This repository implements an MCP (Model Context Protocol) server that exposes IDA Pro's disassembler, decompiler, debugger, and type system as a set of tools and resources consumable by LLM clients (Claude, Codex, Cursor, etc.). It operates in two distinct modes: an IDA GUI plugin that starts an MCP server on a configurable port, and a headless supervisor (`idalib-mcp`) that manages persistent worker processes for multiple databases. The architecture is a hybrid of a plugin and a standalone server, built on a custom, vendored MCP server implementation (`zeromcp`) with HTTP/SSE/stdio transports. The core API surface is defined via a decorator-based registration system (`@tool`, `@resource`, `@unsafe`, `@ext`) in `rpc.py`, which also handles output truncation middleware and JSON schema generation from TypedDicts. All IDA SDK calls are marshalled onto the main thread through a robust execution pipeline (`sync.py`) that manages timeouts, cancellation, and batch mode. The headless mode uses a supervisor/worker pattern (`idalib_supervisor.py`, `idalib_server.py`, `worker_lifecycle.py`) with health probing, idle TTL, and session management. A comprehensive compatibility layer (`compat.py`) provides version-gated shims for IDA 8.4 through 9.3. Key features include decompilation, disassembly, cross-references, memory read/write, patching, type declaration/inference, debugger control (breakpoints, step, registers), signature generation, and binary survey. Tool calls are always-on traced into the IDB as gzipped JSONL batches. The project includes an extensive test suite with a custom test framework, MCP spec regression tests, and CI running against multiple IDA versions in Docker containers. The codebase is actively maintained and demonstrates strong engineering practices, but the plugin mode is explicitly deprecated in favor of the official Hex-Rays IDA MCP Server. The heavy reliance on IDA's internal APIs and the vendored MCP server implementation represent ongoing maintenance risks. The code is well-structured with several genuinely reusable components, though some modules (e.g., `api_analysis.py`) are monolithic.
IFL (Interactive Functions List) is an IDA Pro plugin that provides an enhanced interface for browsing, analyzing, and navigating functions within binary files. The plugin creates a dockable window displaying a comprehensive table of all functions with their attributes (addresses, names, types, arguments, reference counts) and features tabbed views showing incoming/outgoing references for selected functions. Key capabilities include real-time filtering, double-click navigation to addresses, in-place function renaming, and import/export of function names in CSV, TAG, and .imports.txt formats (compatible with tools like PE-sieve). The architecture follows a model-view pattern using Qt (PyQt5/PySide6 abstraction) integrated with IDA's plugin framework, featuring automatic theme adaptation to match IDA's UI and sophisticated reference tracking logic.
This repository provides an ARM64 tracing and emulation workflow based on the Unicorn engine, designed to work as an IDA Pro plugin and with standalone replay capabilities. The system allows users to trace ARM64 code execution within IDA, dump memory segments, generate Tenet-compatible logs for analysis, and replay traces offline. Key features include dynamic code simulation, memory dumping, register state tracking, instruction-level logging, and special handling for ARM64-specific instructions like MRS TPIDR_EL0 and AUTIASP. The architecture separates IDA integration (dyn_trace_ida.py) from core emulation logic (unicorn_trace/unicorn_class.py), enabling both interactive tracing within IDA and offline replay of captured traces.