ida-reverse

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

IDA Pro 逆向分析技能

IDA Pro Reverse Analysis Skill

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: 读取
```
../field-journal/precedent-reverse.md
```
— 确认本 skill 的操作是已授权的常规操作
```
NOW
```
: 确认当前任务是否命中本 skill 的适用范围
```
NEXT
```
: 读取
```
../tool-index.md
```
，校验工具可用性和实际路径
```
NEXT
```
: 缺工具时调用 bootstrap，不要猜路径
```
ACT
```
: 进入"工作流"第一步并执行，不要停在确认状态

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operations of this skill are authorized routine operations
```
NOW
```
: Verify whether the current task falls within the applicable scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Enter the first step of the "Workflow" and execute it, do not stay in the confirmation state

已知问题与反思（必读）

Known Issues and Reflections (Must Read)

踩过的坑

Pitfalls Encountered

idalib_open
不能通过部分代码 AI 客户端 MCP 直接调用
- 部分代码 AI 客户端的 MCP 客户端对
```
idalib_open
```
  的 output schema 校验有 BUG
- 报错：
```
Structured content does not match the tool's output schema
```
- 解决办法：使用
```
scripts/open.ps1
```
  脚本通过 HTTP API 直调，绕过 MCP 校验层
- 文件打开后，数据库绑定到共享上下文，其他所有
```
idapro_*
```
  工具可直接使用
C:\Windows\System32\
文件无权限打开
- idalib 无法直接读取 System32 目录下的文件
- 解决办法：
```
open.ps1
```
  自动检测并复制到
```
临时目录
```
  目录后再打开
启动服务器命令阻塞对话
- ```
idalib-mcp
```
  启动后会持续输出 INFO 日志到控制台
- 解决办法：使用
```
scripts/start.ps1
```
  （
```
-WindowStyle Hidden
```
  后台静默启动）
- 脚本会等待服务就绪后自动退出，不阻塞对话
MCP 服务器名不能用横线
- 之前用
```
ida-pro-mcp
```
  作为服务器名，可能引起工具注册问题
- 当前配置：服务器名
```
idapro
```
  ，工具前缀
```
idapro_*
```
Remote HTTP vs Local Stdio
- ```
type:"local"
```
  （stdio）模式：
```
idalib_open
```
  同样有 schema 校验问题
- ```
type:"remote"
```
  （HTTP）模式：可以先用脚本直开文件，再用 MCP 工具
- 当前方案：Remote HTTP 模式
PR #389 修复了部分 schema 问题
- 作者 mrexodia 在 issue #388 后通过 PR #389 合并了修复
- 修复了 HTTP 模式下的 structuredContent schema，但部分代码 AI 客户端侧校验仍有问题
- 已安装最新
```
main
```
  分支版本
idalib 超时留下孤儿 worker 进程锁文件
- 第一次
```
open.ps1
```
  超时后，idalib 的 python worker 子进程变成孤儿进程，咬着
```
.id0
```
  /
```
.id1
```
  /
```
.nam
```
  不放
- 后续任何工具或手动拖入 IDA GUI 都会报"权限不足"
- 解决办法：
```
start.ps1
```
  改用
```
taskkill /F /T
```
  杀进程树，不再留孤儿
- 兜底：
```
open.ps1
```
  加了自动降级，检测到旧库被锁自动复制到 Temp 并加 GUID 前缀
带自动分析打开看起来像卡死
- ```
idalib_open(run_auto_analysis=true)
```
  可能长时间不回包，但后端实际上仍在继续打开和分析
- 之前用户侧看到的是“PowerShell 一直无输出”，容易误判成脚本卡死
- 当前解决办法：
```
open.ps1
```
  新增
```
-TimeoutSeconds
```
  ，并改为后台请求 + 前台轮询 + 定时进度输出
- 轮询到会话已就绪时会提前返回
```
OK:文件名:session_id
```
  ，超时则返回
```
ERR:open_timeout_xxs
```

