一键导入
ui-context
Capture live IDA UI context. Use when the user references what's on screen, what's selected, or asks about the current view in IDA's GUI.
用 Codex 或 Claude 帮你安装 复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它检查 Skill 页面并帮你完成安装。
菜单
Capture live IDA UI context. Use when the user references what's on screen, what's selected, or asks about the current view in IDA's GUI.
用 Codex 或 Claude 帮你安装 复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Triage and audit IDA binaries. Use when asked to analyze a binary, find suspicious behavior, detect crypto/network activity, review decompiled code against source, or run multi-table queries.
Edit IDA databases. Use when asked to add comments, rename symbols, apply types, create bookmarks, or clean up decompiled code for review.
Connect to IDA databases and bootstrap sessions. Use when starting analysis, routing to other skills, or setting up CLI/HTTP/MCP connections.
Query IDA strings, bytes, and binary data. Use when asked to search strings, find byte patterns, rebuild string tables, or analyze binary content.
IDA debugger operations. Use when asked to set breakpoints, patch bytes, add conditions, or manage a patch inventory.
Decompile and analyze IDA functions. Use when asked for pseudocode, ctree AST analysis, local variables, labels, or decompiler-driven cleanup.
| name | ui-context |
| description | Capture live IDA UI context. Use when the user references what's on screen, what's selected, or asks about the current view in IDA's GUI. |
| allowed-tools | ["Bash","Read","Glob","Grep"] |
Use this function to capture active UI state:
SELECT get_ui_context_json();
Capture once per user question, then reuse that snapshot while answering. Capture again only when the user asks to refresh/re-check, or when a new UI-referential question starts.
Use this skill for prompts like:
get_ui_context_json() before answering UI-referential prompts.has_address: false, explain limits and do not invent code context.focused_widget / main_viewer)type_id (int): raw IDA twidget_type_t numeric id.type_name (string): the SDK macro name for the widget on the building SDK (for example "BWN_PSEUDOCODE", "BWN_TILIST"). The name at SDK slot 10 differs by IDA version (BWN_TILVIEW / BWN_TICSR / BWN_TITREE).canonical_name (string): a stable cross-version name. For the "Local Types" widget (slot 10) this always reads "BWN_LOCAL_TYPES"; for every other widget it equals type_name. Prefer this for cross-version reasoning.category (string): high-level grouping — one of disassembly, decompiler, hex_view, type_view, chooser, debugger, navigation, output, script, auxiliary, unknown.is_address (bool): widget exposes a meaningful address anchor (true for DISASM, HEXVIEW, PSEUDOCODE, MICROCODE).is_custom_view (bool): viewer-style widget with custom line content.is_chooser_like (bool): row-based list/chooser widget where row selection is meaningful.title (string): the widget's title as IDA reports it.main_viewer carries the same widget fields except is_chooser_like (the main viewer is always a viewer, not a chooser).
this / here / current / selected: capture a fresh snapshot for this question.that / previous / earlier: reuse the most recent snapshot in the same working flow.get_ui_context_json() is registered in every runtime, but only the IDA GUI
plugin returns live UI state.available:true; the idalib/CLI stub carries
available:false / capture.source:"cli" (no error, just no UI). So available
is the reliable GUI-vs-CLI discriminator in both directions — key on it.binary is database metadata only; it is not a UI context replacement.
Use this fixed shape after reading UI context:
What You Are Viewing: widget/view summary.What Is Selected: selection range and preview (or "no active selection").Code Context: address/function/segment if available; otherwise mention non-address view.Limits: runtime constraints or missing fields affecting certainty.Suggested Next Query: one concrete follow-up command/query.SELECT get_ui_context_json();
Answer with the template fields above. Include focused widget title/type and current anchor address if present.
SELECT get_ui_context_json();
Summarize active view and selection first, then propose the next action tied to that context (for example, decompile current function).
SELECT get_ui_context_json();
Prioritize selection begin/end and preview text. Explicitly state when there is no active selection.
SELECT get_ui_context_json();
SELECT decompile(0x401000);
Replace 0x401000 with the captured function/address anchor.
Reuse the most recent snapshot from the same flow (do not auto-refresh unless asked), then continue analysis from that stored anchor.
SELECT get_ui_context_json();
If has_address: false, report chooser selection details and state there is no code address anchor in this view.
If get_ui_context_json() cannot run:
SELECT * FROM binary for DB orientation)binary output as UI context.