idapython

Category: Development & Coding | Uploader: Captain-AI-Hub | Downloads: 0 | Version: v1.0（Latest）

IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.

Changelog: Source: GitHub https://github.com/Captain-AI-Hub/IDA-MCP

Directory Structure

Current level: tree/main/skills/idapython/

📁 docs/
- 📄 ida_auto.md 1.7 KB
- 📄 ida_auto.rst 10.2 KB
- 📄 ida_bitrange.md 652 B
- 📄 ida_bitrange.rst 2.0 KB
- 📄 ida_bytes.md 4.0 KB
- 📄 ida_bytes.rst 93.1 KB
- 📄 ida_dbg.md 3.8 KB
- 📄 ida_dbg.rst 74.7 KB
- 📄 ida_dirtree.md 1.9 KB
- 📄 ida_dirtree.rst 16.5 KB
- 📄 ida_diskio.md 2.2 KB
- 📄 ida_diskio.rst 7.0 KB
- 📄 ida_entry.md 1.0 KB
- 📄 ida_entry.rst 3.8 KB
- 📄 ida_expr.md 3.5 KB
- 📄 ida_expr.rst 19.2 KB
- 📄 ida_fixup.md 2.8 KB
- 📄 ida_fixup.rst 9.5 KB
- 📄 ida_fpro.md 1.6 KB
- 📄 ida_fpro.rst 3.5 KB
- 📄 ida_frame.md 4.8 KB
- 📄 ida_frame.rst 21.2 KB
- 📄 ida_funcs.md 7.5 KB
- 📄 ida_funcs.rst 33.0 KB
- 📄 ida_gdl.md 1.5 KB
- 📄 ida_gdl.rst 11.8 KB
- 📄 ida_graph.md 2.0 KB
- 📄 ida_graph.rst 41.0 KB
- 📄 ida_hexrays.md 5.5 KB
- 📄 ida_hexrays.rst 371.4 KB
- 📄 ida_ida.md 2.6 KB
- 📄 ida_ida.rst 68.5 KB
- 📄 ida_idaapi.md 1.3 KB
- 📄 ida_idaapi.rst 14.4 KB
- 📄 ida_idc.md 381 B
- 📄 ida_idc.rst 439 B
- 📄 ida_idd.md 1.5 KB
- 📄 ida_idd.rst 64.8 KB
- 📄 ida_idp.md 1.4 KB
- 📄 ida_idp.rst 133.1 KB
- 📄 ida_ieee.md 1.0 KB
- 📄 ida_ieee.rst 5.1 KB
- 📄 ida_kernwin.md 2.0 KB
- 📄 ida_kernwin.rst 228.2 KB
- 📄 ida_libfuncs.md 966 B
- 📄 ida_libfuncs.rst 3.0 KB
- 📄 ida_lines.md 1.1 KB
- 📄 ida_lines.rst 16.0 KB
- 📄 ida_loader.md 3.5 KB
- 📄 ida_loader.rst 21.2 KB
- 📄 ida_merge.md 1.3 KB
- 📄 ida_merge.rst 25.3 KB
- 📄 ida_mergemod.md 740 B
- 📄 ida_mergemod.rst 3.8 KB
- 📄 ida_moves.md 2.7 KB
- 📄 ida_moves.rst 7.4 KB
- 📄 ida_nalt.md 9.3 KB
- 📄 ida_nalt.rst 52.4 KB
- 📄 ida_name.md 7.0 KB
- 📄 ida_name.rst 27.9 KB
- 📄 ida_netnode.md 1.1 KB
- 📄 ida_netnode.rst 12.1 KB
- 📄 ida_offset.md 996 B
- 📄 ida_offset.rst 7.7 KB
- 📄 ida_pro.md 1.3 KB
- 📄 ida_pro.rst 31.9 KB
- 📄 ida_problems.md 1.2 KB
- 📄 ida_problems.rst 4.1 KB
- 📄 ida_range.md 1.8 KB
- 📄 ida_range.rst 10.5 KB
- 📄 ida_regfinder.md 2.7 KB
- 📄 ida_regfinder.rst 16.1 KB
- 📄 ida_registry.md 1.7 KB
- 📄 ida_registry.rst 6.0 KB
- 📄 ida_search.md 1.4 KB
- 📄 ida_search.rst 3.1 KB
- 📄 ida_segment.md 4.9 KB
- 📄 ida_segment.rst 37.9 KB
- 📄 ida_segregs.md 1.8 KB
- 📄 ida_segregs.rst 6.3 KB
- 📄 ida_srclang.md 1.4 KB
- 📄 ida_srclang.rst 4.2 KB
- 📄 ida_strlist.md 1.0 KB
- 📄 ida_strlist.rst 2.0 KB
- 📄 ida_tryblks.md 1.4 KB
- 📄 ida_tryblks.rst 7.4 KB
- 📄 ida_typeinf.md 7.6 KB
- 📄 ida_typeinf.rst 202.2 KB
- 📄 ida_ua.md 2.2 KB
- 📄 ida_ua.rst 43.6 KB
- 📄 ida_undo.md 768 B
- 📄 ida_undo.rst 1.2 KB
- 📄 ida_xref.md 1.9 KB
- 📄 ida_xref.rst 15.0 KB
- 📄 idaapi.md 317 B
- 📄 idaapi.rst 270 B
- 📄 idadex.md 2.0 KB
- 📄 idadex.rst 3.9 KB
- 📄 idautils.md 3.2 KB
- 📄 idautils.rst 9.8 KB
- 📄 idc.md 10.8 KB
- 📄 idc.rst 119.1 KB
- 📄 init.md 752 B
- 📄 init.rst 1.5 KB
📄 SKILL.md 4.9 KB

