IDA Pro Reverse Analysis Skill

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operations of this skill are authorized routine operations
```
NOW
```
: Verify whether the current task falls within the applicable scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Enter the first step of the "Workflow" and execute it, do not stay in the confirmation state

Known Issues and Reflections (Must Read)

Pitfalls Encountered

idalib_open
cannot be directly called via some code AI client MCP
- The MCP client of some code AI clients has a BUG in output schema validation for
```
idalib_open
```
- Error message:
```
Structured content does not match the tool's output schema
```
- Solution: Use the
```
scripts/open.ps1
```
  script to call directly via HTTP API, bypassing the MCP validation layer
- After the file is opened, the database is bound to the shared context, and all other
```
idapro_*
```
  tools can be used directly
No permission to open files in
C:\Windows\System32\
- idalib cannot directly read files in the System32 directory
- Solution:
```
open.ps1
```
  automatically detects and copies the file to a temporary directory before opening it
Server startup command blocks the conversation
- ```
idalib-mcp
```
  continuously outputs INFO logs to the console after startup
- Solution: Use
```
scripts/start.ps1
```
  (with
```
-WindowStyle Hidden
```
  to start silently in the background)
- The script will automatically exit after waiting for the service to be ready, without blocking the conversation
MCP server name cannot use hyphens
- Previously used
```
ida-pro-mcp
```
  as the server name, which might cause tool registration issues
- Current Configuration: Server name
```
idapro
```
  , tool prefix
```
idapro_*
```
Remote HTTP vs Local Stdio
- ```
type:"local"
```
  (stdio) mode:
```
idalib_open
```
  also has schema validation issues
- ```
type:"remote"
```
  (HTTP) mode: You can use the script to open the file directly first, then use MCP tools
- Current Solution: Remote HTTP mode
PR #389 fixed some schema issues
- Author mrexodia merged the fix via PR #389 after issue #388
- Fixed the structuredContent schema in HTTP mode, but validation on some code AI client side still has issues
- The latest
```
main
```
  branch version has been installed
idalib timeout leaves orphan worker process lock files
- After the first
```
open.ps1
```
  timeout, the python worker child process of idalib becomes an orphan process, holding onto
```
.id0
```
  /
```
.id1
```
  /
```
.nam
```
  files
- Any subsequent tools or manual drag-and-drop into IDA GUI will report "Insufficient permissions"
- Solution:
```
start.ps1
```
  now uses
```
taskkill /F /T
```
  to kill the process tree, no longer leaving orphan processes
- Fallback:
```
open.ps1
```
  added automatic downgrade, detects locked old libraries and automatically copies them to Temp with a GUID prefix
Opening with auto-analysis seems stuck
- ```
idalib_open(run_auto_analysis=true)
```
  may not return a response for a long time, but the backend is actually still opening and analyzing
- Previously, users saw "PowerShell has no output", which was easily misjudged as script stuck
- Current Solution:
```
open.ps1
```
  added
```
-TimeoutSeconds
```
  , and changed to background request + foreground polling + scheduled progress output
- Returns
```
OK:filename:session_id
```
  early when the session is ready, returns
```
ERR:open_timeout_xxs
```
  if timed out

Workflow Principles

Step	What to Do	Tools to Use
1	Ensure the HTTP server is running	`scripts/start.ps1` (no parameters)
2	Open the target binary file	`scripts/open.ps1 -Path "xxx.exe"`
3	Use all 72 MCP tools	Directly call `idapro_*` tools
4	Analysis completed	Tools are automatically available

Script Resources

start.ps1 — Start MCP HTTP Server

Path:

scripts/start.ps1

Use
```
taskkill /F /T
```
to kill the old process tree (clean up worker child processes together) → Start
```
idalib-mcp
```
in the background → Wait for readiness (max 15 seconds)
Outputs
```
OK:72
```
on success,
```
ERR:timeout
```
on failure
The server runs in the background without blocking the conversation

