Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Instruções da origem · Visualização somente leitura
name
iida-mcp-ida-integration
description
IDA Pro plugin that exposes static analysis capabilities via MCP HTTP server for reverse engineering workflows
triggers
["analyze binary with IDA through MCP","connect to IDA Pro MCP server","use IDA decompiler via MCP","reverse engineer executable with iida-mcp","query IDA database through MCP tools","setup IDA Pro MCP integration","analyze functions and disassembly with IDA MCP","use iida-mcp for binary analysis"]
iida-mcp is an IDA Pro plugin that exposes the current IDB's static analysis capabilities through a local HTTP MCP service. It provides 77 MCP tools for binary analysis, supports multiple IDA instances with automatic routing, and offers optional Windows kernel driver capabilities for kernel-mode analysis.
What iida-mcp Does
Static Analysis via MCP: Exposes IDA Pro's reverse engineering capabilities through Model Context Protocol
Multi-Instance Support: Automatically routes requests to the correct IDA instance when multiple IDBs are open
Comprehensive Tools: 77 MCP tools covering disassembly, decompilation, CFG analysis, cross-references, and more
Kernel Analysis: Optional Windows kernel driver for reading kernel memory and enumerating modules
x86/x86-64 Focus: Primarily designed for x86/x86-64 architecture executables
list_files - List all connected IDA instances and their files:
# Returns list of active IDB files with their IDs# Use file IDs for the 'f' parameter in other tools
get_file_info - Get metadata about the analyzed file:
# Arguments: f (optional file ID)# Returns: filename, path, MD5, SHA256, architecture, etc.
read_bytes - Read raw bytes from the binary:
# Arguments: # ea (effective address, hex string)# size (number of bytes)# f (optional file ID)
Functions and Disassembly
list_functions - Enumerate all functions:
# Arguments: f (optional file ID)# Returns: array of {ea, name, size, flags}
get_function_info - Get detailed function information:
# Arguments:# ea (function address, hex string)# f (optional file ID)# Returns: start_ea, end_ea, size, name, frame size, flags
disassemble - Get disassembly listing:
# Arguments:# ea (start address, hex string)# count (number of instructions, default 10)# f (optional file ID)# Returns: array of disassembled instructions with addresses
disasm_bytes - Disassemble raw bytes using Capstone:
# Arguments:# ea (function address, hex string)# f (optional file ID)# Returns: C-like pseudocode
get_function_args - Get function parameter information:
# Arguments:# ea (function address, hex string)# f (optional file ID)# Returns: array of {name, type, location}
get_local_vars - Get local variables:
# Arguments:# ea (function address, hex string)# f (optional file ID)
Control Flow and Cross-References
get_function_cfg - Get control flow graph:
# Arguments:# ea (function address, hex string)# f (optional file ID)# Returns: nodes and edges representing CFG
get_xrefs_to - Get cross-references to an address:
# Arguments:# ea (target address, hex string)# f (optional file ID)# Returns: array of {from, to, type}
get_xrefs_from - Get cross-references from an address:
# Arguments:# ea (source address, hex string)# f (optional file ID)
get_call_tree - Build call tree (callers/callees):
# Arguments:# ea (function address, hex string)# direction ("up" for callers, "down" for callees)# depth (recursion depth, default 3)# f (optional file ID)
# Arguments:# name (module name, e.g. "ntoskrnl.exe")# Requires: iida-mcp-ioctl.sys driver loaded
map_ida_to_runtime - Map IDA address to runtime address:
# Arguments:# ea (IDA address, hex string)# module_name (target module name)# f (optional file ID)# Useful for live debugging correlation
Common Usage Patterns
Single IDB Analysis
When working with one IDA database, omit the f parameter:
# Get function info at specific address
get_function_info(ea="0x401000")
# Decompile function
decompile(ea="0x401000")
# Get cross-references
get_xrefs_to(ea="0x401000")
Multi-IDB Workflow
When multiple IDA instances are connected:
# 1. List available files
files = list_files()
# Returns: [{id: "file1", path: "C:\\samples\\malware.exe"}, ...]# 2. Use file ID in subsequent calls
get_function_info(ea="0x401000", f="file1")
decompile(ea="0x401000", f="file1")
