reverse-skills-max/vendor-new/analyst-ai-pack/skills/scripting-ida-with-idapython/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
scripting-ida-with-idapython	Automates IDA Pro analysis with IDAPython by generating scripts that enumerate functions, decode strings, rename by signature, and export analysis results, and by documenting the headless idat batch invocation. Activates for requests to script IDA Pro, write IDAPython automation, or run IDA in batch/headless mode.	cybersecurity	reverse-engineering	reverse-engineering ida-pro idapython automation batch-analysis	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1059 T1620	D3-DA D3-SDA	Hex-Rays IDAPython API documentation — https://hex-rays.com/products/ida/support/idapython_docs/ IDA batch/headless (idat -A -S) usage — https://hex-rays.com/products/ida/

Scripting IDA Pro With IDAPython

When to Use

• You use IDA Pro and want to automate repetitive analysis — enumerate functions, decode strings, apply signature-based renames, and export results — via IDAPython.
• You need a headless idat batch invocation to process many samples.

Do not use IDA's debugger (-r) on untrusted samples on your host — these scripts drive static analysis. Work in an isolated environment.

Prerequisites

• IDA Pro with IDAPython, and the samples to analyze.

Safety & Handling

• IDA static analysis does not execute the sample; keep the input directory isolated.

Workflow

Step 1: Generate an analysis script

python scripts/analyst.py script --emit functions,strings --out ida_export.py

Emits an IDAPython script using the real API (idautils.Functions, idc.get_func_name, idautils.Strings) that writes results to JSON next to the IDB.

Step 2: Generate the headless batch command

python scripts/analyst.py batch --script ida_export.py --input sample.exe

Builds the idat -A -S"script" input invocation (auto-mode, run script, no UI) for batch runs.

Step 3: Run and collect

Execute the batch command per sample and aggregate the JSON exports.

Step 4: Iterate

Extend the generated script with signature renames (FLIRT) and decompiler (ida_hexrays) output as needed.

Validation

• The generated script uses real IDAPython API calls.
• The batch command uses -A (auto) and -S (script) correctly.
• JSON output is produced per processed IDB.

Pitfalls

• IDAPython API drift between IDA 7.x and 9.x — target your version.
• Forgetting -A leaves IDA waiting for interactive input in batch.
• Decompiler calls require a licensed Hex-Rays decompiler.

References

• See references/api-reference.md for the generator.
• IDAPython and idat batch references (linked in frontmatter).