idasql-skills

Triage and audit IDA binaries. Use when asked to analyze a binary, find suspicious behavior, detect crypto/network activity, review decompiled code against source, or run multi-table queries.

Edit IDA databases. Use when asked to add comments, rename symbols, apply types, create bookmarks, or clean up decompiled code for review.

Connect to IDA databases and bootstrap sessions. Use when starting analysis, routing to other skills, or setting up CLI/HTTP/MCP connections.

Query IDA strings, bytes, and binary data. Use when asked to search strings, find byte patterns, rebuild string tables, or analyze binary content.

IDA debugger operations. Use when asked to set breakpoints, patch bytes, add conditions, or manage a patch inventory.

Decompile and analyze IDA functions. Use when asked for pseudocode, ctree AST analysis, local variables, labels, or decompiler-driven cleanup.

Query IDA disassembly. Use when asked about functions, segments, instructions, blocks, operands, control flow, or raw code structure.

Complete idasql SQL function reference catalog. Use when looking up function signatures, parameters, or usage examples.

Search named IDA entities by pattern. Use when asked to find functions, labels, types, or members by name, or to seed xref/decompiler workflows from a name lookup.

Execute IDAPython via idasql. Use when SQL surfaces are insufficient and direct IDA SDK access is needed via Python snippets or scripts.

Re-source IDA binaries. Use when asked for recursive annotation, structure recovery, type reconstruction, or bottom-up program understanding.

Persistent key-value storage in IDA databases. Use when asked to store metadata, track progress, or persist session state via netnode_kv.

IDA type system. Use when asked to create, modify, or apply structs, unions, enums, typedefs, or parse C declarations.

Capture live IDA UI context. Use when the user references what's on screen, what's selected, or asks about the current view in IDA's GUI.

Analyze IDA cross-references. Use when asked about callers, callees, imports, data refs, call graphs, or dependency chains.