idalib_open
cannot be directly called via some code AI client MCP
- The MCP client of some code AI clients has a BUG in output schema validation for
```
idalib_open
```
- Error message:
```
Structured content does not match the tool's output schema
```
- Solution: Use the
```
scripts/open.ps1
```
  script to call directly via HTTP API, bypassing the MCP validation layer
- After the file is opened, the database is bound to the shared context, and all other
```
idapro_*
```
  tools can be used directly
No permission to open files in
C:\Windows\System32\
- idalib cannot directly read files in the System32 directory
- Solution:
```
open.ps1
```
  automatically detects and copies the file to a temporary directory before opening it
Server startup command blocks the conversation
- ```
idalib-mcp
```
  continuously outputs INFO logs to the console after startup
- Solution: Use
```
scripts/start.ps1
```
  (with
```
-WindowStyle Hidden
```
  to start silently in the background)
- The script will automatically exit after waiting for the service to be ready, without blocking the conversation
MCP server name cannot use hyphens
- Previously used
```
ida-pro-mcp
```
  as the server name, which might cause tool registration issues
- Current Configuration: Server name
```
idapro
```
  , tool prefix
```
idapro_*
```
Remote HTTP vs Local Stdio
- ```
type:"local"
```
  (stdio) mode:
```
idalib_open
```
  also has schema validation issues
- ```
type:"remote"
```
  (HTTP) mode: You can use the script to open the file directly first, then use MCP tools
- Current Solution: Remote HTTP mode
PR #389 fixed some schema issues
- Author mrexodia merged the fix via PR #389 after issue #388
- Fixed the structuredContent schema in HTTP mode, but validation on some code AI client side still has issues
- The latest
```
main
```
  branch version has been installed
idalib timeout leaves orphan worker process lock files
- After the first
```
open.ps1
```
  timeout, the python worker child process of idalib becomes an orphan process, holding onto
```
.id0
```
  /
```
.id1
```
  /
```
.nam
```
  files
- Any subsequent tools or manual drag-and-drop into IDA GUI will report "Insufficient permissions"
- Solution:
```
start.ps1
```
  now uses
```
taskkill /F /T
```
  to kill the process tree, no longer leaving orphan processes
- Fallback:
```
open.ps1
```
  added automatic downgrade, detects locked old libraries and automatically copies them to Temp with a GUID prefix
Opening with auto-analysis seems stuck
- ```
idalib_open(run_auto_analysis=true)
```
  may not return a response for a long time, but the backend is actually still opening and analyzing
- Previously, users saw "PowerShell has no output", which was easily misjudged as script stuck
- Current Solution:
```
open.ps1
```
  added
```
-TimeoutSeconds
```
  , and changed to background request + foreground polling + scheduled progress output
- Returns
```
OK:filename:session_id
```
  early when the session is ready, returns
```
ERR:open_timeout_xxs
```
  if timed out

工作流程原则

Workflow Principles

步骤	做什么	用什么
1	确保 HTTP 服务器在运行	`scripts/start.ps1` （无参数）
2	打开目标二进制文件	`scripts/open.ps1 -Path "xxx.exe"`
3	使用所有 72 个 MCP 工具	直接调用 `idapro_*` 工具
4	分析完毕	工具自动可用

Step	What to Do	Tools to Use
1	Ensure the HTTP server is running	`scripts/start.ps1` (no parameters)
2	Open the target binary file	`scripts/open.ps1 -Path "xxx.exe"`
3	Use all 72 MCP tools	Directly call `idapro_*` tools
4	Analysis completed	Tools are automatically available

脚本资源

Script Resources

start.ps1 — 启动 MCP HTTP 服务器

start.ps1 — Start MCP HTTP Server

路径：

scripts/start.ps1

用
```
taskkill /F /T
```
杀旧进程树（连 worker 子进程一起清理）→ 后台启动
```
idalib-mcp
```
→ 等待就绪（最多 15 秒）
成功输出
```
OK:72
```
，失败输出
```
ERR:timeout
```
服务器在后台运行，不阻塞对话

调用方式：

powershell -File "<skill-root>\ida-reverse\scripts\start.ps1"

Path:

scripts/start.ps1

Use
```
taskkill /F /T
```
to kill the old process tree (clean up worker child processes together) → Start
```
idalib-mcp
```
in the background → Wait for readiness (max 15 seconds)
Outputs
```
OK:72
```
on success,
```
ERR:timeout
```
on failure
The server runs in the background without blocking the conversation