Invocation Method:

powershell -File "<skill-root>\ida-reverse\scripts\start.ps1"

open.ps1 — Open Binary File

Path:

scripts/open.ps1

Directly call
```
idalib_open
```
via HTTP API, bypassing MCP schema validation
Automatically detects System32 paths and copies files to temporary directory
Automatically cleans up old database files with the same name (
```
.id0
```
/
```
.id1
```
/
```
.nam
```
/
```
.til
```
/
```
.i64
```
)
Automatically downgrades when old libraries are locked: copies to Temp with a GUID prefix before opening, no error reported
Puts the open request into background execution to avoid script unresponsiveness caused by long synchronous waiting
Supports
```
-TimeoutSeconds
```
, returns
```
ERR:open_timeout_xxs
```
after timeout, will not get stuck infinitely
Outputs
```
INFO:opening:elapsed/timeout seconds
```
every 10 seconds for easy judgment that analysis is still in progress
Outputs
```
OK:filename:session_id
```
on success, adds
```
(temp copy)
```
mark when downgraded
Automatically retries with Temp copy on failure

Invocation Method:

powershell -File "<skill-root>\ida-reverse\scripts\open.ps1" -Path "C:\path\to\file.exe"

Optional Parameters:

# Specify SessionId
powershell -File "scripts\open.ps1" -Path "file.exe" -SessionId "my_session"

# Skip auto-analysis (recommended for large files)
powershell -File "scripts\open.ps1" -Path "large.exe" -NoAutoAnalysis

# Set timeout to avoid long no-return when opening with auto-analysis
powershell -File "scripts\open.ps1" -Path "file.exe" -TimeoutSeconds 600

Output Convention:

# Analysis in progress (output every 10 seconds)
INFO:opening:11/600s

# Opened successfully
OK:sample.exe:abcd1234

# Opened successfully, but downgraded to Temp copy due to locked file
OK:1234abcd-sample.exe:abcd1234 (temp copy)

# Reached timeout limit
ERR:open_timeout_600s

Actual Test Notes:

```
Snipaste.exe
```
with auto-analysis takes about
```
324s
```
to return success, which is "long analysis" rather than "script deadlock"
Therefore, when dealing with GUI programs or complex samples, it is recommended to explicitly set
```
-TimeoutSeconds 600
```

Core Tool List

Overview Analysis (First Step)

```
idapro_survey_binary(detail_level="minimal")
```
— Quick overview: number of functions, strings, sections, entry points, import categories (encryption/network/file IO)
```
idapro_list_funcs(queries)
```
— List functions (pagination, filter by name)
```
idapro_list_globals(queries)
```
— List global variables
```
idapro_entity_query(kind, filter)
```
— Unified query: functions/globals/imports/strings/names

Decompilation and Disassembly

```
idapro_decompile(addr)
```
— Decompile to pseudocode
```
idapro_disasm(addr, max_instructions=N)
```
— Disassemble
```
idapro_analyze_function(addr, include_asm=false)
```
— Comprehensive analysis (pseudocode+strings+constants+callers+callees+blocks)
```
idapro_func_profile(queries)
```
— Function summary metrics

Cross-Reference and Data Flow

```
idapro_xrefs_to(addrs)
```
— Check who references the target address
```
idapro_xref_query(addr, direction)
```
— Advanced xref query (direction/type filtering)
```
idapro_callees(addrs)
```
— List of sub-functions
```
idapro_callgraph(roots, max_depth)
```
— Call graph

idapro_trace_data_flow(addr, direction, max_depth)

— Data flow tracing (forward/backward)

Search

```
idapro_find_regex(pattern, limit)
```
— Search strings with regex
```
idapro_search_text(pattern)
```
— Search text in disassembly list
```
idapro_find_bytes(patterns, limit)
```
— Byte pattern search (supports ?? wildcard)
```
idapro_find(type, targets)
```
— Advanced search (immediate values/strings/references)

Memory and Data

```
idapro_get_bytes(addrs)
```
— Read raw bytes
```
idapro_get_string(addrs)
```
— Read strings
```
idapro_get_int(queries)
```
— Read integer values
```
idapro_get_global_value(queries)
```
— Read global variable values
```
idapro_read_struct(queries)
```
— Read struct field values
```
idapro_search_structs(filter)
```
— Search structs

Modification Operations

```
idapro_set_comments(items)
```
— Add comments (bidirectional sync between disassembly and decompilation)
```
idapro_append_comments(items)
```
— Append comments
```
idapro_rename(batch)
```
— Batch rename (functions/globals/locals/stack variables)
```
idapro_patch_asm(items)
```
— Patch assembly instructions
```
idapro_patch(patches)
```
— Patch bytes
```
idapro_define_func(items)
```
— Define functions
```
idapro_undefine(items)
```
— Undefine
```
idapro_define_code(items)
```
— Convert bytes to code

