Ida Pro Skill

ida-pro-skill

Drive static analysis against a live IDA database from Codex, Claude Code, or OpenCode.

If the skill is not installed yet, the supported repo entrypoint is root ./install.sh.

Operating Rules

• Default to static analysis only.
• Do not execute the target binary.
• Prefer built-in aliases before raw ida tool ... or IDAPython.
• Treat py-eval, py-file, patch-bytes, and define-function as

deliberate, higher-risk actions.

• Keep REMOTE_ACCESS = False unless the user explicitly wants another

machine to connect.

Quick Workflow

1. Confirm the local installation if needed:

python3 scripts/run_cli.py doctor

1. Discover live IDA instances:

python3 scripts/run_cli.py ida list-instances

1. Inspect bridge and database state before analysis:

python3 scripts/run_cli.py ida metadata python3 scripts/run_cli.py ida tools Read access_mode, remote_access_enabled, input_path, idb_path, imagebase, and available tools.

1. If multiple instances are running, select one:

python3 scripts/run_cli.py ida select --instance 127.0.0.1:39091

1. Use short aliases first; use raw ida tool ... only for unaliased bridge

methods.

Command Selection

• Overview: ida metadata, ida cursor, ida selection, ida segments,

ida entrypoints, ida tools

• Function map: ida functions --limit 20, ida function ,

ida callers , ida xrefs-to , ida xrefs-from

• Code understanding: ida decompile , ida disassemble ,

ida imports --query , ida import-callers , ida strings --query , ida string-xrefs , ida globals

• Types: ida structs --query --limit 20, then

ida struct

• Offline context: ida export-ai [output_dir] --query --limit 100
• IDB updates: ida rename , ida comment ,

ida append-comment , ida patch-bytes "90 90", ida define-function

• Python escape hatch: ida py-eval "print(hex(here()))",

cat script.py | python3 scripts/run_cli.py ida py-eval --stdin, ida py-file /tmp/script.py

Analysis Heuristics

• Start from cursor/selection when the user references the current IDA view.
• Use ida import-callers for Windows API tracing instead of manually

copying import addresses.

• Use ida string-xrefs for user-visible strings before issuing manual

xref calls.

• Use ida structs --query ... before ida struct ... to avoid unbounded type

dumps.

• Use ida decompile first; fall back to ida disassemble when Hex-Rays is

unavailable or pseudocode is misleading.

• Use ida export-ai when the user wants a source-tree-style handoff for

broader AI IDE indexing. Keep it bounded by default; use --all-functions or --all-strings only after explicit user intent.

WSL And Connectivity

• Trust discovered host candidates; do not assume 127.0.0.1 reaches

Windows-hosted IDA from WSL.

• If WSL cmd.exe interop is unavailable, discovery can still use mounted

Windows registry files such as /mnt/c/Users//.ida-pro-skill/instances.

• Treat ida export-ai output paths as paths from the IDA process perspective.

If IDA runs on Windows and Codex runs in WSL, omit output_dir or use a Windows path.

• Diagnose bridge access with access_mode and remote_access_enabled from

ida metadata or ida tools; do not recommend enabling REMOTE_ACCESS unless the user explicitly wants external-machine access.

• Run heavy bridge calls such as decompile, export-ai, and py-eval

serially.

References

• Read references/workflow.md for full analysis flow.
• Read references/cli-reference.md for command details.
• Read references/safety.md before write operations or IDAPython.
• Read references/troubleshooting.md for discovery, WSL, or bridge failures.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: timwhitez
• Source: timwhitez/ida-pro-skill
• License: MIT

Install and usage instructions live in the source repository linked above.