Claude Code skills for IDA

Ah :person_facepalming: of course, thanks for highlighting that @Special-K

Let me summarize what I know you can do with LLMs/Agents, broken down by IDA capability, so anyone can mix and match based on what they have available to them:

IDA with Qt GUI and IDAPython (IDA Pro)

You can use an MCP server (like mrexodia/ida-pro-mcp) to let an agent interact with the currently opened database, and if it makes changes (sets a name, comments, etc.) you’ll see them reflected in the UI.

You can also try the IDA Chat plugin by @pal_hexrays (IDA Chat plugin - AI assistant inside IDA) that gives you a chat window within IDA to ask Claude to take actions on the currently opened database, like with an MCP server. There are other alternatives, too, like Gepetto (JusticeRage/gepetto), ReCopilot (XingTuLab/recopilot), and others.

idalib

You can ask your agent to write IDAPython scripts or ida-domain scripts and invoke them via idalib. That’s the skill referenced here: analyze-with-ida-domain-api

I currently really like this strategy, because doing code generation/evaluation often reduces token usage, leading to longer sessions or lower cost. See also here: Your MCP Doesn’t Need 30 Tools: It Needs Code | Armin Ronacher's Thoughts and Writings

idat/headless IDA

You could also use the above skill analyze-with-ida-domain-api to have an AI Agent write temporary Python scripts to the temp directory and then invoke IDA headlessly to execute the script, either with idat or ida -B (batch mode), reading results from stdout or temporary output text files.

Aside, I’d encourage most users to migrate from using idat/ida- B to using idalib (probably with Python), but it’s not strictly necessary.

with and without decompilers

AI Agents, such as Claude Code, seem to do a reasonably good job of analyzing both pseudocode produced by the Hex-Rays Decompilers, but also the raw disassembly when this isn’t available. So, I believe you can still experiment with these systems without a decompiler license (though perhaps in a production setting have the decompiler might work better - I’d like to test this and/or hear about your results!).

IDA Free

As mentioned above, Hex-Rays doesn’t distribute IDAPython or idat with IDA Free. I think you could possibly use pre-compiled native plugins with IDA Free, perhaps like ida-chat-cpp (again, I haven’t tested this but it might work).


disclaimer: in this thread we’re discussing evaluating code generated by an LLM that’s working with untrusted data (possibly even malware). Please make sure you understand the threat model and risk, and sandbox the environment appropriately. We’ll share more about our experiments soon, and would love to hear what you’ve tried. sprites.dev is interesting, for example.