Loading...
Loading...
Export IDA Pro decompiled code and memory for AI-assisted reverse engineering
npx skill4agent add aradotso/mcp-skills ida-no-mcp-decompiler-exporterSkill by ara.so — MCP Skills collection.
.c.asmINP.py%APPDATA%\Hex-Rays\IDA Pro\plugins\~/.idapro/plugins/Ctrl-Shift-EEditPluginsExport for AIINP.pyAlt-F7# From IDA script window
execfile('/path/to/INP.py')your_binary.idb/
├── decompile/ # Decompiled C code (.c files)
├── disassembly/ # Fallback assembly (.asm files)
├── memory/ # Memory dumps (hexdump format)
├── strings.txt # All strings with addresses
├── imports.txt # Import table
├── exports.txt # Export table
├── disassembly_fallback.txt # List of fallback functions
├── decompile_failed.txt # Complete failures
└── decompile_skipped.txt # Skipped library/invalid functions/*
* func-name: sub_401000
* func-address: 0x401000
* export-type: decompile
* callers: 0x402000, 0x403000
* callees: 0x404000, 0x405000
*/
__int64 __fastcall sub_401000(__int64 a1, int a2)
{
// Decompiled code here
return result;
}.asm/*
* func-name: sub_401000
* func-address: 0x401000
* export-type: disassembly
* callers: 0x402000, 0x403000
* callees: 0x404000, 0x405000
*/
sub_401000 proc near
push rbp
mov rbp, rsp
; ... assembly code
ret
sub_401000 endpimport idaapi
import idc
import idautils
import ida_hexrays
import ida_funcs
import os
def export_decompiled_code(func_ea):
"""Export decompiled code for a function"""
try:
# Get function name
func_name = idc.get_func_name(func_ea)
# Get callers and callees
callers = [hex(xref.frm) for xref in idautils.XrefsTo(func_ea, 0)]
callees = []
for item_ea in idautils.FuncItems(func_ea):
for xref in idautils.XrefsFrom(item_ea, 0):
if xref.type in [ida_xref.fl_CN, ida_xref.fl_CF]:
callees.append(hex(xref.to))
# Try decompilation
cfunc = idaapi.decompile(func_ea)
if cfunc:
decompiled = str(cfunc)
# Build metadata header
header = f"""/*
* func-name: {func_name}
* func-address: {hex(func_ea)}
* export-type: decompile
* callers: {', '.join(callers) if callers else 'none'}
* callees: {', '.join(callees) if callees else 'none'}
*/
"""
return header + decompiled
except Exception as e:
print(f"Decompilation failed for {hex(func_ea)}: {e}")
return Nonedef export_memory_segment(seg_ea, output_dir):
"""Export memory segment as hexdump"""
seg = idaapi.getseg(seg_ea)
if not seg:
return
seg_start = seg.start_ea
seg_end = seg.end_ea
seg_size = seg_end - seg_start
max_size = 1024 * 1024 # 1MB chunks
chunk_num = 0
while seg_start < seg_end:
chunk_end = min(seg_start + max_size, seg_end)
filename = f"{hex(seg_start)}--{hex(chunk_end)}.txt"
with open(os.path.join(output_dir, filename), 'w') as f:
addr = seg_start
while addr < chunk_end:
# Read 16 bytes per line
line_bytes = []
ascii_chars = []
for i in range(16):
if addr + i >= chunk_end:
break
byte = idc.get_wide_byte(addr + i)
line_bytes.append(f"{byte:02X}")
ascii_chars.append(chr(byte) if 32 <= byte <= 126 else '.')
# Format: ADDRESS | HEX BYTES | ASCII
hex_part = ' '.join(line_bytes).ljust(48)
ascii_part = ''.join(ascii_chars)
f.write(f"{hex(addr)} | {hex_part} | {ascii_part}\n")
addr += 16
seg_start = chunk_end
chunk_num += 1def export_strings(output_file):
"""Export all strings with metadata"""
with open(output_file, 'w', encoding='utf-8') as f:
strings = idautils.Strings()
for s in strings:
# Format: address, length, type, content
str_type = {
0: "ASCII",
1: "UTF-16LE",
2: "UTF-32LE"
}.get(s.strtype, "UNKNOWN")
f.write(f"{hex(s.ea)} | len={s.length} | {str_type} | {str(s)}\n").cyour_binary.idb/
├── decompile/ # Auto-generated
├── docs/ # Your reverse engineering notes
├── codes/ # Frida scripts, exploits, tools
└── apk/ # APK decompilation (for Android)# Run export from IDA Python script
import INP
# Trigger export programmatically
INP.main() # Runs the full export process
# Or customize export paths
output_dir = "/custom/path/output"
INP.export_all(output_dir)INP.py# Skip library functions (default: True)
SKIP_LIB_FUNCS = True
# Maximum memory chunk size in bytes
MAX_CHUNK_SIZE = 1024 * 1024 # 1MB
# Progress reporting interval
PROGRESS_INTERVAL = 100 # Report every 100 functions
# Export types to include
EXPORT_DECOMPILE = True
EXPORT_DISASM_FALLBACK = True
EXPORT_MEMORY = True
EXPORT_STRINGS = True
EXPORT_IMPORTS = True
EXPORT_EXPORTS = TrueINP.pydecompile_failed.txtMAX_CHUNK_SIZE/\:*?"<>|main_401000.c# After export, ask AI in your IDE:
"Analyze all functions in decompile/ for buffer overflow vulnerabilities"
"Find all memcpy/strcpy calls and check bounds validation""Trace the execution flow starting from entry point at 0x401000"
"Identify anti-debugging checks and obfuscation techniques"
"Extract C2 communication URLs from strings.txt and related functions""Find packet parsing functions using imports.txt and decompiled code"
"Document the binary protocol structure based on recv/send call patterns"