skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

ida-reverse

Automates IDA Pro binary analysis through MCP tools and PowerShell server scripts.

21|8|Updated Aug 3, 2026
Search Tags:#mcp#reverse engineering#binary analysis#decompilation#disassembly#ida pro#malware analysis
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill ida-reverse-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ida-reverse
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/ida-reverse
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill ida-reverse-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ida-pro-mcp, and includes scripts (resource) and references (resource) components.

What problem does it solve? Reverse engineering binaries with IDA Pro requires manually managing the idalib-mcp HTTP server, working around MCP schema validation bugs, handling locked database files, and knowing which of the 72 analysis tools to call in what order. This Skill codifies that entire workflow so an AI agent can analyze PE, ELF, DLL, SO, and firmware files deterministically instead of guessing commands. ## Core Features & Use Cases - Deterministic server and file management: scripts/start.ps1 launches the idalib-mcp HTTP server in the background with process-tree cleanup, and scripts/open.ps1 opens binaries via direct HTTP API calls, bypassing the known idalib_open schema validation bug, with automatic fallback to temp copies when database files are locked. - Full 72-tool analysis workflow: survey binaries, decompile and disassemble functions, trace cross-references and data flow, search strings and byte patterns, patch instructions, rename symbols, and manage types and stack frames through the idapro_* MCP tool family. - Use Case: A user asks to analyze a suspicious exe or find a password check in a DLL. The Skill starts the server, opens the file with a 600-second timeout for auto-analysis, surveys imports and strings, decompiles the verification function, traces the comparison logic, and produces an annotated report. ## Quick Start Use the ida-reverse skill to analyze this binary file and find its license verification logic.

Frequently Asked Questions about ida-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a binary file with IDA Pro from an AI agent?▼

Start the idalib-mcp HTTP server with scripts/start.ps1, then open the target with scripts/open.ps1 -Path followed by the file path. Once the session is ready, call idapro_* MCP tools such as survey_binary, decompile, and xrefs_to for analysis.

How to fix idalib_open schema validation errors in MCP clients?▼

The idalib_open tool fails structured output schema validation in some MCP clients. Bypass it by calling scripts/open.ps1, which invokes idalib_open directly over the HTTP API and returns the session ID once the database is bound.

Does this workflow support large binaries or GUI applications?▼

Yes. Pass -TimeoutSeconds 600 to open.ps1 for files needing long auto-analysis, or -NoAutoAnalysis to open quickly without analysis. The script polls session readiness and reports progress every 10 seconds instead of blocking.

Why does opening a file fail with a locked database error?▼

Orphaned idalib worker processes can hold locks on .id0, .id1, .nam, and .i64 files after a timeout. start.ps1 kills the full process tree, and open.ps1 automatically falls back to a GUID-prefixed temp copy when locks persist.

What are the prerequisites for running the IDA MCP server?▼

IDA Pro must be installed with the IDADIR environment variable pointing to its directory, plus Python with the mrexodia ida-pro-mcp package installed from GitHub. The PyPI ida-mcp package is a different project and will not work.

Related Skills

Explore More Software Engineering Skills→
guaidao2guaidao2
81

ghidra

Automate headless analysis and decompilation of executable binaries and firmware.

Community
Intermediate
YukiIto1999YukiIto1999

performing-ios-app-security-assessment

Identify iOS app security weaknesses using Frida and Objection.

Community
Advanced
xalgordxalgord
954

performing-yara-rule-development-for-detection

Develops and tests YARA rules that detect malware families through unique strings, byte patterns, and PE characteristics.

Community
Intermediate
2389-research2389-research
90

binary-re:static-analysis

Analyze binary structure and decompile functions with radare2 and Ghidra headless.

Official
Advanced