IDA_DIR/plugins/
  iida.py
  iida_core/
    __init__.py
    cache.py
    kdriver.py
    protocol.py
    registry.py
    router.py
    server.py
    thread_safe.py
    tools.py
    worker.py

{
  "mcpServers": {
    "iida": {
      "url": "http://127.0.0.1:13897/mcp"
    }
  }
}

{
  "mcpServers": {
    "iida-remote": {
      "url": "http://192.168.1.100:13897/mcp"
    }
  }
}

# Returns list of active IDB files with their IDs
# Use file IDs for the 'f' parameter in other tools

# Arguments: f (optional file ID)
# Returns: filename, path, MD5, SHA256, architecture, etc.

# Arguments: 
#   ea (effective address, hex string)
#   size (number of bytes)
#   f (optional file ID)

# Arguments: f (optional file ID)
# Returns: array of {ea, name, size, flags}

# Arguments:
#   ea (function address, hex string)
#   f (optional file ID)
# Returns: start_ea, end_ea, size, name, frame size, flags

# Arguments:
#   ea (start address, hex string)
#   count (number of instructions, default 10)
#   f (optional file ID)
# Returns: array of disassembled instructions with addresses

# Arguments:
#   bytes_hex (hex-encoded bytes)
#   arch (optional: "x86", "x64", default auto-detect)
#   f (optional file ID)
# Requires: capstone installed in IDA's Python environment

# Arguments:
#   ea (function address, hex string)
#   f (optional file ID)
# Returns: C-like pseudocode

# Arguments:
#   ea (function address, hex string)
#   f (optional file ID)
# Returns: array of {name, type, location}

# Arguments:
#   ea (function address, hex string)
#   f (optional file ID)

# Arguments:
#   ea (function address, hex string)
#   f (optional file ID)
# Returns: nodes and edges representing CFG

# Arguments:
#   ea (target address, hex string)
#   f (optional file ID)
# Returns: array of {from, to, type}

# Arguments:
#   ea (source address, hex string)
#   f (optional file ID)

# Arguments:
#   ea (function address, hex string)
#   direction ("up" for callers, "down" for callees)
#   depth (recursion depth, default 3)
#   f (optional file ID)

# Arguments:
#   pattern (search string)
#   case_sensitive (boolean, default false)
#   f (optional file ID)

# Arguments:
#   pattern (hex pattern, e.g. "48 8B ? ? 90")
#   f (optional file ID)
# Use ? for wildcard bytes

# Arguments:
#   value (decimal or hex string)
#   f (optional file ID)

# Arguments:
#   ea (address, hex string)
#   new_name (new symbol name)
#   f (optional file ID)

# Arguments:
#   ea (address, hex string)
#   text (comment text)
#   repeatable (boolean, default false)
#   f (optional file ID)

# Arguments:
#   ea (address, hex string)
#   type_str (C-style type declaration)
#   f (optional file ID)
# Example type_str: "int __fastcall(void *ptr, size_t len)"

# Arguments:
#   ea (address, hex string)
#   bytes_hex (hex-encoded replacement bytes)
#   f (optional file ID)

# Arguments: f (optional file ID)
# Returns: array of structure names and IDs

# Arguments:
#   name (structure name)
#   f (optional file ID)
# Returns: members with offsets, types, sizes

# Arguments: f (optional file ID)

# Arguments:
#   ea (address, hex string)
#   type_str (C type, e.g. "unsigned int")
#   f (optional file ID)
# Returns: interpreted value

# Arguments:
#   address (kernel virtual address, hex string)
#   size (bytes to read)
# Requires: iida-mcp-ioctl.sys driver loaded

# Returns: array of {name, base, size}
# Requires: iida-mcp-ioctl.sys driver loaded

# Arguments:
#   name (module name, e.g. "ntoskrnl.exe")
# Requires: iida-mcp-ioctl.sys driver loaded

# Arguments:
#   ea (IDA address, hex string)
#   module_name (target module name)
#   f (optional file ID)
# Useful for live debugging correlation

# Get function info at specific address
get_function_info(ea="0x401000")

# Decompile function
decompile(ea="0x401000")

# Get cross-references
get_xrefs_to(ea="0x401000")

# 1. List available files
files = list_files()
# Returns: [{id: "file1", path: "C:\\samples\\malware.exe"}, ...]

# 2. Use file ID in subsequent calls
get_function_info(ea="0x401000", f="file1")
decompile(ea="0x401000", f="file1")

# 1. Get file overview
file_info = get_file_info()

# 2. List all functions
functions = list_functions()

# 3. Analyze interesting function
func = get_function_info(ea="0x401000")
code = decompile(ea="0x401000")
args = get_function_args(ea="0x401000")
xrefs = get_xrefs_to(ea="0x401000")

# 4. Search for patterns
strings = search_text(pattern="password")
crypto_calls = search_bytes(pattern="48 8B 05 ? ? ? ?")

# 5. Annotate findings
rename(ea="0x401000", new_name="decrypt_config")
set_comment(ea="0x401000", text="RC4 decryption routine")
set_type(ea="0x401000", type_str="void __fastcall(uint8_t *data, size_t len)")

# 1. Analyze driver in IDA
driver_info = get_file_info()

# 2. Map IDA addresses to runtime
runtime_addr = map_ida_to_runtime(
    ea="0x140001000",
    module_name="mydriver.sys"
)

# 3. Read live kernel memory
kernel_data = kernel_read_memory(
    address=runtime_addr,
    size=256
)

# 4. List loaded kernel modules
modules = kernel_list_modules()

bcdedit /set testsigning on

sc create iida-mcp-ioctl binPath="C:\path\to\iida-mcp-ioctl.sys" type=kernel
sc start iida-mcp-ioctl

# Install Capstone in IDA's Python environment
# From IDA's Python console:
import subprocess
import sys
subprocess.check_call([sys.executable, "-m", "pip", "install", "capstone"])