Add or replace the IDA bookmark at an address. Set prefix="" for no prefix.

Run comprehensive analysis over one or more target functions.

Analyze related functions as a group: per-function summaries, internal call graph, shared data.

Compact single-function analysis: pseudocode, strings, constants, callers, callees, xrefs, blocks.

Append comments at addresses, deduping exact text by default.

Return function CFG blocks with offset/max_blocks pagination.

Return unique callees per function, capped by limit.

Build bounded callgraph from roots with depth/node/edge limits.

Release this session's lease on an IDA database (.i64/.idb) without disrupting other clients. If this is the final lease on a managed idalib worker, orphaned IDA Python execution is cancelled and this call waits for the IDB to shut down. Databases open in the IDA GUI stay open.

Create stack variables from typed stack declarations.

Declare C type definitions in local type library.

Decompile function(s) at address(es); returns pseudocode and per-item errors.

Convert bytes to code instruction(s) at address(es).

Define functions; IDA infers bounds unless end is provided.

Delete stack variables by name or offset.

检测常见混淆模式：控制流平坦化、字符串加密、反调试、死代码，返回各标志与详情。

Rename a function, set its type, or add a comment, and immediately see the before/after decompilation side by side. Use this instead of calling rename then decompile separately when you want to verify that a rename or type change actually improved readability. Actions: 'rename_func' (action_args: {name: str}), 'set_type' (action_args: {type: str}), 'set_comment' (action_args: {comment: str}). Returns {before, after, action_applied, changes_detected}. Especially useful during batch renaming to confirm each change had the intended effect.

Disassemble function with offset/max_instructions pagination and optional total count.

Query IDB entities with typed filters, projection, and pagination.

Create or extend local enums in an idempotent way.

Run Python (IDAPython and the ida-domain API) against the binary open in IDA: decompile a function to Hex-Rays pseudocode, disassemble (disasm) instructions, enumerate functions, strings, imports, exports, symbols, segments and sections, find cross references (xrefs to/from an address, callers, callees, call graph), get the function at an address, inspect or apply types and structs, rename functions and variables, add comments, and patch bytes. Returns the result plus stdout/stderr. Look up API names with reference first.

Export function data for addresses in json/c_header/prototypes formats.

Search strings/immediates/refs for targets with offset/limit pagination.

Search byte patterns (supports ??) with offset/limit pagination.

Search strings by case-insensitive regex with offset/limit pagination.

Find signatures for code locations that reference an address. For each input address, finds all code cross-references TO it, generates a unique signature at each xref site, and returns the shortest ones. Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly.

Invalidate the Hex-Rays decompile cache for one or more functions.

Use after set_type, rename (especially of locals), set_op_type, or make_data so the next decompile call regenerates fresh pseudocode instead of returning a cached, stale view.

Profile functions with summary metrics and optional sampled details.

Query functions with richer filtering than list_funcs.

一键生成结构化 markdown 报告，帮助快速理解程序核心逻辑（全量函数扫描）。

自动识别常见算法（md5/sha/aes/des/rc4/tea/xor/base64/crc32/zlib 等），返回算法类型和置信度。

自动生成结构化分析报告（函数/全局/字符串/入口点全量清单）。

Read bytes from memory addresses

动态字符串解密映射（静态字符串 + 运行期记录的动态字符串）。

从反编译伪代码中启发式提取 flag/校验约束线索（长度比较、常量 == 等）。

Read global variable values by address or symbol name.

Read integer values from memory addresses

自动定位可 patch 位置（条件跳转、call、反调试 int 0x2d 等）。

Read strings from memory addresses

Save active IDB to disk, optionally to a provided path.

The open database is backed by loose working files (.id0/.id1/.id2/.nam/.til) that IDA actively manages, headless included. Killing them out from under the open database corrupts it (issues #446, #498), so DBFL_KILL is never used here: an in-place save uses IDA's native save (Ctrl+W), and an explicit different destination gets a compressed copy while the working files stay.

List imports with module names using offset/count pagination.

Query imports with richer filtering than imports(offset,count).

Infer and apply likely types at target addresses.

Query instructions with mnemonic/operand filters and scoped scans.

Convert numbers to different formats

Show the IDA databases (analyzed binaries, .i64/.idb) currently open in the IDA GUI or in headless idalib workers, with their instance ids.

List functions with optional filtering and offset/count pagination.

List globals with optional filtering and offset/count pagination.

Get functions by address or name (auto-detects)

Create a typed data symbol at an address, replacing any prior items.

Use this to harden a symbol boundary that the decompiler is currently expressing through a neighboring global plus offset. set_type alone leaves the underlying byte items unchanged; this tool deletes them first, then re-creates them at the right size with the right type, then optionally renames.

The type field is a full C declaration with a placeholder name, e.g. "ISP_SNS_STATE_S * g_pastImx290[4]" — IDA parses it via SetType.

