Imported from bkerler/ida_rpc (SKILL.md). Install upstream with npx skills add bkerler/ida_rpc. Copyright stays with the author.

SKILL.md — ida-rpc

How to use ida-rpc as a reverse-engineering skill inside an agent workflow.

What This Skill Provides

Direct, structured access to IDA Pro's analysis engine without GUI interaction. Commands print human-readable text by default; pass --json (before the subcommand) or set IDA_RPC_JSON=1 for JSON. No screen scraping, no MCP protocol overhead. Works in both interactive (GUI) and automation (headless) modes.

When to Use This Skill

• You need to decompile, disassemble, or analyze a binary.
• You need cross-references, function lists, imports, exports, or strings.
• You need to rename functions, set comments, or create data types programmatically.
• You need segment editing, processor context switching (ARM/Thumb), or assembly patching.
• You are working in an automation pipeline or multi-agent system.

What this skill requires

• RPC queries should always be run outside the sandbox.

Quick Start Workflow

1. Discover capabilities and project path

ida-rpc capabilities
ida-rpc find-project /path/to/binary-or-existing.i64
ida-rpc list-loaders /path/to/binary

Use capabilities as the stable automation probe. It describes the supported command groups and the recommended agent workflow. Add --json for machine-readable output.

2. Start the Daemon

# Open a binary and start the daemon
ida-rpc open /path/to/binary --arch <arch> --headless --detach

# Open an existing database (.i64 or .idb)
ida-rpc open --project /path/to/existing.i64 --arch <arch> --headless --detach

# For raw binaries, specify architecture and base address
ida-rpc open /path/to/raw.bin --arch arm --base 0x8000 --loader raw --headless --detach

# For custom loaders, first list candidates, then force the loader if needed
ida-rpc list-loaders /path/to/loader.bin
ida-rpc open /path/to/loader.bin --arch arm --loader miniloader --headless --detach

# When opening a system binary (e.g. /usr/bin/ls), specify a writable project path
ida-rpc open /usr/bin/ls --project /tmp/ls_analysis.i64 --arch x86 --headless --detach

3. Set the default project

export IDA_RPC_PROJECT=/path/to/binary.i64

4. Check status and list loaded binaries

# Check if a daemon is running for a project
ida-rpc status --project /tmp/ls_analysis.i64

# List all currently loaded binaries in a project
ida-rpc list-binaries --project /tmp/ls_analysis.i64

# List all active ida-rpc daemons on this machine
ida-rpc list

5. Run analysis commands

Commands print human-readable text by default. Add --json (before the subcommand) or set IDA_RPC_JSON=1 when you need structured output for jq or other tools.

# List functions (paginated)
ida-rpc functions --limit 20

# Decompile a function
ida-rpc decompile main

# Search for strings containing "password"
ida-rpc strings "password" --limit 20

# Find byte pattern
ida-rpc find-bytes "55 8b ec 83 ec"

# Get cross-references to a function
ida-rpc xrefs-to target_function

# Read raw bytes at an address
ida-rpc read-bytes 0x401000 64

6. Make annotations

# Rename a function
ida-rpc rename-function sub_401000 my_awesome_function

# Set a comment
ida-rpc set-comment 0x401020 "This is the entry point"

# Create a struct
ida-rpc create-struct my_struct "int" field1 "char" field2

# Set a bookmark
ida-rpc set-bookmark 0x401000 --type Analysis --comment "Suspicious loop"

7. Save and stop

ida-rpc save
ida-rpc stop

Command Reference for Agents

Lifecycle

Loader aliases accepted by --loader include:

Analysis & Listing

Decompilation & Disassembly

Cross-References

Annotations & Modifications

Lumina

Lumina commands use the primary or secondary Lumina server configured in IDA (Options > General > Lumina) or overridden for the IDA session with -Olumina:... / -Osecondary_lumina:.... Credentials are not returned.

Data Types

Segments

Processor Context

Namespaces

Bookmarks

Tags

Agent Workflow Patterns

Pattern 1: Explore → Analyze → Annotate

# 1. Discover
ida-rpc functions --limit 50 | jq '.result.functions[].name'

# 2. Deep-dive
ida-rpc decompile suspicious_func | jq '.result.c_code'
ida-rpc xrefs-to suspicious_func | jq '.result.xrefs[]'

# 3. Annotate findings
ida-rpc rename-function suspicious_func decrypt_payload
ida-rpc set-comment 0x401234 "Calls decrypt_payload"
ida-rpc save

Pattern 2: Batch String Hunt

# Find all strings matching a pattern, then decompile their xrefs
ida-rpc strings "auth" --limit 20 | jq '.result.strings[] | .address'
# For each string address, find xrefs-to, then decompile the referencing functions

Pattern 3: Structural Analysis

# Get memory map
ida-rpc memory-map | jq '.result.segments[] | select(.execute == true)'

# Find functions in a specific address range
ida-rpc functions --address-min 0x401000 --address-max 0x410000

# Decompile each function in that range
for name in $(ida-rpc functions --address-min 0x401000 --address-max 0x410000 | jq -r '.result.functions[].name'); do
    ida-rpc decompile "$name"
done

