Open (load) a binary executable, shared library, firmware image, or an existing .i64/.idb IDA database in IDA Pro for reverse engineering. Runs IDA auto-analysis (functions, disassembly, cross references, strings) in a headless idalib worker, or attaches to the file already open in the IDA GUI. Call this first, then use execute_python to decompile, disassemble and query the binary. load_options apply only when a new headless worker is spawned; they do not change an already-open IDA GUI database or a reused worker.

Run Python (IDAPython and the ida-domain API) against the binary open in IDA: decompile a function to Hex-Rays pseudocode, disassemble (disasm) instructions, enumerate functions, strings, imports, exports, symbols, segments and sections, find cross references (xrefs to/from an address, callers, callees, call graph), get the function at an address, inspect or apply types and structs, rename functions and variables, add comments, and patch bytes. Returns the result plus stdout/stderr. Look up API names with reference first.

Look up the IDA Pro ida-domain Python API by task or name, e.g. "decompile function", "xrefs to address", "list strings", "rename local variable", "struct type". Returns API signatures and usage examples for IDA analysis via execute_python.

Show the IDA databases (analyzed binaries, .i64/.idb) currently open in the IDA GUI or in headless idalib workers, with their instance ids.

Save the IDA database (.i64) to disk so renames, comments, types and patches made during reverse engineering persist.

Release this session's lease on an IDA database (.i64/.idb) without disrupting other clients. If this is the final lease on a managed idalib worker, orphaned IDA Python execution is cancelled and this call waits for the IDB to shut down. Databases open in the IDA GUI stay open.

Health/ready probe for MCP server and current IDB state.

Get functions by address or name (auto-detects)

Convert numbers to different formats

List functions with optional filtering and offset/count pagination.

Query functions with richer filtering than list_funcs.

List globals with optional filtering and offset/count pagination.

Query IDB entities with typed filters, projection, and pagination.

List imports with module names using offset/count pagination.

Query imports with richer filtering than imports(offset,count).

Save active IDB to disk, optionally to a provided path.

The open database is backed by loose working files (.id0/.id1/.id2/.nam/.til) that IDA actively manages, headless included. Killing them out from under the open database corrupts it (issues #446, #498), so DBFL_KILL is never used here: an in-place save uses IDA's native save (Ctrl+W), and an explicit different destination gets a compressed copy while the working files stay.

Search strings by case-insensitive regex with offset/limit pagination.

Search the rendered listing for pattern over [start, end).

Iterates idautils.Heads() in pure Python and renders each via ida_lines.generate_disassembly(). Per-head iteration is cheap and yields between heads, so the per-tool deadline (sync_wrapper) and the UI Cancel button both interrupt the walk reliably — unlike the C-level ida_search.find_text() it replaced, which on huge .text segments could run for minutes without polling user_cancelled().

Use start/end to scope the work for predictable performance on large binaries; without them the scan covers the whole image.

Read bytes from memory addresses

Read integer values from memory addresses

Read strings from memory addresses

Read global variable values by address or symbol name.

Patch bytes at memory addresses with hex data

Write integer values to memory addresses

Decompile function(s) at address(es); returns pseudocode and per-item errors.

Disassemble function with offset/max_instructions pagination and optional total count.

Profile functions with summary metrics and optional sampled details.

Run comprehensive analysis over one or more target functions.

Return xrefs to address(es) or named symbols, capped per target with truncation flag.

Query xrefs with direction/type filters and pagination.

Get cross-references to structure fields

Return unique callees per function, capped by limit.

Search byte patterns (supports ??) with offset/limit pagination.

Return function CFG blocks with offset/max_blocks pagination.

Search strings/immediates/refs for targets with offset/limit pagination.

Query instructions with mnemonic/operand filters and scoped scans.

Export function data for addresses in json/c_header/prototypes formats.

Build bounded callgraph from roots with depth/node/edge limits.

Declare C type definitions in local type library.

Create or extend local enums in an idempotent way.

Read struct fields from memory at address; auto-detect type when possible.

Search local structs/unions by name pattern.

Query local types with structured filters/projection-friendly output.

Inspect named types (size/kind/declaration/members).

Apply types (function/global/local/stack)

Apply multiple type edits and return aggregate status.

Infer and apply likely types at target addresses.

Return stack variables for function address(es).

Create stack variables from typed stack declarations.

Delete stack variables by name or offset.

Add or replace the IDA bookmark at an address. Set prefix="" for no prefix.

Set comments at addresses (both disassembly and decompiler views)

Append comments at addresses, deduping exact text by default.

Patch assembly instructions at addresses

Batch-rename funcs/globals/locals/stack vars with dry-run options.

Define functions; IDA infers bounds unless end is provided.

Convert bytes to code instruction(s) at address(es).

Undefine item(s) at address(es), converting back to raw bytes.

Invalidate the Hex-Rays decompile cache for one or more functions.