Create unique byte signatures for addresses. Generates the shortest unique signature starting at each address by walking instructions and wildcarding operands. Useful for finding stable patterns that survive recompilation.

Create unique byte signatures for function entry points. Resolves each name/address to a function, then generates the shortest unique signature starting at the function start.

Create a byte signature for a specific address range (e.g. a selected region). Unlike make_signature, this does NOT guarantee uniqueness — it simply encodes the bytes in the range with optional operand wildcarding.

Open (load) a binary executable, shared library, firmware image, or an existing .i64/.idb IDA database in IDA Pro for reverse engineering. Runs IDA auto-analysis (functions, disassembly, cross references, strings) in a headless idalib worker, or attaches to the file already open in the IDA GUI. Call this first, then use execute_python to decompile, disassemble and query the binary. load_options apply only when a new headless worker is spawned; they do not change an already-open IDA GUI database or a reused worker.

Patch bytes at memory addresses with hex data

Patch assembly instructions at addresses

Write integer values to memory addresses

Execute Python in IDA context and return result/stdout/stderr.

Locals persistence (Jupyter-style): the locals namespace persists across calls by default, so variables, imports, and definitions from previous calls stay visible. Pass new_locals=True to reset the stored namespace and start fresh.

Note: the globals namespace (IDA modules and helpers) is always rebuilt per call; only locals persist. Jupyter-style last-expression return: if the code ends with an expression, its value is returned in "result".

Timeouts for long snippets: this tool runs with a 300s ceiling enforced by the nexus side — a snippet that blocks past it is cancelled there (the worker's main-thread pump cannot be interrupted from inside Python, so no pollable deadline helpers are provided).

Execute a Python script file in IDA context and return stdout/stderr.

Unlike py_eval, this runs the entire file with exec() using a single shared globals dict (no locals split), so top-level definitions are visible to all code in the script. Handles large scripts that would be unwieldy as inline code.

Read struct fields from memory at address; auto-detect type when possible.

Look up the IDA Pro ida-domain Python API by task or name, e.g. "decompile function", "xrefs to address", "list strings", "rename local variable", "struct type". Returns API signatures and usage examples for IDA analysis via execute_python.

Batch-rename funcs/globals/locals/stack vars with dry-run options.

Save the IDA database (.i64) to disk so renames, comments, types and patches made during reverse engineering persist.

Search local structs/unions by name pattern.

Search the rendered listing for pattern over [start, end).

Iterates idautils.Heads() in pure Python and renders each via ida_lines.generate_disassembly(). Per-head iteration is cheap and yields between heads, so the per-tool deadline (sync_wrapper) and the UI Cancel button both interrupt the walk reliably — unlike the C-level ida_search.find_text() it replaced, which on huge .text segments could run for minutes without polling user_cancelled().

Use start/end to scope the work for predictable performance on large binaries; without them the scan covers the whole image.

Health/ready probe for MCP server and current IDB state.

Set comments at addresses (both disassembly and decompiler views)

Set the type of an instruction operand. GUI 'Y' / 'O' / '#' equivalent.

Tags an operand at a specific instruction with a desired interpretation. Useful when the decompiler picks an awkward expression form (e.g., the "earlier-named-symbol + offset" form for contiguous globals).

kind values:

• "stroff": struct-offset reference. Requires struct, optional delta.

• "offset": absolute offset / pointer. Optional target_addr.

• "hex" | "dec" | "char" | "binary" | "octal": numeric format.

• "stkvar": stack-variable reference (function-local).

Apply types (function/global/local/stack)

Return stack variables for function address(es).

Get a compact overview of the binary in one call. Returns file metadata, segment layout, entry points, statistics, top 15 strings and functions ranked by xref count (functions include classification: thunk/wrapper/leaf/dispatcher/ complex), imports by category, and call graph summary. Use this as your FIRST tool call when starting analysis. Do not call list_funcs, imports, or find_regex separately for triage — this returns all of that. Use detail_level='minimal' for binaries with >10k functions.

Follow cross-references from or to an address, automatically traversing multiple hops. Use 'forward' to see where data flows TO (xrefs-from), or 'backward' to see where data flows FROM (xrefs-to). At each node in the traversal, returns the function name, instruction, and whether it's code or data. Use this when you find an interesting string, constant, or global and want to understand every code path that touches it without manually chaining xrefs_to calls. Do not use for call graph traversal — use callgraph for that. max_depth controls how many hops to follow (default 5, max 20).

Apply multiple type edits and return aggregate status.

Inspect named types (size/kind/declaration/members).

Query local types with structured filters/projection-friendly output.

Undefine item(s) at address(es), converting back to raw bytes.

Query xrefs with direction/type filters and pagination.

Return xrefs to address(es) or named symbols, capped per target with truncation flag.

Get cross-references to structure fields