Invocation Method:

powershell -File "<skill-root>\ida-reverse\scripts\start.ps1"

open.ps1 — 打开二进制文件

open.ps1 — Open Binary File

路径：

scripts/open.ps1

通过 HTTP API 直调
```
idalib_open
```
，绕过 MCP schema 校验
自动检测 System32 路径并复制到临时目录
自动清理同名旧数据库文件（
```
.id0
```
/
```
.id1
```
/
```
.nam
```
/
```
.til
```
/
```
.i64
```
）
旧库被锁时自动降级：复制到 Temp 加 GUID 前缀后打开，不报错
将打开请求放到后台执行，避免长时间同步等待导致脚本无响应
支持
```
-TimeoutSeconds
```
，超时后返回
```
ERR:open_timeout_xxs
```
，不会无限卡住
每隔 10 秒输出一次
```
INFO:opening:已用时/超时秒数
```
，便于判断仍在分析中
成功输出
```
OK:文件名:session_id
```
，降级时加
```
(temp copy)
```
标记
失败时自动重试走 Temp 副本

调用方式：

powershell -File "<skill-root>\ida-reverse\scripts\open.ps1" -Path "C:\path\to\file.exe"

可选参数：

undefined

Path:

scripts/open.ps1

Directly call
```
idalib_open
```
via HTTP API, bypassing MCP schema validation
Automatically detects System32 paths and copies files to temporary directory
Automatically cleans up old database files with the same name (
```
.id0
```
/
```
.id1
```
/
```
.nam
```
/
```
.til
```
/
```
.i64
```
)
Automatically downgrades when old libraries are locked: copies to Temp with a GUID prefix before opening, no error reported
Puts the open request into background execution to avoid script unresponsiveness caused by long synchronous waiting
Supports
```
-TimeoutSeconds
```
, returns
```
ERR:open_timeout_xxs
```
after timeout, will not get stuck infinitely
Outputs
```
INFO:opening:elapsed/timeout seconds
```
every 10 seconds for easy judgment that analysis is still in progress
Outputs
```
OK:filename:session_id
```
on success, adds
```
(temp copy)
```
mark when downgraded
Automatically retries with Temp copy on failure

Invocation Method:

powershell -File "<skill-root>\ida-reverse\scripts\open.ps1" -Path "C:\path\to\file.exe"

Optional Parameters:

undefined

指定 SessionId

Specify SessionId

powershell -File "scripts\open.ps1" -Path "file.exe" -SessionId "my_session"

跳过自动分析（大文件推荐）

Skip auto-analysis (recommended for large files)

powershell -File "scripts\open.ps1" -Path "large.exe" -NoAutoAnalysis

设置超时，避免带自动分析时长时间无返回

Set timeout to avoid long no-return when opening with auto-analysis

powershell -File "scripts\open.ps1" -Path "file.exe" -TimeoutSeconds 600


**输出约定**：

powershell -File "scripts\open.ps1" -Path "file.exe" -TimeoutSeconds 600


**Output Convention**:

分析进行中（每 10 秒输出一次）

Analysis in progress (output every 10 seconds)

INFO:opening:11/600s

成功打开

Opened successfully

OK:sample.exe:abcd1234

成功打开，但因锁文件降级到 Temp 副本

Opened successfully, but downgraded to Temp copy due to locked file

OK:1234abcd-sample.exe:abcd1234 (temp copy)

达到超时上限

Reached timeout limit

ERR:open_timeout_600s


**实测说明**：
- `Snipaste.exe` 带自动分析实测约 `324s` 才返回成功，属于“分析很久”而不是“脚本死锁”
- 因此遇到 GUI 程序或较复杂样本时，建议优先显式设置 `-TimeoutSeconds 600`

ERR:open_timeout_600s


**Actual Test Notes**:
- `Snipaste.exe` with auto-analysis takes about `324s` to return success, which is "long analysis" rather than "script deadlock"
- Therefore, when dealing with GUI programs or complex samples, it is recommended to explicitly set `-TimeoutSeconds 600`

核心工具列表

Core Tool List

概况分析（第一步）

Overview Analysis (First Step)

```
idapro_survey_binary(detail_level="minimal")
```
— 快速概况：函数数、字符串、段、入口点、导入分类（加密/网络/文件IO）
```
idapro_list_funcs(queries)
```
— 列出函数（分页、按名称过滤）
```
idapro_list_globals(queries)
```
— 列出全局变量
```
idapro_entity_query(kind, filter)
```
— 统一查询：functions/globals/imports/strings/names

```
idapro_survey_binary(detail_level="minimal")
```
— Quick overview: number of functions, strings, sections, entry points, import categories (encryption/network/file IO)
```
idapro_list_funcs(queries)
```
— List functions (pagination, filter by name)
```
idapro_list_globals(queries)
```
— List global variables
```
idapro_entity_query(kind, filter)
```
— Unified query: functions/globals/imports/strings/names