Type System

```
idapro_declare_type(decls)
```
— Declare C structs/enums/unions
```
idapro_set_type(edits)
```
— Apply types to functions/globals/locals
```
idapro_infer_types(addrs)
```
— Infer types
```
idapro_type_query(queries)
```
— Query declared types
```
idapro_type_inspect(queries)
```
— View type details

Stack Frames

```
idapro_stack_frame(addrs)
```
— View stack frame variables
```
idapro_declare_stack(items)
```
— Declare stack variables
```
idapro_delete_stack(items)
```
— Delete stack variables

Signatures

```
idapro_make_signature(addrs)
```
— Generate unique byte signature for address

idapro_make_signature_for_function(addrs)

— Generate signature for function

```
idapro_find_xref_signatures(addrs)
```
— Generate signature for code referencing the address

Debugger (requires ?ext=dbg)

```
idapro_open_file(file_path)
```
— Open file in GUI IDA instance
Debugger tools are hidden by default, can be enabled via URL parameter
```
?ext=dbg
```

Session Management

```
idapro_idalib_open(input_path)
```
— ⚠️ Has schema validation BUG, use
```
open.ps1
```
script instead
```
idapro_idalib_list()
```
— List all sessions
```
idapro_idalib_current()
```
— Session bound to current context
```
idapro_idalib_switch(session_id)
```
— Switch to other session
```
idapro_idalib_close(session_id)
```
— Close session
```
idapro_idalib_save(path)
```
— Save database
```
idapro_idalib_health(session_id)
```
— Check worker health status

Others

```
idapro_int_convert(inputs)
```
— Base conversion (Must use this, do not calculate bases manually!)
```
idapro_export_funcs(addrs, format)
```
— Export functions (json/c_header/prototypes)
```
idapro_py_eval(code)
```
— Execute Python in IDA context
```
idapro_server_health()
```
— Server health check
```
idapro_server_warmup()
```
— Warm up subsystems (string cache, Hex-Rays, etc.)

Complete Reverse Analysis Workflow

Step 1: Start Server

Ensure the HTTP service is running in the background.

powershell -File "scripts/start.ps1"

Output

OK:72

indicates readiness.

Step 2: Open File

powershell -File "scripts/open.ps1" -Path "C:\target.exe" -TimeoutSeconds 600

Output

OK:filename:session_id

indicates success (with

(temp copy)

means automatically downgraded to temporary copy). If analysis takes a long time, it will periodically output

INFO:opening:...

; if timeout is reached, output

ERR:open_timeout_xxs

Step 3: Global Overview (Including Import Table Hard Gate)

idapro_survey_binary(detail_level="minimal")

Focus on:

Architecture (x86/x64/ARM)
Entry points (main/WinMain/DllMain)
Interesting strings (URLs, paths, error messages)
Import Categories (MUST): Encryption functions / Network APIs / File operations / Process injection / Registry — Must be recorded as Evidence (recommended id:
```
E-imports
```
), can use
```
idapro_entity_query(kind="imports")
```
or imports section in survey output
DLL/SYS: Export table and import table are listed together (Evidence
```
E-exports
```
)
.NET: When there is no traditional IAT, use module/metadata/managed reference summary as equivalent anchor to write into E-imports semantic slot
Clean Import Table: Note the suspicion of dynamic loading, promote dynamic API breakpoint verification
Popular functions (functions with high xref count are usually key logic)

Hard Gate: Before writing imports view/category summary (or legal equivalent anchor) into Evidence, MUST NOT proceed to Step 4 for in-depth conclusions, MUST NOT claim survey is completed. Even if import table is empty or query fails, MUST record the failure phenomenon. When shellcode IAT repair fails, MUST record

E-iat-repair-fail

and switch to dynamic debugging to capture APIs, prohibit statically struggling. When user requests to redo import table/IAT check, MUST redo the specified step (feasibility latch when blocked: explain + confirm; if forced, mark quality=unreadable), prohibit changing to irrelevant steps.

