hack-the-world/idapluginlist/idapython

Claude Code and agent skill by hack-the-world/idapluginlist

Trust tier 2
  • community
LLM review pending
Source check pending

Checking that the SKILL.md file is still in the repository.

IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.

Install

npx vskill@latest install hack-the-world/idapluginlist/idapython

SKILL.md

IDAPython

Use modern ida_* modules. Avoid legacy idc module.

Module Router

TaskModuleKey Items
Bytes/memoryida_bytesget_bytes, patch_bytes, get_flags, create_*
Functionsida_funcsfunc_t, get_func, add_func, get_func_name
Namesida_nameset_name, get_name, demangle_name
Typesida_typeinftinfo_t, apply_tinfo, parse_decl
Decompilerida_hexraysdecompile, cfunc_t, lvar_t, ctree visitor
Segmentsida_segmentsegment_t, getseg, add_segm
Xrefsida_xrefxrefblk_t, add_cref, add_dref
Instructionsida_uainsn_t, op_t, decode_insn
Stack framesida_frameget_frame, define_stkvar
IterationidautilsFunctions(), Heads(), XrefsTo(), Strings()
UI/dialogsida_kernwinmsg, ask_*, jumpto, Choose
Database infoida_idainf_get_*, inf_is_64bit()
Analysisida_autoauto_wait, plan_and_wait
Flow graphsida_gdlFlowChart, BasicBlock
Register trackingida_regfinderfind_reg_value, reg_value_info_t

Core Patterns

Iterate functions
python
for ea in idautils.Functions():
name = ida_funcs.get_func_name(ea)
func = ida_funcs.get_func(ea)
Iterate instructions in function
python
for head in idautils.FuncItems(func_ea):
insn = ida_ua.insn_t()
if ida_ua.decode_insn(insn, head):
print(f"{head:#x}: {insn.itype}")
Cross-references
python
for xref in idautils.XrefsTo(ea):
print(f"{xref.frm:#x} -> {xref.to:#x} type={xref.type}")
Read/write bytes
python
data = ida_bytes.get_bytes(ea, size)
ida_bytes.patch_bytes(ea, b"\x90\x90")
Names
python
name = ida_name.get_name(ea)
ida_name.set_name(ea, "new_name", ida_name.SN_NOCHECK)
Decompile function
python
cfunc = ida_hexrays.decompile(ea)
if cfunc:
print(cfunc) # pseudocode
for lvar in cfunc.lvars:
print(f"{lvar.name}: {lvar.type()}")
Walk ctree (decompiled AST)
python
class MyVisitor(ida_hexrays.ctree_visitor_t):
def visit_expr(self, e):
if e.op == ida_hexrays.cot_call:
print(f"Call at {e.ea:#x}")
return 0
cfunc = ida_hexrays.decompile(ea)
MyVisitor().apply_to(cfunc.body, None)
Apply type
python
tif = ida_typeinf.tinfo_t()
if ida_typeinf.parse_decl(tif, None, "int (*)(char *, int)", 0):
ida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)
Create structure
python
udt = ida_typeinf.udt_type_data_t()
m = ida_typeinf.udm_t()
m.name = "field1"
m.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)
m.offset = 0
m.size = 4
udt.push_back(m)
tif = ida_typeinf.tinfo_t()
tif.create_udt(udt, ida_typeinf.BTF_STRUCT)
tif.set_named_type(ida_typeinf.get_idati(), "MyStruct")
Strings list
python
for s in idautils.Strings():
print(f"{s.ea:#x}: {str(s)}")
Wait for analysis
python
ida_auto.auto_wait() # Block until autoanalysis completes

Key Constants

ConstantValue/Use
BADADDRInvalid address sentinel
ida_name.SN_NOCHECKSkip name validation
ida_typeinf.TINFO_DEFINITEForce type application
o_reg, o_mem, o_imm, o_displ, o_nearOperand types
dt_byte, dt_word, dt_dword, dt_qwordData types
fl_CF, fl_CN, fl_JF, fl_JN, fl_FCode xref types
dr_R, dr_W, dr_OData xref types

Critical Rules

  1. NEVER convert hex/decimal manually — use int_convert MCP tool
  2. Wait for analysis: Call ida_auto.auto_wait() before reading results
  3. Thread safety: IDA SDK calls must run on main thread (use @idasync)
  4. 64-bit addresses: Always assume ea_t can be 64-bit

Anti-Patterns

AvoidDo Instead
idc.* functionsUse ida_* modules
Hardcoded addressesUse names, patterns, or xrefs
Manual hex conversionUse int_convert tool
Blocking main threadUse execute_sync() for long ops
Guessing at typesDerive from disassembly/decompilation

Detailed API Reference

For comprehensive documentation on any module, read docs/<module>.md:

  • High-use: ida_bytes, ida_funcs, ida_hexrays, ida_typeinf, ida_name, idautils
  • Medium-use: ida_segment, ida_xref, ida_ua, ida_frame, ida_kernwin
  • Specialized: ida_dbg (debugger), ida_nalt (netnode storage), ida_regfinder (register tracking)

Full RST sources from hex-rays.com available at docs/<module>.rst.

Security

  • Security scanPassed, 96 of 100Pattern checks on the skill's files.
  • Model reviewNot runA model review is scheduled for the next rescan.

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

Source

Popularity

Repository stars
561
Repository forks
62
7-day trend score
32

Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 19 Mar 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/hack-the-world/idapluginlist/idapython/badge)](https://verified-skill.com/skills/hack-the-world/idapluginlist/idapython)

Something wrong with this skill or its page? Tell us.