反编译与反汇编

Decompilation and Disassembly

```
idapro_decompile(addr)
```
— 反编译为伪代码
```
idapro_disasm(addr, max_instructions=N)
```
— 反汇编
```
idapro_analyze_function(addr, include_asm=false)
```
— 综合分析（伪代码+字符串+常量+调用者+被调用者+块）
```
idapro_func_profile(queries)
```
— 函数概要指标

```
idapro_decompile(addr)
```
— Decompile to pseudocode
```
idapro_disasm(addr, max_instructions=N)
```
— Disassemble
```
idapro_analyze_function(addr, include_asm=false)
```
— Comprehensive analysis (pseudocode+strings+constants+callers+callees+blocks)
```
idapro_func_profile(queries)
```
— Function summary metrics

交叉引用与数据流

Cross-Reference and Data Flow

```
idapro_xrefs_to(addrs)
```
— 查谁引用目标地址
```
idapro_xref_query(addr, direction)
```
— 高级 xref 查询（方向/类型过滤）
```
idapro_callees(addrs)
```
— 子函数列表
```
idapro_callgraph(roots, max_depth)
```
— 调用图

idapro_trace_data_flow(addr, direction, max_depth)

— 数据流追踪（forward/backward）

```
idapro_xrefs_to(addrs)
```
— Check who references the target address
```
idapro_xref_query(addr, direction)
```
— Advanced xref query (direction/type filtering)
```
idapro_callees(addrs)
```
— List of sub-functions
```
idapro_callgraph(roots, max_depth)
```
— Call graph

idapro_trace_data_flow(addr, direction, max_depth)

— Data flow tracing (forward/backward)

搜索

Search

```
idapro_find_regex(pattern, limit)
```
— 正则搜字符串
```
idapro_search_text(pattern)
```
— 在反汇编列表中搜文本
```
idapro_find_bytes(patterns, limit)
```
— 字节模式搜索（支持 ?? 通配符）
```
idapro_find(type, targets)
```
— 高级搜索（立即数/字符串/引用）

```
idapro_find_regex(pattern, limit)
```
— Search strings with regex
```
idapro_search_text(pattern)
```
— Search text in disassembly list
```
idapro_find_bytes(patterns, limit)
```
— Byte pattern search (supports ?? wildcard)
```
idapro_find(type, targets)
```
— Advanced search (immediate values/strings/references)

内存与数据

Memory and Data

```
idapro_get_bytes(addrs)
```
— 读原始字节
```
idapro_get_string(addrs)
```
— 读字符串
```
idapro_get_int(queries)
```
— 读整数值
```
idapro_get_global_value(queries)
```
— 读全局变量值
```
idapro_read_struct(queries)
```
— 读结构体字段值
```
idapro_search_structs(filter)
```
— 搜索结构体

```
idapro_get_bytes(addrs)
```
— Read raw bytes
```
idapro_get_string(addrs)
```
— Read strings
```
idapro_get_int(queries)
```
— Read integer values
```
idapro_get_global_value(queries)
```
— Read global variable values
```
idapro_read_struct(queries)
```
— Read struct field values
```
idapro_search_structs(filter)
```
— Search structs

修改操作

Modification Operations

```
idapro_set_comments(items)
```
— 添加注释（反汇编+反编译双向同步）
```
idapro_append_comments(items)
```
— 追加注释
```
idapro_rename(batch)
```
— 批量重命名（函数/全局/局部/栈变量）
```
idapro_patch_asm(items)
```
— Patch 汇编指令
```
idapro_patch(patches)
```
— Patch 字节
```
idapro_define_func(items)
```
— 定义函数
```
idapro_undefine(items)
```
— 取消定义
```
idapro_define_code(items)
```
— 将字节转为代码

```
idapro_set_comments(items)
```
— Add comments (bidirectional sync between disassembly and decompilation)
```
idapro_append_comments(items)
```
— Append comments
```
idapro_rename(batch)
```
— Batch rename (functions/globals/locals/stack variables)
```
idapro_patch_asm(items)
```
— Patch assembly instructions
```
idapro_patch(patches)
```
— Patch bytes
```
idapro_define_func(items)
```
— Define functions
```
idapro_undefine(items)
```
— Undefine
```
idapro_define_code(items)
```
— Convert bytes to code