SKILL.md

---
name: idapython
description: IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.
---

# IDAPython

Use modern `ida_*` modules. Avoid legacy `idc` module.

## Module Router

| Task | Module | Key Items |
|------|--------|-----------|
| Bytes/memory | `ida_bytes` | `get_bytes`, `patch_bytes`, `get_flags`, `create_*` |
| Functions | `ida_funcs` | `func_t`, `get_func`, `add_func`, `get_func_name` |
| Names | `ida_name` | `set_name`, `get_name`, `demangle_name` |
| Types | `ida_typeinf` | `tinfo_t`, `apply_tinfo`, `parse_decl` |
| Decompiler | `ida_hexrays` | `decompile`, `cfunc_t`, `lvar_t`, ctree visitor |
| Segments | `ida_segment` | `segment_t`, `getseg`, `add_segm` |
| Xrefs | `ida_xref` | `xrefblk_t`, `add_cref`, `add_dref` |
| Instructions | `ida_ua` | `insn_t`, `op_t`, `decode_insn` |
| Stack frames | `ida_frame` | `get_frame`, `define_stkvar` |
| Iteration | `idautils` | `Functions()`, `Heads()`, `XrefsTo()`, `Strings()` |
| UI/dialogs | `ida_kernwin` | `msg`, `ask_*`, `jumpto`, `Choose` |
| Database info | `ida_ida` | `inf_get_*`, `inf_is_64bit()` |
| Analysis | `ida_auto` | `auto_wait`, `plan_and_wait` |
| Flow graphs | `ida_gdl` | `FlowChart`, `BasicBlock` |
| Register tracking | `ida_regfinder` | `find_reg_value`, `reg_value_info_t` |

## Core Patterns

### Iterate functions
```python
for ea in idautils.Functions():
    name = ida_funcs.get_func_name(ea)
    func = ida_funcs.get_func(ea)
```

### Iterate instructions in function
```python
for head in idautils.FuncItems(func_ea):
    insn = ida_ua.insn_t()
    if ida_ua.decode_insn(insn, head):
        print(f"{head:#x}: {insn.itype}")
```

