$ show williballenthin/idawilli
A comprehensive, actively maintained collection of IDA Pro plugins, scripts, and tooling authored by Willi Ballenthin (Hex-Rays). The repository spans multiple domains: UI enhancement plugins (oplog, bookmark_hints, colorize_calls, navband_visited, tag_func, hint_calls), analysis utilities (flirt-data-pack, vtloader, global_struct_dissector), a CLI binary inspector (idals), and a modern LLM-integrated reverse engineering agent (ida-codemode) consisting of a sandbox, portable API, AI agent, and evaluation framework. The core idawilli package provides reusable syntax and lexing utilities for IDA's tagged-line output. The codebase is well-engineered with modern Python practices: Pydantic models, type hints, uv workspace management, Rich CLI interfaces, and comprehensive pytest suites. While primarily an application for IDA Pro enhancement, it also includes data/research elements in the form of LLM benchmarking evaluations (c2_extraction) and systematic test data. The sandbox isolation pattern, evaluator framework, and tagged-line parsing utilities are especially clean and potentially reusable outside this repository.
The LLM identified 5 files worth highlighting for reuse:
Implements a secure Python sandbox using the `pydantic-monty` library to execute untrusted IDAPython scripts with configurable resource limits (timeout, recursion, virtual memory). Returns a structured `SandboxResult` (ok, stdout, stderr, error) and normalizes runtime, syntax, and typing errors into typed `SandboxError` objects. The error augmentation logic that provides API call hints from error messages is a non-obvious pattern. The sandbox is tightly coupled to IDA Pro but the isolation and error normalization pattern is reusable for any host application requiring safe script evaluation.
Provides well-typed classes and functions for parsing IDA's color-tagged string output (e.g., `syntax.highlighted()` and `syntax.plain_text()`). Uses regex and abstract syntax trees to convert IDA's internal tagged representation to ANSI escape sequences or plain text. This is a self-contained, thoroughly documented utility that any IDAPython script or external tool consuming IDA output can reuse. Demonstrates careful separation of parsing, rendering, and color mapping.
Defines the portable API contract between the IDA sandbox and the LLM agent: a `TypedDict` map (`ApiFunctions`) of function names to callable wrappers, `SuccessPayload | ApiError` return types using `TypedDict` discriminated unions, and helper functions like `expect_ok`. This pattern establishes a type-safe, verifiable API boundary that can be used to create sandboxed interfaces in any context where you need to expose a subset of host functions.
Provides an `Evaluator` base class with `evaluate` and `compare` methods that compare expected vs actual JSON outputs using Pydantic models. Includes specific evaluators for C2 extraction and SHA256 extraction tasks. The pattern of loading YAML task definitions, running agents, and comparing structured results is cleanly decoupled from the agent implementation and could be reused for any LLM benchmarking pipeline.
Defines Pydantic models for all IDB change events (segment, dirtree, function, type, etc.) as Union discriminators in an `EventList`. The models capture the full event context (address, name, old/new values) in a type-safe, JSON-serializable format. This pattern is a clean way to persist and analyze IDA analysis history and could be adapted for logging any structured event stream.