类型系统

Type System

```
idapro_declare_type(decls)
```
— 声明 C 结构体/枚举/联合体
```
idapro_set_type(edits)
```
— 应用类型到函数/全局/局部
```
idapro_infer_types(addrs)
```
— 推断类型
```
idapro_type_query(queries)
```
— 查询已声明类型
```
idapro_type_inspect(queries)
```
— 查看类型详情

```
idapro_declare_type(decls)
```
— Declare C structs/enums/unions
```
idapro_set_type(edits)
```
— Apply types to functions/globals/locals
```
idapro_infer_types(addrs)
```
— Infer types
```
idapro_type_query(queries)
```
— Query declared types
```
idapro_type_inspect(queries)
```
— View type details

栈帧

Stack Frames

```
idapro_stack_frame(addrs)
```
— 查看栈帧变量
```
idapro_declare_stack(items)
```
— 声明栈变量
```
idapro_delete_stack(items)
```
— 删除栈变量

```
idapro_stack_frame(addrs)
```
— View stack frame variables
```
idapro_declare_stack(items)
```
— Declare stack variables
```
idapro_delete_stack(items)
```
— Delete stack variables

签名

Signatures

```
idapro_make_signature(addrs)
```
— 为地址生成唯一字节签名

idapro_make_signature_for_function(addrs)

— 为函数生成签名

```
idapro_find_xref_signatures(addrs)
```
— 为引用地址的代码生成签名

```
idapro_make_signature(addrs)
```
— Generate unique byte signature for address

idapro_make_signature_for_function(addrs)

— Generate signature for function

```
idapro_find_xref_signatures(addrs)
```
— Generate signature for code referencing the address

调试器（需要 ?ext=dbg）

Debugger (requires ?ext=dbg)

```
idapro_open_file(file_path)
```
— 在 GUI IDA 实例中打开文件
调试器工具默认隐藏，可通过 URL 参数
```
?ext=dbg
```
启用

```
idapro_open_file(file_path)
```
— Open file in GUI IDA instance
Debugger tools are hidden by default, can be enabled via URL parameter
```
?ext=dbg
```

会话管理

Session Management

```
idapro_idalib_open(input_path)
```
— ⚠️ 有 schema 校验 BUG，改用
```
open.ps1
```
脚本
```
idapro_idalib_list()
```
— 列出所有 session
```
idapro_idalib_current()
```
— 当前上下文绑定的 session
```
idapro_idalib_switch(session_id)
```
— 切换到其他 session
```
idapro_idalib_close(session_id)
```
— 关闭 session
```
idapro_idalib_save(path)
```
— 保存数据库
```
idapro_idalib_health(session_id)
```
— 检查 worker 健康状态

```
idapro_idalib_open(input_path)
```
— ⚠️ Has schema validation BUG, use
```
open.ps1
```
script instead
```
idapro_idalib_list()
```
— List all sessions
```
idapro_idalib_current()
```
— Session bound to current context
```
idapro_idalib_switch(session_id)
```
— Switch to other session
```
idapro_idalib_close(session_id)
```
— Close session
```
idapro_idalib_save(path)
```
— Save database
```
idapro_idalib_health(session_id)
```
— Check worker health status

其他

Others

```
idapro_int_convert(inputs)
```
— 进制转换（必须用这个，不要自己算进制！）
```
idapro_export_funcs(addrs, format)
```
— 导出函数（json/c_header/prototypes）
```
idapro_py_eval(code)
```
— 在 IDA 上下文执行 Python
```
idapro_server_health()
```
— 服务器健康检查
```
idapro_server_warmup()
```
— 预热子系统（字符串缓存、Hex-Rays 等）

```
idapro_int_convert(inputs)
```
— Base conversion (Must use this, do not calculate bases manually!)
```
idapro_export_funcs(addrs, format)
```
— Export functions (json/c_header/prototypes)
```
idapro_py_eval(code)
```
— Execute Python in IDA context
```
idapro_server_health()
```
— Server health check
```
idapro_server_warmup()
```
— Warm up subsystems (string cache, Hex-Rays, etc.)

