IDA Pro MCP

1---
2name: idapython
3description: IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.
4---
5 
6# IDAPython
7 
8Use modern `ida_*` modules. Avoid legacy `idc` module.
9 
10## Module Router
11 
12| Task | Module | Key Items |
13|------|--------|-----------|
14| Bytes/memory | `ida_bytes` | `get_bytes`, `patch_bytes`, `get_flags`, `create_*` |
15| Functions | `ida_funcs` | `func_t`, `get_func`, `add_func`, `get_func_name` |
16| Names | `ida_name` | `set_name`, `get_name`, `demangle_name` |
17| Types | `ida_typeinf` | `tinfo_t`, `apply_tinfo`, `parse_decl` |
18| Decompiler | `ida_hexrays` | `decompile`, `cfunc_t`, `lvar_t`, ctree visitor |
19| Segments | `ida_segment` | `segment_t`, `getseg`, `add_segm` |
20| Xrefs | `ida_xref` | `xrefblk_t`, `add_cref`, `add_dref` |
21| Instructions | `ida_ua` | `insn_t`, `op_t`, `decode_insn` |
22| Stack frames | `ida_frame` | `get_frame`, `define_stkvar` |
23| Iteration | `idautils` | `Functions()`, `Heads()`, `XrefsTo()`, `Strings()` |
24| UI/dialogs | `ida_kernwin` | `msg`, `ask_*`, `jumpto`, `Choose` |
25| Database info | `ida_ida` | `inf_get_*`, `inf_is_64bit()` |
26| Analysis | `ida_auto` | `auto_wait`, `plan_and_wait` |
27| Flow graphs | `ida_gdl` | `FlowChart`, `BasicBlock` |
28| Register tracking | `ida_regfinder` | `find_reg_value`, `reg_value_info_t` |
29 
30## Core Patterns
31 
32### Iterate functions
33```python
34for ea in idautils.Functions():
35    name = ida_funcs.get_func_name(ea)
36    func = ida_funcs.get_func(ea)
37```
38 
39### Iterate instructions in function
40```python
41for head in idautils.FuncItems(func_ea):
42    insn = ida_ua.insn_t()
43    if ida_ua.decode_insn(insn, head):
44        print(f"{head:#x}: {insn.itype}")
45```
46 
47### Cross-references
48```python
49for xref in idautils.XrefsTo(ea):
50    print(f"{xref.frm:#x} -> {xref.to:#x} type={xref.type}")
51```
52 
53### Read/write bytes
54```python
55data = ida_bytes.get_bytes(ea, size)
56ida_bytes.patch_bytes(ea, b"\x90\x90")
57```
58 
59### Names
60```python
61name = ida_name.get_name(ea)
62ida_name.set_name(ea, "new_name", ida_name.SN_NOCHECK)
63```
64 
65### Decompile function
66```python
67cfunc = ida_hexrays.decompile(ea)
68if cfunc:
69    print(cfunc)  # pseudocode
70    for lvar in cfunc.lvars:
71        print(f"{lvar.name}: {lvar.type()}")
72```
73 
74### Walk ctree (decompiled AST)
75```python
76class MyVisitor(ida_hexrays.ctree_visitor_t):
77    def visit_expr(self, e):
78        if e.op == ida_hexrays.cot_call:
79            print(f"Call at {e.ea:#x}")
80        return 0
81 
82cfunc = ida_hexrays.decompile(ea)
83MyVisitor().apply_to(cfunc.body, None)
84```
85 
86### Apply type
87```python
88tif = ida_typeinf.tinfo_t()
89if ida_typeinf.parse_decl(tif, None, "int (*)(char *, int)", 0):
90    ida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)
91```
92 
93### Create structure
94```python
95udt = ida_typeinf.udt_type_data_t()
96m = ida_typeinf.udm_t()
97m.name = "field1"
98m.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)
99m.offset = 0
100m.size = 4
101udt.push_back(m)
102tif = ida_typeinf.tinfo_t()
103tif.create_udt(udt, ida_typeinf.BTF_STRUCT)
104tif.set_named_type(ida_typeinf.get_idati(), "MyStruct")
105```
106 
107### Strings list
108```python
109for s in idautils.Strings():
110    print(f"{s.ea:#x}: {str(s)}")
111```
112 
113### Wait for analysis
114```python
115ida_auto.auto_wait()  # Block until autoanalysis completes
116```
117 
118## Key Constants
119 
120| Constant | Value/Use |
121|----------|-----------|
122| `BADADDR` | Invalid address sentinel |
123| `ida_name.SN_NOCHECK` | Skip name validation |
124| `ida_typeinf.TINFO_DEFINITE` | Force type application |
125| `o_reg`, `o_mem`, `o_imm`, `o_displ`, `o_near` | Operand types |
126| `dt_byte`, `dt_word`, `dt_dword`, `dt_qword` | Data types |
127| `fl_CF`, `fl_CN`, `fl_JF`, `fl_JN`, `fl_F` | Code xref types |
128| `dr_R`, `dr_W`, `dr_O` | Data xref types |
129 
130## Critical Rules
131 
1321. **NEVER convert hex/decimal manually** — use `int_convert` MCP tool
1332. **Wait for analysis**: Call `ida_auto.auto_wait()` before reading results
1343. **Thread safety**: IDA SDK calls must run on main thread (use `@idasync`)
1354. **64-bit addresses**: Always assume `ea_t` can be 64-bit
136 
137## Anti-Patterns
138 
139| Avoid | Do Instead |
140|-------|------------|
141| `idc.*` functions | Use `ida_*` modules |
142| Hardcoded addresses | Use names, patterns, or xrefs |
143| Manual hex conversion | Use `int_convert` tool |
144| Blocking main thread | Use `execute_sync()` for long ops |
145| Guessing at types | Derive from disassembly/decompilation |
146 
147## Detailed API Reference
148 
149For comprehensive documentation on any module, read `docs/<module>.md`:
150- **High-use**: `ida_bytes`, `ida_funcs`, `ida_hexrays`, `ida_typeinf`, `ida_name`, `idautils`
151- **Medium-use**: `ida_segment`, `ida_xref`, `ida_ua`, `ida_frame`, `ida_kernwin`
152- **Specialized**: `ida_dbg` (debugger), `ida_nalt` (netnode storage), `ida_regfinder` (register tracking)
153 
154Full RST sources from hex-rays.com available at `docs/<module>.rst`.
155