search_immediate_value
Find specific numeric or string values within a binary file during reverse engineering analysis in IDA Pro.
Instructions
Search for immediate values in the binary
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| value | Yes | Value to search for (number or string) | |
| radix | No | Radix for number conversion (default: 16) | |
| startAddress | No | Start address for search (optional) | |
| endAddress | No | End address for search (optional) |
Implementation Reference
- index.ts:472-508 (handler)MCP server handler for the 'search_immediate_value' tool. Validates input arguments and delegates execution to IDARemoteClient.searchForImmediateValue, then formats and returns the results.case 'search_immediate_value': if (!isValidSearchImmediateValueArgs(request.params.arguments)) { throw new McpError( ErrorCode.InvalidParams, 'Invalid search immediate value arguments' ); } try { const { value, radix, startAddress, endAddress } = request.params.arguments; const result = await ida.searchForImmediateValue(value, { radix, startAddress, endAddress }); return { content: [ { type: 'text', text: `Found ${result.count} occurrences of immediate value ${value}:\n\n${JSON.stringify(result.results, null, 2) }`, }, ], }; } catch (error: any) { return { content: [ { type: 'text', text: `Error searching for immediate value: ${error.message || error}`, }, ], isError: true, }; }
- idaremoteclient.ts:336-366 (helper)Core implementation of immediate value search. Constructs query parameters and makes HTTP GET request to IDA Pro remote API endpoint '/search/immediate'.async searchForImmediateValue( value: number | string, options: { radix?: number; startAddress?: number | string; endAddress?: number | string; } = {} ): Promise<ImmediateSearchResponse> { const params = new URLSearchParams(); params.append('value', value.toString()); if (options.radix !== undefined) { params.append('radix', options.radix.toString()); } if (options.startAddress !== undefined) { const startAddr = typeof options.startAddress === 'string' ? options.startAddress : options.startAddress.toString(); params.append('start', startAddr); } if (options.endAddress !== undefined) { const endAddr = typeof options.endAddress === 'string' ? options.endAddress : options.endAddress.toString(); params.append('end', endAddr); } return this.get<ImmediateSearchResponse>(`/search/immediate?${params.toString()}`); }
- index.ts:236-261 (registration)Tool registration in ListToolsRequestSchema handler, defining name, description, and input schema for 'search_immediate_value'.{ name: 'search_immediate_value', description: 'Search for immediate values in the binary', inputSchema: { type: 'object', properties: { value: { type: 'string', description: 'Value to search for (number or string)', }, radix: { type: 'number', description: 'Radix for number conversion (default: 16)', }, startAddress: { type: 'string', description: 'Start address for search (optional)', }, endAddress: { type: 'string', description: 'End address for search (optional)', }, }, required: ['value'], }, },
- index.ts:35-40 (schema)TypeScript interface defining the input arguments for the search_immediate_value tool, used for runtime validation.interface SearchImmediateValueArgs { value: string | number; radix?: number; startAddress?: string | number; endAddress?: string | number; }
- index.ts:97-103 (helper)Runtime validation function for SearchImmediateValueArgs type, ensuring required 'value' field is present and of correct type.const isValidSearchImmediateValueArgs = (args: any): args is SearchImmediateValueArgs => { return ( typeof args === 'object' && args !== null && (typeof args.value === 'string' || typeof args.value === 'number') ); };