::SetModelFromClass in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CCSPlayerPawn::SetModelFromClass" (symbol CCSPlayerPawn_SetModelFromClass). Shortlist via callers of CBaseModelEntity::SetModel inside pawn model-selection code: this variant takes the pawn's class model. The body resolves a cached model precache handle from the player class and calls SetModel. Distinguish from SetModelFromLoadout by the ABSENCE of loadout/inventory item lookups in the call chain. Trigger: CCSPlayerPawn_SetModelFromClass, CCSPlayerPawn::SetModelFromClass

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayerPawn::SetModelFromLoadout in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CCSPlayerPawn::SetModelFromLoadout" (symbol CCSPlayerPawn_SetModelFromLoadout). Shortlist alongside SetModelFromClass (same file/call region — sibling paths in pawn model selection). This variant resolves the model from the player's loadout/inventory items (agent skin selection), referencing inventory services and item definition indexes before calling SetModel. Trigger: CCSPlayerPawn_SetModelFromLoadout, CCSPlayerPawn::SetModelFromLoadout

日本語の概要は準備中です。原文の説明を表示しています。

Locate CEconItemView::operator= in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CEconItemView::operator=" (symbol CEconItemView_operator=). Copy-assignment operator. Shortlist via call sites in weapon-give/refresh paths that copy an existing CEconItemView into another (this-pointer copy of definition index, seed, wear, attribute list and item ID fields — a field-by-field copy, not a memcpy). Trigger: CEconItemView_operator=, CEconItemView::operator=

日本語の概要は準備中です。原文の説明を表示しています。

Locate CEconItemView::CEconItemView in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CEconItemView::CEconItemView" (symbol CEconItemView_CEconItemView). This is the CONSTRUCTOR of CEconItemView. Shortlist via allocation sites: callers of operator-new whose result is immediately stored with the CEconItemView vtable (RTTI), followed by zeroing and initialization of definition-index/quantity/attribute-list fields. Distinguish from subobject constructors of derived classes by the vtable identity. Trigger: CEconItemView_CEconItemView, CEconItemView::CEconItemView

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayerInventory::GetItemInLoadout in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CCSPlayerInventory::GetItemInLoadout" (symbol CCSPlayerInventory_GetItemInLoadout). Non-virtual inventory method resolving a player's loadout item. Shortlist via callers inside CCSPlayerInventory code that walk the loadout item cache (m_pSOCache / CGCClientSharedObjectCache), and via the CSO/econ loadout message paths. The function takes an item definition index + loadout slot and returns the matching CEconItemView — the body iterates a small item list comparing definition indices and loadout slots. Trigger: CCSPlayerInventory_GetItemInLoadout, CCSPlayerInventory::GetItemInLoadout

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayerController_InventoryServices::m_pInventory in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CCSPlayerController_InventoryServices::m_pInventory" (symbol CCSPlayerController_InventoryServices_m_pInventory). This is a STRUCT MEMBER OFFSET (schema netvar), not a function. Resolve the CCSPlayerController_InventoryServices class layout via the schema/network system; m_pInventory is an 8-byte pointer member early in the class (must stay 8-aligned). Cross-check: functions of the class dereference this->m_pInventory shortly after entry. Trigger: CCSPlayerController_InventoryServices_m_pInventory, CCSPlayerController_InventoryServices::m_pInventory

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayer_MovementServices::Pawn in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the local gamedata entry "CCSPlayer_MovementServices::Pawn" (symbol CCSPlayer_MovementServices_Pawn). This is a STRUCT MEMBER OFFSET (schema netvar), not a function. Resolve the CCSPlayer_MovementServices class layout via the schema/network system; the member must satisfy natural alignment. Cross-check with functions that dereference the member. Do not switch output schema: emit the structmember fields below even if the class turns out to be polymorphic - a func_*/vfunc_* payload for this symbol is rejected by canonical_symbol_yaml_bytes. Trigger: CCSPlayer_MovementServices_Pawn, CCSPlayer_MovementServices::Pawn

日本語の概要は準備中です。原文の説明を表示しています。

Find and patch the water jump velocity inside CCSPlayer_MovementServices_CheckJumpButton in CS2 binary using IDA Pro MCP. This patch changes the water jump velocity from 100.0f to 145.0f by modifying the immediate operand of a mov instruction. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate and patch the water jump height value. Trigger: water jump patch, CheckJumpButton water velocity, jump height patch, water jump 145

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSPlayer_ItemServices::SetWearables in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the WeaponPaints gamedata entry "CCSPlayer_ItemServices::SetWearables" (symbol CCSPlayer_ItemServices_SetWearables). VIRTUAL function, but WeaponPaints consumes it as a byte signature. Resolve the CCSPlayer_ItemServices vtable via RTTI to locate the slot, then generate a function-head byte signature of the resolved function. The body copies wearable item handles into the pawn's wearable array (m_Item wearables netvar array) and marks state changed. Trigger: CCSPlayer_ItemServices_SetWearables, CCSPlayer_ItemServices::SetWearables

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CCSPlayer_ItemServices_GiveNamedItem virtual function, the CCSPlayer_WeaponServices_Weapon_GetSlot helper, and the CBasePlayerPawn_RemovePlayerItem helper in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate GiveNamedItem by RTTI-walking the CCSPlayer_ItemServices vtable, then to locate the other two by decompiling the already-known CCSPlayer_ItemServices_GiveDefaultItems anchor and matching its callees' argument shapes and inventory-slot bookkeeping semantics. Trigger: CCSPlayer_ItemServices_GiveNamedItem, CCSPlayer_WeaponServices_Weapon_GetSlot, CBasePlayerPawn_RemovePlayerItem

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CCSGameRules::TerminateRound function in the CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the round-end-processing function by finding the code that references both the bare "TerminateRound" debug tag string and the "TerminateRound: unknown round end ID %i\n" warning-format string — both are referenced from the same function. Trigger: CCSGameRules_TerminateRound

日本語の概要は準備中です。原文の説明を表示しています。

Locate CCSGameRules::SameMapTeardown in CS2 server.dll / libserver.so via IDA Pro MCP and emit a fresh, minimal-unique signature or offset for the local gamedata entry "CCSGameRules::SameMapTeardown" (symbol CCSGameRules_SameMapTeardown). This is a non-virtual function - emit a byte signature (func_sig), not an offset. Locate it via cross-references, distinctive constants/strings in its body, or callers of related symbols; verify by decompilation before committing to a candidate. Trigger: CCSGameRules_SameMapTeardown, CCSGameRules::SameMapTeardown

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CCSGameRules_ResetRound function in CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the round-reset routine. It is the only function that references the "GMR_ResetRound\n" debug log string, and is the predecessor anchor for find-CCSGameRules_PostCleanUp (which it calls). Emits a unique IDA-style byte signature and a func YAML. Mirrors the find-CCSGameRules_ResetRound.py preprocessor (xref_strings "GMR_ResetRound\n"). Trigger: CCSGameRules_ResetRound, ResetRound, GMR_ResetRound

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CCSPlayer_WeaponServices_EquipWeapon function and the CCSPlayer_WeaponServices_CanUse virtual function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the weapon-equip helper and the "is this weapon usable right now" vfunc by RTTI-walking the CCSPlayer_WeaponServices vtable and confirming each candidate's decompiled body against the known CCSPlayer_WeaponServices_PickupItem anchor's callee shapes. Trigger: CCSPlayer_WeaponServices_EquipWeapon, CCSPlayer_WeaponServices_CanUse

日本語の概要は準備中です。原文の説明を表示しています。