search_immediate_value
Locate specific immediate values in binary files using defined start and end addresses, supporting number or string searches with customizable radix settings.
Instructions
Search for immediate values in the binary
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| endAddress | No | End address for search (optional) | |
| radix | No | Radix for number conversion (default: 16) | |
| startAddress | No | Start address for search (optional) | |
| value | Yes | Value to search for (number or string) |
Implementation Reference
- index.ts:472-508 (handler)MCP tool handler for 'search_immediate_value': validates input arguments, calls IDARemoteClient.searchForImmediateValue, formats and returns the search results.case 'search_immediate_value': if (!isValidSearchImmediateValueArgs(request.params.arguments)) { throw new McpError( ErrorCode.InvalidParams, 'Invalid search immediate value arguments' ); } try { const { value, radix, startAddress, endAddress } = request.params.arguments; const result = await ida.searchForImmediateValue(value, { radix, startAddress, endAddress }); return { content: [ { type: 'text', text: `Found ${result.count} occurrences of immediate value ${value}:\n\n${JSON.stringify(result.results, null, 2) }`, }, ], }; } catch (error: any) { return { content: [ { type: 'text', text: `Error searching for immediate value: ${error.message || error}`, }, ], isError: true, }; }
- index.ts:35-40 (schema)TypeScript interface defining the input arguments for the search_immediate_value tool.interface SearchImmediateValueArgs { value: string | number; radix?: number; startAddress?: string | number; endAddress?: string | number; }
- index.ts:236-261 (registration)Registration of the 'search_immediate_value' tool in the MCP server's listTools response, including input schema.{ name: 'search_immediate_value', description: 'Search for immediate values in the binary', inputSchema: { type: 'object', properties: { value: { type: 'string', description: 'Value to search for (number or string)', }, radix: { type: 'number', description: 'Radix for number conversion (default: 16)', }, startAddress: { type: 'string', description: 'Start address for search (optional)', }, endAddress: { type: 'string', description: 'End address for search (optional)', }, }, required: ['value'], }, },
- index.ts:97-103 (helper)Validator function to check if arguments match SearchImmediateValueArgs interface.const isValidSearchImmediateValueArgs = (args: any): args is SearchImmediateValueArgs => { return ( typeof args === 'object' && args !== null && (typeof args.value === 'string' || typeof args.value === 'number') ); };
- idaremoteclient.ts:336-366 (helper)IDARemoteClient helper method that constructs query parameters and makes HTTP GET request to IDA Pro remote API endpoint /search/immediate for the actual search.async searchForImmediateValue( value: number | string, options: { radix?: number; startAddress?: number | string; endAddress?: number | string; } = {} ): Promise<ImmediateSearchResponse> { const params = new URLSearchParams(); params.append('value', value.toString()); if (options.radix !== undefined) { params.append('radix', options.radix.toString()); } if (options.startAddress !== undefined) { const startAddr = typeof options.startAddress === 'string' ? options.startAddress : options.startAddress.toString(); params.append('start', startAddr); } if (options.endAddress !== undefined) { const endAddr = typeof options.endAddress === 'string' ? options.endAddress : options.endAddress.toString(); params.append('end', endAddr); } return this.get<ImmediateSearchResponse>(`/search/immediate?${params.toString()}`); }