struct-offset-analyzer

Statically analyze C struct member offsets through code reading to calculate memory layouts

Security Scan

The skill is an instruction-only guide for statically computing C struct offsets; its requested footprint (no installs, no credentials) matches its stated purpose.

Purpose & Capability

The name/description (static C struct offset analysis) match the SKILL.md workflow: searching headers, collecting type info, and applying alignment rules. No unrelated credentials, binaries, or installs are requested.

Instruction Scope

Instructions stay within scope (search local source files, compute offsets, consider #ifdef/#pragma). Minor technical inaccuracies and oversimplifications appear in the alignment rules (e.g., text says 'Member offset must be a multiple of its size' when it should reference alignment requirements), but these are correctness issues rather than evidence of malicious behavior.

Install Mechanism

No install spec and no code files are included; this is instruction-only so nothing is written to disk or fetched at install time.

Credentials

The skill requests no environment variables, credentials, or config paths — proportional to an offline, static-analysis guide.

Persistence & Privilege

always is false, the skill is user-invocable and does not request persistent presence or modify other skills or system settings.

Assessment

This skill is an instruction-only guide that will tell an agent how to search your codebase and compute struct offsets; it does not fetch code or require credentials. Before using it: (1) be aware the alignment/size table is an oversimplification—verify results against the target compiler/ABI (use offsetof/sizeof in a build or compiler docs); (2) take into account conditional compilation and #pragma pack in the target source; and (3) remember the skill's grep-based steps will scan your repository files, so do not run it against sensitive locations you don't want searched. Overall the package is internally coherent and does what it claims, but double-check computed offsets with a compiler when precision is critical.

Statically analyze the memory offsets of C language struct members without needing to run code.

Use Cases

• Locating struct members during reverse engineering
• Confirming memory layouts during debugging
• Analyzing data structures in security research
• Understanding struct field positions in binary analysis

Workflow

1. Locate Struct Definition

# Search for struct definition
grep -n "struct xxx_st {" **/*.h
grep -n "typedef struct" **/*.h

2. Collect Type Information

Find definitions for all member types:

• Nested structs
• Enum types
• typedef aliases
• Constant definitions (e.g., #define EVP_MAX_MD_SIZE 64)

3. Calculate Alignment Rules

Type	Size (64-bit)	Alignment Requirement
char/unsigned char	1	1
short	2	2
int/uint32_t	4	4
long/size_t/pointer	8	8
unsigned char[N]	N	1 (no padding needed)
enum	usually 4	4
struct	depends on members	aligned to largest member

Key Rules:

• Member offset must be a multiple of its size
• unsigned char arrays are 1-byte aligned, no padding required
• Overall struct size is aligned to the size of its largest member
• Padding bytes count toward offsets

4. Output Offset Table

Use hexadecimal representation for offsets, format:

| Offset(0x) | Member | Type | Size |
|------------|--------|------|------|
| 0x00 | field1 | int | 4 |
| 0x04 | *(padding)* | - | 4 |
| 0x08 | field2 | void * | 8 |

Common Search Patterns

# Find struct member definition
grep -n "struct xxx_st" **/*.h

# Find type definition
grep -n "typedef.*XXX" **/*.h

# Find constant definition
grep -n "#define.*SIZE" **/*.h

# Find enum definition
grep -n "typedef enum" **/*.h

Example: OpenSSL ssl_st Analysis

Analyzing client_app_traffic_secret member offset:

1. Locate struct: ssl/ssl_local.h:1068
2. Find constant: EVP_MAX_MD_SIZE = 64 (include/openssl/evp.h:19)
3. Calculate layout, note that unsigned char arrays need no padding
4. Result: offset 0x33c (828 bytes)

Notes

• Confirm target platform (32-bit vs 64-bit)
• Note that conditional compilation (#ifdef) may affect struct layout
• Check for #pragma pack directives that may change alignment
• Union members share the same offset