bkerler/ida_rpc/ida-rpc

SKILL.md — ida-rpc

How to use ida-rpc as a reverse-engineering skill inside an agent workflow.

What This Skill Provides

Direct, structured access to IDA Pro's analysis engine without GUI interaction. Commands print human-readable text by default; pass --json (before the subcommand) or set IDA_RPC_JSON=1 for JSON. No screen scraping, no MCP protocol overhead. Works in both interactive (GUI) and automation (headless) modes.

When to Use This Skill

• You need to decompile, disassemble, or analyze a binary.
• You need cross-references, function lists, imports, exports, or strings.
• You need to rename functions, set comments, or create data types programmatically.
• You need segment editing, processor context switching (ARM/Thumb), or assembly patching.
• You are working in an automation pipeline or multi-agent system.

What this skill requires

• Run Unix-socket RPC queries outside the sandbox. ida-rpc-codex starts a

loopback TCP session whose RPC commands can run inside the sandbox.

Quick Start Workflow

1. Discover capabilities and project path

ida-rpc capabilities
ida-rpc find-project /path/to/binary-or-existing.i64
ida-rpc list-loaders /path/to/binary

Use capabilities as the stable automation probe. It describes the supported command groups and the recommended agent workflow. Add --json for machine-readable output.

2. Start the Daemon

# Open a binary and start the daemon
ida-rpc open /path/to/binary --arch <arch> --headless --detach
 
# Open an existing database (.i64 or .idb)
ida-rpc open --project /path/to/existing.i64 --arch <arch> --headless --detach
 
# For raw binaries, specify architecture and base address
ida-rpc open /path/to/raw.bin --arch arm --base 0x8000 --loader raw --headless --detach
 
# For custom loaders, first list candidates, then force the loader if needed
ida-rpc list-loaders /path/to/loader.bin
ida-rpc open /path/to/loader.bin --arch arm --loader miniloader --headless --detach
 
# When opening a system binary (e.g. /usr/bin/ls), specify a writable project path
ida-rpc open /usr/bin/ls --project /tmp/ls_analysis.i64 --arch x86 --headless --detach

3. Set the default project

export IDA_RPC_PROJECT=/path/to/binary.i64

4. Check status and list loaded binaries

# Check if a daemon is running for a project
ida-rpc status --project /tmp/ls_analysis.i64
 
# List all currently loaded binaries in a project
ida-rpc list-binaries --project /tmp/ls_analysis.i64
 
# List all active ida-rpc daemons on this machine
ida-rpc list

5. Run analysis commands

Commands print human-readable text by default. Add --json (before the subcommand) or set IDA_RPC_JSON=1 when you need structured output for jq or other tools.

# List functions (paginated)
ida-rpc functions --limit 20
 
# Decompile a function
ida-rpc decompile main
 
# Search for strings containing "password"
ida-rpc strings "password" --limit 20
 
# Find byte pattern
ida-rpc find-bytes "55 8b ec 83 ec"
 
# Get cross-references to a function
ida-rpc xrefs-to target_function
 
# Read raw bytes at an address
ida-rpc read-bytes 0x401000 64

6. Make annotations

# Rename a function
ida-rpc rename-function sub_401000 my_awesome_function
 
# Set a comment
ida-rpc set-comment 0x401020 "This is the entry point"
 
# Create a struct
ida-rpc create-struct my_struct "int" field1 "char" field2
 
# Set a bookmark
ida-rpc set-bookmark 0x401000 --type Analysis --comment "Suspicious loop"

7. Save and stop

ida-rpc save
ida-rpc stop

Command Reference for Agents

Lifecycle

Loader aliases accepted by --loader include:

Analysis & Listing

Decompilation & Disassembly

Cross-References

Annotations & Modifications

Lumina

Lumina commands use the primary or secondary Lumina server configured in IDA (Options > General > Lumina) or overridden for the IDA session with -Olumina:... / -Osecondary_lumina:.... Credentials are not returned.

Data Types

Segments

Processor Context

Namespaces

Bookmarks

Tags

Agent Workflow Patterns