列出所有已连接的 IDA/Hopper 实例。无需加载 IDB。返回 instance_id,name,binary_path,idb_path,base_addr。

获取指定实例详情。instance_id 来自 instance_list。返回 binary_path,idb_path,base_addr,processor 等。

反编译函数为伪代码(C 风格)。输入地址或符号名。返回 addr,code。失败返回 error。

反汇编函数为汇编指令。输入地址或符号名。返回 addr,asm(行列表),cursor。支持 offset/分页。

Profile functions with summary metrics and optional sampled details.

Run comprehensive analysis over one or more target functions.

获取交叉引用(引用的目标地址)。

Query xrefs with direction/type filters and pagination.

Get cross-references to structure fields

Return unique callees per function, capped by limit.

Search byte patterns (supports ??) with offset/limit pagination.

Return function CFG blocks with offset/max_blocks pagination.

Search strings/immediates/refs for targets with offset/limit pagination.

Query instructions with mnemonic/operand filters and scoped scans.

导出函数数据。format: json(含 asm/code/xrefs)、c_header、prototypes。输入地址或符号名。

Build bounded callgraph from roots with depth/node/edge limits.

Compact single-function analysis: pseudocode, strings, constants, callers, callees, xrefs, blocks.

Analyze related functions as a group: per-function summaries, internal call graph, shared data.

Follow cross-references from or to an address, automatically traversing multiple hops. Use 'forward' to see where data flows TO (xrefs-from), or 'backward' to see where data flows FROM (xrefs-to). At each node in the traversal, returns the function name, instruction, and whether it's code or data. Use this when you find an interesting string, constant, or global and want to understand every code path that touches it without manually chaining xrefs_to calls. Do not use for call graph traversal — use callgraph for that. max_depth controls how many hops to follow (default 5, max 20).

Health/ready probe for MCP server and current IDB state.

Warm up IDA subsystems to reduce first-call latency and transient failures.

按地址或名称查找函数。输入: 地址(0x401000/sub_401000)或符号名(main,start)。输出: addr,name,size。支持批量。

数值进制转换。输入任意格式数(0x/十进制)，输出 decimal/hex/ascii/binary。禁止 LLM 手算进制，必须调用此工具。

列出函数。支持 glob 过滤、分页。'0:50'=offset:count（列表索引，非地址）。

Query functions with richer filtering than list_funcs.

列出全局变量。支持 glob 过滤、分页。'0:20'=offset:count（列表索引，非地址）。

Query IDB entities with typed filters, projection, and pagination.

列出导入表。返回 addr, imported_name, module。用于查动态链接/API 调用。

Query imports with richer filtering than imports(offset,count).

Save active IDB to disk, optionally to a provided path.

在二进制字符串中按正则搜索。返回 addr,string。不区分大小写。用于找硬编码字符串。

Search the rendered listing using IDA's native text search (fast C++ scan).

Discovers candidate EAs with ida_search.find_text(), then renders each hit once via ida_lines.generate_disassembly() to extract matching lines and classify them as disasm or comment. Returns one hit per EA.

List all discovered IDA Pro instances with their binary name, port, and reachability status.

Use this to see which IDA databases are currently open and available for analysis. The 'active' field indicates which instance is currently handling your tool calls.

Switch to a different IDA Pro instance. All subsequent tool calls will be routed to the selected instance. Use list_instances to see available instances.

To switch back to this instance, call select_instance with this instance's port, or call select_instance with port=0 to reset.

从内存读取原始字节。输入格式: 对象{addr,size}、数组、或字符串'addr:size'(例'0x401000:16'、'0x401000:16, 0x402000:8')。返回 addr,data(hex)。

从指定地址按类型读整数。支持有符号(i)无符号(u)、8/16/32/64位、大小端(le/be)。返回 addr,ty,value。

从地址读取 IDA 识别的字符串(C/宽字符)。返回 addr,value。若该址无字符串则 error。

按地址或符号名读取全局变量值。自动识别 hex 地址 vs 名称。需 IDA 已定义该全局类型。

Patch bytes at memory addresses with hex data

Write integer values to memory addresses

Set comments at addresses (both disassembly and decompiler views)

Append comments at addresses, deduping exact text by default.

Patch assembly instructions at addresses

批量重命名: 函数、全局变量、局部变量、栈变量。支持 dry_run 等选项。

Define functions; IDA infers bounds unless end is provided.

Convert bytes to code instruction(s) at address(es).

Undefine item(s) at address(es), converting back to raw bytes.

Create unique byte signatures for addresses. Generates the shortest unique signature starting at each address by walking instructions and wildcarding operands. Useful for finding stable patterns that survive recompilation.

Create unique byte signatures for function entry points. Resolves each name/address to a function, then generates the shortest unique signature starting at the function start.

Create a byte signature for a specific address range (e.g. a selected region). Unlike make_signature, this does NOT guarantee uniqueness — it simply encodes the bytes in the range with optional operand wildcarding.

Find signatures for code locations that reference an address. For each input address, finds all code cross-references TO it, generates a unique signature at each xref site, and returns the shortest ones. Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly.

Return stack variables for function address(es).

Create stack variables from typed stack declarations.

Delete stack variables by name or offset.

Get a compact overview of the binary in one call. Returns file metadata, segment layout, entry points, statistics, top 15 strings and functions ranked by xref count (functions include classification: thunk/wrapper/leaf/dispatcher/ complex), imports by category, and call graph summary. Use this as your FIRST tool call when starting analysis. Do not call list_funcs, imports, or find_regex separately for triage — this returns all of that. Use detail_level='minimal' for binaries with >10k functions.

Declare C type definitions in local type library.

Create or extend local enums in an idempotent way.

Read struct fields from memory at address; auto-detect type when possible.

Search local structs/unions by name pattern.

Query local types with structured filters/projection-friendly output.

Inspect named types (size/kind/declaration/members).

Apply types (function/global/local/stack)

Apply multiple type edits and return aggregate status.

Infer and apply likely types at target addresses.

请求指定 IDA 实例立即刷新其本地 SQLite 静态缓存 (xxx.idb.mcp.sqlite)。实际刷新仍然需要 IDA 进入 idle 状态才会执行，此工具仅唤醒插件端守护线程并立即返回。

查询指定 IDA 实例的本地 SQLite 静态缓存状态 (status / last_updated / 各表计数)。当 status != 'ready' 时，find_regex / entity_query / list_funcs / list_globals / imports 等工具将返回错误并提示稍后重试。