SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
scripting-ida-with-idapython
0
Automates IDA Pro analysis with IDAPython by generating scripts that enumerate functions, decode strings, rename by signature, and export analysis results, and by documenting the headless idat batch invocation. Activates for requests to script IDA Pro, write IDAPython automation, or run IDA in batch/headless mode.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Scripting IDA Pro With IDAPython ## When to Use - You use IDA Pro and want to automate repetitive analysis — enumerate functions, decode strings, apply signature-based renames, and export results — via IDAPython. - You need a headless `idat` batch invocation to process many samples. **Do not use** IDA's debugger (`-r`) on untrusted samples on your host — these scripts drive *static* analysis. Work in an isolated environment. ## Prerequisites - IDA Pro with IDAPython, and the samples to analyze. ## Safety & Handling - IDA static analysis does not execute the sample; keep the input directory isolated. ## Workflow ### Step 1: Generate an analysis script ```bash python scripts/analyst.py script --emit functions,strings --out ida_export.py ``` Emits an IDAPython script using the real API (`idautils.Functions`, `idc.get_func_name`, `idautils.Strings`) that writes results to JSON next to the IDB. ### Step 2: Generate the headless batch command ```bash python scripts/analyst.py batch --script ida_export.py --input sample.exe ``` Builds the `idat -A -S"script" input` invocation (auto-mode, run script, no UI) for batch runs. ### Step 3: Run and collect Execute the batch command per sample and aggregate the JSON exports. ### Step 4: Iterate Extend the generated script with signature renames (FLIRT) and decompiler (`ida_hexrays`) output as needed. ## Validation - The generated script uses real IDAPython API calls. - The batch command uses `-A` (auto) and `-S` (script) correctly. - JSON output is produced per processed IDB. ## Pitfalls - IDAPython API drift between IDA 7.x and 9.x — target your version. - Forgetting `-A` leaves IDA waiting for interactive input in batch. - Decompiler calls require a licensed Hex-Rays decompiler. ## References - See [`references/api-reference.md`](references/api-reference.md) for the generator. - IDAPython and idat batch references (linked in frontmatter).