逆向分析完整工作流

Complete Reverse Analysis Workflow

Step 1: 启动服务器

Step 1: Start Server

确保 HTTP 服务在后台运行。

powershell -File "scripts/start.ps1"

输出

OK:72

表示就绪。

Ensure the HTTP service is running in the background.

powershell -File "scripts/start.ps1"

Output

OK:72

indicates readiness.

Step 2: 打开文件

Step 2: Open File

powershell -File "scripts/open.ps1" -Path "C:\目标.exe" -TimeoutSeconds 600

输出

OK:文件名:session_id

表示成功（后带

(temp copy)

表示自动降级到临时副本）。若分析时间较长，会周期性输出

INFO:opening:...

；若达到超时则输出

ERR:open_timeout_xxs

。

powershell -File "scripts/open.ps1" -Path "C:\target.exe" -TimeoutSeconds 600

Output

OK:filename:session_id

indicates success (with

(temp copy)

means automatically downgraded to temporary copy). If analysis takes a long time, it will periodically output

INFO:opening:...

; if timeout is reached, output

ERR:open_timeout_xxs

Step 3: 全局概览（含导入表硬门）

Step 3: Global Overview (Including Import Table Hard Gate)

idapro_survey_binary(detail_level="minimal")

关注：

架构（x86/x64/ARM）
入口点（main/WinMain/DllMain）
有趣的字符串（URL、路径、错误消息）
导入分类（MUST）：加密函数 / 网络 API / 文件操作 / 进程注入 / 注册表 — 必须落成 Evidence（建议 id：
```
E-imports
```
），可用
```
idapro_entity_query(kind="imports")
```
或 survey 输出中的 imports 段
DLL/SYS：导出表与导入表并列（Evidence
```
E-exports
```
）
.NET：无传统 IAT 时用模块/元数据/托管引用摘要作为等价锚点写入 E-imports 语义槽
干净导入表：注明动态加载嫌疑，推动动态 API 断点验证
热门函数（高 xref 计数的函数通常是关键逻辑）

硬门禁：未将 imports 视图/分类摘要（或合法等价锚点）写入 Evidence 前，MUST NOT 进入 Step 4 深挖结论，MUST NOT 声称 survey 完成。导入表为空或查询失败时仍 MUST 记录失败现象。加壳 IAT 修复失败时 MUST 记

E-iat-repair-fail

并转动态调试抓 API，禁止静态死磕。用户要求重做导入表/IAT 检查时 MUST 重做被点名步骤（阻塞时可行性门闩：说明+确认；强制则标 quality=unreadable），禁止改换无关步骤。

idapro_survey_binary(detail_level="minimal")

Focus on:

Architecture (x86/x64/ARM)
Entry points (main/WinMain/DllMain)
Interesting strings (URLs, paths, error messages)
Import Categories (MUST): Encryption functions / Network APIs / File operations / Process injection / Registry — Must be recorded as Evidence (recommended id:
```
E-imports
```
), can use
```
idapro_entity_query(kind="imports")
```
or imports section in survey output
DLL/SYS: Export table and import table are listed together (Evidence
```
E-exports
```
)
.NET: When there is no traditional IAT, use module/metadata/managed reference summary as equivalent anchor to write into E-imports semantic slot
Clean Import Table: Note the suspicion of dynamic loading, promote dynamic API breakpoint verification
Popular functions (functions with high xref count are usually key logic)

Hard Gate: Before writing imports view/category summary (or legal equivalent anchor) into Evidence, MUST NOT proceed to Step 4 for in-depth conclusions, MUST NOT claim survey is completed. Even if import table is empty or query fails, MUST record the failure phenomenon. When shellcode IAT repair fails, MUST record

E-iat-repair-fail

and switch to dynamic debugging to capture APIs, prohibit statically struggling. When user requests to redo import table/IAT check, MUST redo the specified step (feasibility latch when blocked: explain + confirm; if forced, mark quality=unreadable), prohibit changing to irrelevant steps.

