Skip to main content
Glama

find_hook_target

Read-onlyIdempotent

Locates a method’s hookable runtime address and returns its RVA and token, resolving nested names and rejecting ambiguous matches so you can confirm and hook the correct overload.

Instructions

定位某个方法可 Hook 的地址(含 RVA 与 token)。同样支持完整嵌套名,歧义时拒绝。

这是「从静态元数据到 Hook 落点」的关键一步: 先用 search_classes/class_detail 从元数据确认目标方法(拿到 token), 再用本工具在运行时把类实体化,拿到真实地址; 最后用返回的 token 与静态 token 比对,确认挂的是同一个方法。

返回的每个 candidate 里 address 可直接喂给 hook_address; rva_hex 可与静态元数据的 RVA 对照,token 用于确认是同一个重载。

Args: name: 类名(短名即可;嵌套类型传完整嵌套名)。 method: 方法名(重载时看 candidates 的 param_count 区分)。 namespace: 命名空间(可选)。不给时按短名在顶层类型里解析, 唯一才采用,多个则返回 ambiguous: true + candidates。 image: 程序集名。

Input Schema

NameRequiredDescriptionDefault
nameYes
imageNo
methodYes
namespaceNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare this is a read-only, idempotent, open-world, non-destructive lookup, so the safety profile is covered. The description still adds real context beyond that: it discloses that the class is materialized at runtime (a side effect beyond pure metadata reads) and defines the ambiguity outcome with its payload. It does not discuss cost, failures, or whether materialization affects game state, which keeps it at 4 rather than 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence front-loads the core purpose, and the workflow block is genuinely load-bearing for correct invocation. It is longer than strictly necessary — the closing per-field notes on address/rva_hex/token partly repeat the workflow paragraph — but no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must explain return values, and it does: candidates containing address (feedable to hook_address), rva_hex (comparable to static RVA), token (confirms the same overload), plus the ambiguous flag. Combined with the documented params and annotations, an agent has everything needed to call and interpret it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden, and it does: name accepts a short name but nested types need the full nested name; method overloads are disambiguated via param_count on candidates; namespace is optional, and when omitted resolution is restricted to top-level types and only adopted if unique, otherwise ambiguous. That is meaning well beyond the bare typed properties.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: locate the hookable address (with RVA and token) of a method. It distinguishes itself from the sibling tools it names explicitly (search_classes/class_detail for static lookup, hook_address for consuming the result), so an agent can place it in the pipeline without opening the schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit three-step workflow: first confirm the target method in static metadata with search_classes/class_detail and capture its token, then call this tool to materialize the class at runtime, then compare the returned token with the static token. It also states the failure behavior when the name is ambiguous (returns ambiguous: true plus candidates), which is exactly the when-not case an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.