Skip to main content IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.
npx skills add mrexodia/ida-pro-mcp --skill idapython ida-plugin ida-pro mcp mcp-server modelcontextprotocol reverse-engineering
IDAPython
Use modern ida_* modules. Avoid legacy idc module.
Module Router
Task Module Key Items Bytes/memory ida_bytesget_bytes, patch_bytes, get_flags, create_*Functions ida_funcs
func_t, get_func, add_func, get_func_name
Names ida_nameset_name, get_name, demangle_name
Types ida_typeinftinfo_t, apply_tinfo, parse_decl
Decompiler ida_hexraysdecompile, cfunc_t, lvar_t, ctree visitor
Segments ida_segmentsegment_t, getseg, add_segm
Xrefs ida_xrefxrefblk_t, add_cref, add_dref
Instructions ida_uainsn_t, op_t, decode_insn
Stack frames ida_frameget_frame, define_stkvar
Iteration idautilsFunctions(), Heads(), XrefsTo(), Strings()
UI/dialogs ida_kernwinmsg, ask_*, jumpto, Choose
Database info ida_idainf_get_*, inf_is_64bit()
Analysis ida_autoauto_wait, plan_and_wait
Flow graphs ida_gdlFlowChart, BasicBlock
Register tracking ida_regfinderfind_reg_value, reg_value_info_t
Core Patterns
Iterate functions for ea in idautils.Functions():
name = ida_funcs.get_func_name(ea)
func = ida_funcs.get_func(ea)
Iterate instructions in function for head in idautils.FuncItems(func_ea):
insn = ida_ua.insn_t()
if ida_ua.decode_insn(insn, head):
print(f"{head:#x}: {insn.itype}")
Cross-references for xref in idautils.XrefsTo(ea):
print(f"{xref.frm:#x} -> {xref.to:#x} type={xref.type}")
Read/write bytes data = ida_bytes.get_bytes(ea, size)
ida_bytes.patch_bytes(ea, b"\x90\x90")
Names name = ida_name.get_name(ea)
ida_name.set_name(ea, "new_name", ida_name.SN_NOCHECK)
Decompile function cfunc = ida_hexrays.decompile(ea)
if cfunc:
print(cfunc) # pseudocode
for lvar in cfunc.lvars:
print(f"{lvar.name}: {lvar.type()}")
Walk ctree (decompiled AST) class MyVisitor(ida_hexrays.ctree_visitor_t):
def visit_expr(self, e):
if e.op == ida_hexrays.cot_call:
print(f"Call at {e.ea:#x}")
return 0
cfunc = ida_hexrays.decompile(ea)
MyVisitor().apply_to(cfunc.body, None)
Apply type tif = ida_typeinf.tinfo_t()
if ida_typeinf.parse_decl(tif, None, "int (*)(char *, int)", 0):
ida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)
Create structure udt = ida_typeinf.udt_type_data_t()
m = ida_typeinf.udm_t()
m.name = "field1"
m.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)
m.offset = 0
m.size = 4
udt.push_back(m)
tif = ida_typeinf.tinfo_t()
tif.create_udt(udt, ida_typeinf.BTF_STRUCT)
tif.set_named_type(ida_typeinf.get_idati(), "MyStruct")
Strings list for s in idautils.Strings():
print(f"{s.ea:#x}: {str(s)}")
Wait for analysis ida_auto.auto_wait() # Block until autoanalysis completes
Key Constants Constant Value/Use BADADDRInvalid address sentinel ida_name.SN_NOCHECKSkip name validation ida_typeinf.TINFO_DEFINITEForce type application o_reg, o_mem, o_imm, o_displ, o_nearOperand types dt_byte, dt_word, dt_dword, dt_qwordData types fl_CF, fl_CN, fl_JF, fl_JN, fl_FCode xref types dr_R, dr_W, dr_OData xref types
Critical Rules
NEVER convert hex/decimal manually — use int_convert MCP toolWait for analysis : Call ida_auto.auto_wait() before reading resultsThread safety : IDA SDK calls must run on main thread (use @idasync)64-bit addresses : Always assume ea_t can be 64-bit
Anti-Patterns Avoid Do Instead idc.* functionsUse ida_* modules Hardcoded addresses Use names, patterns, or xrefs Manual hex conversion Use int_convert tool Blocking main thread Use execute_sync() for long ops Guessing at types Derive from disassembly/decompilation
Detailed API Reference For comprehensive documentation on any module, read docs/<module>.md:
High-use : ida_bytes, ida_funcs, ida_hexrays, ida_typeinf, ida_name, idautilsMedium-use : ida_segment, ida_xref, ida_ua, ida_frame, ida_kernwinSpecialized : ida_dbg (debugger), ida_nalt (netnode storage), ida_regfinder (register tracking) Full RST sources from hex-rays.com available at docs/<module>.rst.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