Use after set_type, rename (especially of locals), set_op_type, or make_data so the next decompile call regenerates fresh pseudocode instead of returning a cached, stale view.

Set the type of an instruction operand. GUI 'Y' / 'O' / '#' equivalent.

Tags an operand at a specific instruction with a desired interpretation. Useful when the decompiler picks an awkward expression form (e.g., the "earlier-named-symbol + offset" form for contiguous globals).

kind values:

• "stroff": struct-offset reference. Requires struct, optional delta.

• "offset": absolute offset / pointer. Optional target_addr.

• "hex" | "dec" | "char" | "binary" | "octal": numeric format.

• "stkvar": stack-variable reference (function-local).

Create a typed data symbol at an address, replacing any prior items.

Use this to harden a symbol boundary that the decompiler is currently expressing through a neighboring global plus offset. set_type alone leaves the underlying byte items unchanged; this tool deletes them first, then re-creates them at the right size with the right type, then optionally renames.

The type field is a full C declaration with a placeholder name, e.g. "ISP_SNS_STATE_S * g_pastImx290[4]" — IDA parses it via SetType.

Execute Python in IDA context and return result/stdout/stderr.

Locals persistence (Jupyter-style): the locals namespace persists across calls by default, so variables, imports, and definitions from previous calls stay visible. Pass new_locals=True to reset the stored namespace and start fresh.

Note: the globals namespace (IDA modules and helpers) is always rebuilt per call; only locals persist. Jupyter-style last-expression return: if the code ends with an expression, its value is returned in "result".

Timeouts for long snippets: this tool runs with a 300s ceiling, and the helpers mcp_time_left() / mcp_deadline_exceeded() are injected into the snippet namespace. Poll them inside long loops so the main thread bails out cleanly instead of freezing every other MCP call (including server_health) behind a non-polling C++ call.

Execute a Python script file in IDA context and return stdout/stderr.

Unlike py_eval, this runs the entire file with exec() using a single shared globals dict (no locals split), so top-level definitions are visible to all code in the script. Handles large scripts that would be unwieldy as inline code.

Get a compact overview of the binary in one call. Returns file metadata, segment layout, entry points, statistics, top 15 strings and functions ranked by xref count (functions include classification: thunk/wrapper/leaf/dispatcher/ complex), imports by category, and call graph summary. Use this as your FIRST tool call when starting analysis. Do not call list_funcs, imports, or find_regex separately for triage — this returns all of that. Use detail_level='minimal' for binaries with >10k functions.

Compact single-function analysis: pseudocode, strings, constants, callers, callees, xrefs, blocks.

Analyze related functions as a group: per-function summaries, internal call graph, shared data.

Rename a function, set its type, or add a comment, and immediately see the before/after decompilation side by side. Use this instead of calling rename then decompile separately when you want to verify that a rename or type change actually improved readability. Actions: 'rename_func' (action_args: {name: str}), 'set_type' (action_args: {type: str}), 'set_comment' (action_args: {comment: str}). Returns {before, after, action_applied, changes_detected}. Especially useful during batch renaming to confirm each change had the intended effect.

Follow cross-references from or to an address, automatically traversing multiple hops. Use 'forward' to see where data flows TO (xrefs-from), or 'backward' to see where data flows FROM (xrefs-to). At each node in the traversal, returns the function name, instruction, and whether it's code or data. Use this when you find an interesting string, constant, or global and want to understand every code path that touches it without manually chaining xrefs_to calls. Do not use for call graph traversal — use callgraph for that. max_depth controls how many hops to follow (default 5, max 20).

Create unique byte signatures for addresses. Generates the shortest unique signature starting at each address by walking instructions and wildcarding operands. Useful for finding stable patterns that survive recompilation.

Create unique byte signatures for function entry points. Resolves each name/address to a function, then generates the shortest unique signature starting at the function start.

Create a byte signature for a specific address range (e.g. a selected region). Unlike make_signature, this does NOT guarantee uniqueness — it simply encodes the bytes in the range with optional operand wildcarding.

Find signatures for code locations that reference an address. For each input address, finds all code cross-references TO it, generates a unique signature at each xref site, and returns the shortest ones. Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly.

自动识别常见算法（md5/sha/aes/des/rc4/tea/xor/base64/crc32/zlib 等），返回算法类型和置信度。

检测常见混淆模式：控制流平坦化、字符串加密、反调试、死代码，返回各标志与详情。

自动定位可 patch 位置（条件跳转、call、反调试 int 0x2d 等）。

从反编译伪代码中启发式提取 flag/校验约束线索（长度比较、常量 == 等）。

动态字符串解密映射（静态字符串 + 运行期记录的动态字符串）。

自动生成结构化分析报告（函数/全局/字符串/入口点全量清单）。

一键生成结构化 markdown 报告，帮助快速理解程序核心逻辑（全量函数扫描）。