Step 4: 深入关键函数

Step 4: Deep Dive into Key Functions

idapro_analyze_function(addr="关键函数名")

或：

idapro_decompile(addr="函数名")
idapro_disasm(addr="函数名", max_instructions=50)

idapro_analyze_function(addr="key_function_name")

Or:

idapro_decompile(addr="function_name")
idapro_disasm(addr="function_name", max_instructions=50)

Step 5: 数据流和交叉引用

Step 5: Data Flow and Cross-Reference

idapro_xrefs_to(addrs="关键地址/字符串")
idapro_callgraph(roots=["关键函数"], max_depth=3)
idapro_trace_data_flow(addr="关键地址", direction="backward", max_depth=5)

idapro_xrefs_to(addrs="key_address/string")
idapro_callgraph(roots=["key_function"], max_depth=3)
idapro_trace_data_flow(addr="key_address", direction="backward", max_depth=5)

Step 6: 记录和优化

Step 6: Record and Optimize

idapro_set_comments(items=[{"addr": "0x140001000", "comment": "你的理解"}])
idapro_rename(batch={"func": [{"addr": "函数地址", "name": "有意义的名字"}]})

idapro_set_comments(items=[{"addr": "0x140001000", "comment": "Your understanding"}])
idapro_rename(batch={"func": [{"addr": "function_address", "name": "meaningful_name"}]})

Step 7: 输出报告

Step 7: Output Report

分析完成后，生成

report.md

记录发现和步骤。

After analysis is completed, generate

report.md

to record findings and steps.

Prompt 工程准则

Prompt Engineering Guidelines

不要手动算进制 — 任何时候需要转换数字，用
```
idapro_int_convert
```
先 survey 后深入 — 先看概况再针对性分析
持续加注释和重命名 — 分析过程中不断更新函数名和变量名，提升后续分析的准确性
跟踪交叉引用 — 发现有趣的数据/字符串，用
```
xrefs_to
```
看谁引用了它
遇到混淆代码 — 先做字符串解密、导入哈希去除、控制流平坦化去除等预处理
C++ STL 代码 — 用 FLIRT/Lumina 识别库函数后，再分析业务逻辑
不要暴力破解 — 分析应从反汇编中推导解决方案，用简单 Python 辅助计算
遇到 "No database bound" — 还没有打开任何二进制文件，先执行
```
open.ps1
```
遇到 "Failed to open database" — 可能是旧数据库文件被锁，
```
open.ps1
```
会自动降级到 Temp 副本（输出含
```
(temp copy)
```
标记）
带自动分析打开 GUI/复杂样本时 — 默认加
```
-TimeoutSeconds 600
```
，不要把长时间
```
INFO:opening:...
```
误判成脚本卡死

Do not calculate bases manually — Use
```
idapro_int_convert
```
whenever number conversion is needed
Survey first, then deep dive — Look at the overview first, then conduct targeted analysis
Continuously add comments and rename — Update function names and variable names during analysis to improve the accuracy of subsequent analysis
Track cross-references — When interesting data/strings are found, use
```
xrefs_to
```
to see who references them
When encountering obfuscated code — First perform preprocessing such as string decryption, import hash removal, control flow flattening removal
C++ STL code — Use FLIRT/Lumina to identify library functions before analyzing business logic
Do not brute force crack — Derive solutions from disassembly, use simple Python for auxiliary calculation
When encountering "No database bound" — No binary file has been opened yet, execute
```
open.ps1
```
first
When encountering "Failed to open database" — Old database files may be locked,
```
open.ps1
```
will automatically downgrade to Temp copy (output contains
```
(temp copy)
```
mark)
When opening GUI/complex samples with auto-analysis — Add
```
-TimeoutSeconds 600
```
by default, do not misjudge long
```
INFO:opening:...
```
as script stuck

路由上下文

Routing Context

上游入口:

skills/SKILL.md

（总控）、

routing.md

上游备选:

radare2/

（如果不想开 IDA，可以先 r2 快速侦察） 下游出口:

需 Frida 动态验证 →
```
reverse-engineering/tools-dynamic.md
```
需符号执行/angr →
```
reverse-engineering/tools-dynamic.md
```
需通用逆向方法论 →
```
reverse-engineering/SKILL.md
```

同级关联模块:

radare2/

（IDA 不可用时替代方案）

Upstream Entries:

skills/SKILL.md

(master control),

routing.md

Upstream Alternatives:

radare2/

(if you don't want to open IDA, you can use r2 for quick reconnaissance first) Downstream Exports:

Need Frida dynamic verification →
```
reverse-engineering/tools-dynamic.md
```
Need symbolic execution/angr →
```
reverse-engineering/tools-dynamic.md
```
Need general reverse engineering methodology →
```
reverse-engineering/SKILL.md
```

Peer Associated Modules:

radare2/

(alternative when IDA is unavailable)

按需自举（On-Demand Bootstrap）

On-Demand Bootstrap

本 skill 的入口脚本已接入统一自举系统。

The entry script of this skill has been integrated into the unified bootstrap system.

