Run IDA Python analysis
execute_pythonRun Python (IDAPython/ida-domain) against the binary open in IDA to decompile, disassemble, inspect xrefs, manage types, rename symbols, add comments, and patch bytes.
Instructions
Run Python (IDAPython and the ida-domain API) against the binary open in IDA: decompile a function to Hex-Rays pseudocode, disassemble (disasm) instructions, enumerate functions, strings, imports, exports, symbols, segments and sections, find cross references (xrefs to/from an address, callers, callees, call graph), get the function at an address, inspect or apply types and structs, rename functions and variables, add comments, and patch bytes. Returns the result plus stdout/stderr. Look up API names with reference first.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Python code that runs against an already-open database. Call reference(query) first; do not guess the API shape. `db` is the current ida-domain Database, and `ida_domain` is also imported globally. Imports, variables, and definitions persist for this agent's database lease. A single or trailing expression is returned. For function-style code, define run(db), execute(db), or main(db); it is invoked automatically when there is no trailing expression. | |
| timeout | No | Python execution timeout in seconds. This does not include the separate initial autoanalysis wait. | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes | ||
| stderr | Yes | ||
| stdout | Yes |