Pattern 4: Find Raw Binary Base Address

When you have a firmware dump or bare-metal image and don't know the load address, use basefind before loading:

# Scan a raw binary for likely base addresses (no daemon needed)
ida-rpc basefind /path/to/dump.bin --max-results 10

# Example output:
# {
#   "candidates": [
#     {"base": "0x8000000", "score": 10025, "refs": 25, "string_refs": 0, "source": "early-pointer"},
#     {"base": "0x8010000", "score": 18, "refs": 18, "string_refs": 0, "source": "absolute"}
#   ]
# }

# Use the best candidate to start IDA
ida-rpc start /path/to/dump.bin --base 0x8000000 --arch arm --headless --detach

Tuning parameters:

• --str-len (default 10): minimum printable-string length
• --diff-len (default 10): string/pointer delta window length
• --samplerate (default 20): sparse validation rate for large files
• --min-abs-refs (default 4): threshold for absolute-reference candidates

Pattern 5: Loading Raw Binaries and Memory Segments

When IDA cannot auto-detect the file format (e.g., firmware dumps, bare-metal images), load the raw binary, fix segment bitness/permissions, and then define functions.

# 1. Start the daemon with a raw binary
#    --base is the byte address (not paragraphs)
#    --arch selects the processor module and auto-configures the segment
ida-rpc start /path/to/dump.bin \
  --project /tmp/firmware.i64 \
  --base 0x8200000 \
  --arch arm \
  --headless --detach

# 2. The segment is auto-configured: class=CODE32, bitness=1, read+exec.
#    No manual edit-segment needed when --arch is provided.

# 3. Create functions at known entry points
ida-rpc create-function 0x8211170 --name func_entry

# 4. Disassemble and verify
ida-rpc disassemble 0x8211170 --count 20
ida-rpc functions --limit 20

Loading a raw binary with explicit file offset, load address, and size:

# Step 1: Create an empty database and start the daemon
#    Pass --arch so add-segment auto-configures class/bitnesss/perms.
ida-rpc start --project /tmp/firmware.i64 --arch arm --headless --detach

# Step 2: Create a segment at the target load address
#    Class, bitness, and permissions are auto-configured from --arch.
ida-rpc add-segment 0x08000000 0x08020000 --name FLASH

# Step 3: Extract bytes from a specific file offset and load them
#         dd:  bs=1 skip=<file_offset> count=<size>
dd if=/path/to/dump.bin bs=1 skip=0x2000 count=0x10000 of=/tmp/extracted.bin
python3 -c "import sys; print(open('/tmp/extracted.bin','rb').read().hex())" > /tmp/extracted.hex
ida-rpc write-bytes 0x08000000 "$(cat /tmp/extracted.hex)"

# Step 4: Define functions and analyze
ida-rpc create-function 0x08000000 --name reset_handler
ida-rpc disassemble 0x08000000 --count 10
ida-rpc functions --limit 20

Supported --arch values for raw binary auto-configuration:

Important notes on architecture selection:

• thumb vs arm: For 32-bit ARM firmware that is primarily Thumb code (common in Cortex-M/MCU binaries), use --arch thumb. This sets the segment class to CODE16, which tells IDA to disassemble in Thumb mode by default. If you later encounter ARM-mode functions, use set-processor-context to switch the T-bit (see Pattern 5).
• For raw binaries, IDA may default to 64-bit addressing even for 32-bit processors. --arch is mandatory and auto-configures the segment with the correct bitness and class.

Segment class values: CODE, DATA, CONST, BSS, STACK, HEAP, XTRN.

Pattern 6: ARM/Thumb Mode Switching

# Check current processor context at an address
ida-rpc get-processor-context --address 0x8000 --register T

# Switch to Thumb mode (T=1) for a range
ida-rpc set-processor-context 0x8000 T 1 --end 0x9000

Pattern 7: Bulk Decompile for Diffing

# Decompile all functions matching a pattern
ida-rpc decompile-all --function "parse" --limit 50 | jq '.result.functions[].c_code'

Pattern 8: Assembly Patching

# Assemble a nop sled at an address (requires Keystone Engine)
ida-rpc assemble 0x401000 "nop"
ida-rpc assemble 0x401001 "jmp 0x401050"

JSON Response Structure

Every successful response:

{
  "id": "<uuid>",
  "ok": true,
  "result": { ... }
}

Every error response:

{
  "id": "<uuid>",
  "ok": false,
  "error": "ValueError",
  "message": "Function 'foo' not found."
}

Parse with jq .result to extract the payload, or check .ok first.

Environment Variables

Troubleshooting

Programmatic Use (Python)

from ida_rpc.client import send_request
from ida_rpc.session import socket_path_for_project
from pathlib import Path

sock = socket_path_for_project("/tmp/test.i64")
resp = send_request(sock, "functions", {"limit": 10})
print(resp["result"]["functions"])

Protocol Compatibility Note

The wire format ({"id", "cmd", "args"} → {"id", "ok", "result/error"}) is designed to be compatible with ghidra-rpc. If you have existing clients built for Ghidra, point them at the IDA socket path and most read-only commands will work with minimal or no changes.