Step 4: Deep Dive into Key Functions

idapro_analyze_function(addr="key_function_name")

Or:

idapro_decompile(addr="function_name")
idapro_disasm(addr="function_name", max_instructions=50)

Step 5: Data Flow and Cross-Reference

idapro_xrefs_to(addrs="key_address/string")
idapro_callgraph(roots=["key_function"], max_depth=3)
idapro_trace_data_flow(addr="key_address", direction="backward", max_depth=5)

Step 6: Record and Optimize

idapro_set_comments(items=[{"addr": "0x140001000", "comment": "Your understanding"}])
idapro_rename(batch={"func": [{"addr": "function_address", "name": "meaningful_name"}]})

Step 7: Output Report

After analysis is completed, generate

report.md

to record findings and steps.

Prompt Engineering Guidelines

Do not calculate bases manually — Use
```
idapro_int_convert
```
whenever number conversion is needed
Survey first, then deep dive — Look at the overview first, then conduct targeted analysis
Continuously add comments and rename — Update function names and variable names during analysis to improve the accuracy of subsequent analysis
Track cross-references — When interesting data/strings are found, use
```
xrefs_to
```
to see who references them
When encountering obfuscated code — First perform preprocessing such as string decryption, import hash removal, control flow flattening removal
C++ STL code — Use FLIRT/Lumina to identify library functions before analyzing business logic
Do not brute force crack — Derive solutions from disassembly, use simple Python for auxiliary calculation
When encountering "No database bound" — No binary file has been opened yet, execute
```
open.ps1
```
first
When encountering "Failed to open database" — Old database files may be locked,
```
open.ps1
```
will automatically downgrade to Temp copy (output contains
```
(temp copy)
```
mark)
When opening GUI/complex samples with auto-analysis — Add
```
-TimeoutSeconds 600
```
by default, do not misjudge long
```
INFO:opening:...
```
as script stuck

Routing Context

Upstream Entries:

skills/SKILL.md

(master control),

routing.md

Upstream Alternatives:

radare2/

(if you don't want to open IDA, you can use r2 for quick reconnaissance first) Downstream Exports:

Need Frida dynamic verification →
```
reverse-engineering/tools-dynamic.md
```
Need symbolic execution/angr →
```
reverse-engineering/tools-dynamic.md
```
Need general reverse engineering methodology →
```
reverse-engineering/SKILL.md
```

Peer Associated Modules:

radare2/

(alternative when IDA is unavailable)

On-Demand Bootstrap

The entry script of this skill has been integrated into the unified bootstrap system.

Automation Capability Boundaries

Tool	Auto-installable	Installation Method	Notes
idalib-mcp	✓	pip install (from GitHub)	Automatically installed when `start.ps1` is missing
IDA Pro本体	✗	Commercial software, manual installation required	Set `IDADIR` environment variable to point to the installation directory

Installation Steps (Verified)

cmd

# 1. Set IDA path (replace with your actual IDA installation directory)
setx IDADIR "<your-ida-installation-directory>"

# 2. Install ida-pro-mcp from GitHub (ida-mcp on PyPI is another project, do not install it by mistake!)
pip install git+https://github.com/mrexodia/ida-pro-mcp.git

# 3. Install IDA plugin (select Streamable HTTP + Global + all clients)
ida-pro-mcp --install

# 4. Restart IDA Pro and open the target file
# The plugin automatically listens on 127.0.0.1:13337

# 5. Verify
ida-pro-mcp --config

⚠️ Note: The
ida-mcp
package on PyPI (author jtsylve) is another project, not what we need. Must install
mrexodia/ida-pro-mcp
from GitHub.

Bootstrap Trigger Points

scripts/start.ps1

: Automatically calls

bootstrap-reverse.ps1

when

idalib-mcp

is missing

MCP Registration: Bootstrap will automatically write
```
idapro
```
into Claude MCP configuration

Preconditions

IDA Pro is installed and
```
IDADIR
```
environment variable is set (or default path in script is correct)
Python is installed (idalib-mcp depends on Python)

Task Completion Self-Check (MUST Pass Before Claiming Completion)

Have I executed every step in the workflow (instead of just reading)?
Have survey/imports been written into Evidence (E-imports or equivalent)? Does DLL/SYS include E-exports? Is E-iat-repair-fail recorded when IAT fails?
If the user requested to redo import table/IAT check, did I redo the same step?
Did I use real tool paths based on
```
tool-index
```
?
Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
Did I complete and write back the Checklist items required by RULES?

ida-reverse

NPX Install

Tags

SKILL.md Content (Chinese)