自动化能力边界

Automation Capability Boundaries

工具	可自动安装	安装方式	说明
idalib-mcp	✓	pip install (from GitHub)	`start.ps1` 缺失时自动安装
IDA Pro 本体	✗	商业软件，需手动安装	设置 `IDADIR` 环境变量指向安装目录

Tool	Auto-installable	Installation Method	Notes
idalib-mcp	✓	pip install (from GitHub)	Automatically installed when `start.ps1` is missing
IDA Pro本体	✗	Commercial software, manual installation required	Set `IDADIR` environment variable to point to the installation directory

安装步骤（已验证）

Installation Steps (Verified)

cmd

undefined

cmd

undefined

1. 设置 IDA 路径（替换为你的实际 IDA 安装目录）

1. Set IDA path (replace with your actual IDA installation directory)

setx IDADIR "<你的IDA安装目录>"

setx IDADIR "<your-ida-installation-directory>"

2. 从 GitHub 安装 ida-pro-mcp（PyPI 上的 ida-mcp 是另一个项目，不要装错！）

2. Install ida-pro-mcp from GitHub (ida-mcp on PyPI is another project, do not install it by mistake!)

pip install git+https://github.com/mrexodia/ida-pro-mcp.git

3. 安装 IDA 插件（选择 Streamable HTTP + Global + 全选客户端）

3. Install IDA plugin (select Streamable HTTP + Global + all clients)

ida-pro-mcp --install

4. 重启 IDA Pro，打开目标文件

4. Restart IDA Pro and open the target file

插件自动监听 127.0.0.1:13337

The plugin automatically listens on 127.0.0.1:13337

5. 验证

5. Verify

ida-pro-mcp --config


> ⚠️ **注意**：PyPI 上的 `ida-mcp` 包（作者 jtsylve）是另一个项目，不是我们需要的。
> 必须从 GitHub 安装 `mrexodia/ida-pro-mcp`。

ida-pro-mcp --config


> ⚠️ **Note**: The `ida-mcp` package on PyPI (author jtsylve) is another project, not what we need.
> Must install `mrexodia/ida-pro-mcp` from GitHub.

自举触发点

Bootstrap Trigger Points

scripts/start.ps1

：缺

idalib-mcp

时自动调用

bootstrap-reverse.ps1

MCP 注册：bootstrap 会自动把
```
idapro
```
写入 Claude MCP 配置

scripts/start.ps1

: Automatically calls

bootstrap-reverse.ps1

when

idalib-mcp

is missing

MCP Registration: Bootstrap will automatically write
```
idapro
```
into Claude MCP configuration

前置条件

Preconditions

IDA Pro 已安装且
```
IDADIR
```
环境变量已设置（或脚本内默认路径正确）
Python 已安装（idalib-mcp 依赖 Python）

IDA Pro is installed and
```
IDADIR
```
environment variable is set (or default path in script is correct)
Python is installed (idalib-mcp depends on Python)

任务完成自检（声称完成前 MUST 通过）

Task Completion Self-Check (MUST Pass Before Claiming Completion)

我是否执行了工作流中的每一步（而不是只阅读）？
survey/imports 是否已写入 Evidence（E-imports 或等价）？DLL/SYS 是否含 E-exports？IAT 失败是否记 E-iat-repair-fail？
用户若要求重做导入表/IAT，是否重做了同一步？
我是否基于
```
tool-index
```
使用了真实工具路径？
我是否产出了可复现证据（命令/脚本/截图/报告）？
我是否完成并回写了 RULES 要求的 Checklist 项？

Have I executed every step in the workflow (instead of just reading)?
Have survey/imports been written into Evidence (E-imports or equivalent)? Does DLL/SYS include E-exports? Is E-iat-repair-fail recorded when IAT fails?
If the user requested to redo import table/IAT check, did I redo the same step?
Did I use real tool paths based on
```
tool-index
```
?
Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
Did I complete and write back the Checklist items required by RULES?