### Cross-references
```python
for xref in idautils.XrefsTo(ea):
    print(f"{xref.frm:#x} -> {xref.to:#x} type={xref.type}")
```

### Read/write bytes
```python
data = ida_bytes.get_bytes(ea, size)
ida_bytes.patch_bytes(ea, b"\x90\x90")
```

### Names
```python
name = ida_name.get_name(ea)
ida_name.set_name(ea, "new_name", ida_name.SN_NOCHECK)
```

### Decompile function
```python
cfunc = ida_hexrays.decompile(ea)
if cfunc:
    print(cfunc)  # pseudocode
    for lvar in cfunc.lvars:
        print(f"{lvar.name}: {lvar.type()}")
```

### Walk ctree (decompiled AST)
```python
class MyVisitor(ida_hexrays.ctree_visitor_t):
    def visit_expr(self, e):
        if e.op == ida_hexrays.cot_call:
            print(f"Call at {e.ea:#x}")
        return 0

cfunc = ida_hexrays.decompile(ea)
MyVisitor().apply_to(cfunc.body, None)
```

### Apply type
```python
tif = ida_typeinf.tinfo_t()
if ida_typeinf.parse_decl(tif, None, "int (*)(char *, int)", 0):
    ida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)
```

### Create structure
```python
udt = ida_typeinf.udt_type_data_t()
m = ida_typeinf.udm_t()
m.name = "field1"
m.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)
m.offset = 0
m.size = 4
udt.push_back(m)
tif = ida_typeinf.tinfo_t()
tif.create_udt(udt, ida_typeinf.BTF_STRUCT)
tif.set_named_type(ida_typeinf.get_idati(), "MyStruct")
```

### Strings list
```python
for s in idautils.Strings():
    print(f"{s.ea:#x}: {str(s)}")
```

### Wait for analysis
```python
ida_auto.auto_wait()  # Block until autoanalysis completes
```

## Key Constants

| Constant | Value/Use |
|----------|-----------|
| `BADADDR` | Invalid address sentinel |
| `ida_name.SN_NOCHECK` | Skip name validation |
| `ida_typeinf.TINFO_DEFINITE` | Force type application |
| `o_reg`, `o_mem`, `o_imm`, `o_displ`, `o_near` | Operand types |
| `dt_byte`, `dt_word`, `dt_dword`, `dt_qword` | Data types |
| `fl_CF`, `fl_CN`, `fl_JF`, `fl_JN`, `fl_F` | Code xref types |
| `dr_R`, `dr_W`, `dr_O` | Data xref types |

## Critical Rules

1. **NEVER convert hex/decimal manually** — use `int_convert` MCP tool
2. **Wait for analysis**: Call `ida_auto.auto_wait()` before reading results
3. **Thread safety**: IDA SDK calls must run on main thread (use `@idasync`)
4. **64-bit addresses**: Always assume `ea_t` can be 64-bit

## Anti-Patterns

| Avoid | Do Instead |
|-------|------------|
| `idc.*` functions | Use `ida_*` modules |
| Hardcoded addresses | Use names, patterns, or xrefs |
| Manual hex conversion | Use `int_convert` tool |
| Blocking main thread | Use `execute_sync()` for long ops |
| Guessing at types | Derive from disassembly/decompilation |

## Detailed API Reference

For comprehensive documentation on any module, read `docs/<module>.md`:
- **High-use**: `ida_bytes`, `ida_funcs`, `ida_hexrays`, `ida_typeinf`, `ida_name`, `idautils`
- **Medium-use**: `ida_segment`, `ida_xref`, `ida_ua`, `ida_frame`, `ida_kernwin`
- **Specialized**: `ida_dbg` (debugger), `ida_nalt` (netnode storage), `ida_regfinder` (register tracking)

Full RST sources from hex-rays.com available at `docs/<module>.rst`.

Comments 0

Latest | Hot

Please login before commenting.

Loading comments...

idapython

Directory Structure

SKILL.md

Report

Notice