IDA Pro deep analysis

When it applies

You have an in-scope binary (confirmed in scope.txt, a client-owned thick client/service, or a sample you own — see tradecraft-scope-roe) and cheap triage (reverse-eng-binary-triage) has surfaced functions worth real decompilation: auth/license logic, custom crypto or protocol parsers, a suspected vulnerable sink, or a malware sample whose capabilities you must map. Use reverse-eng-radare2 for fast CLI recon first; use reverse-eng-ghidra when there's no IDA license.

Why it works

Hex-Rays recovers near-source pseudocode, and IDA's cross-reference database ties every string, import, and data item to the code that touches it — so you navigate by who uses this instead of reading linearly. Renaming and retyping as you go compounds: each good name makes the next function cheaper to read.

Method

1. Set up the MCP bridge (agent-driven analysis). Install from GitHub — the PyPI ida-mcp package is a different project, do not install it:

   pip install git+https://github.com/mrexodia/ida-pro-mcp.git
   ida-pro-mcp --install     # installs the IDA plugin + client config
   ida-pro-mcp --config      # verify
   

   The plugin listens on 127.0.0.1:13337; tools appear under your MCP server name (e.g. idapro_*, ~65 tools depending on version). Headless (idalib supervisor) needs an idalib-licensed install; otherwise run the plugin inside the GUI — same tools either way.
2. Open the target. GUI: open the file, confirm [MCP] ... port=13337 in the output window. Headless: open the database with the bridge's idb_open (ida-pro-mcp 2.x naming — no longer idalib_*); it returns a session_id that later calls pass as database=.
3. Survey before diving. survey_binary(detail_level="minimal") → architecture, entry point, function count, strings, segments, categorized imports. Record the import table before any conclusion — crypto / network / file-IO / registry / injection categories steer everything downstream (for DLL/SYS also record the export table; an empty import table means likely dynamic loading — verify with runtime API breakpoints). Full tool inventory: cheatsheet.md.
4. Work string/import → sink. Anchor on find_regex("https?://") or entity_query(kind="imports", filter="Crypt"), jump to users with xrefs_to(addr), then read with analyze_function(addr) or decompile(addr). Map reachability with callgraph(roots, max_depth=3) and trace_data_flow(addr, direction="backward").
5. Annotate as you go — rename functions/locals, set_comments, declare_type + set_type for structs. Never convert number bases by hand: use int_convert.
6. Patch only when asked, on a copy. patch_asm / patch rewrite the database; idb_save to persist. Re-decompile the patched site to confirm the bypass before claiming it.

Gotchas

• Some MCP clients reject idb_open with Structured content does not match the tool's output schema — open the database by calling the HTTP API on 13337 directly, then use the MCP tools.
• Opening with auto-analysis looks hung — a large GUI binary can take 5+ minutes before the open call returns; poll for readiness instead of killing it.
• Stale locks after a killed open — orphaned idalib workers hold .id0/.id1/.nam; copy the sample to a temp dir and open the copy. Never taskkill /T the process tree — it kills the GUI ida.exe too.
• C:\Windows\System32 files can't be read by idalib directly — copy them out first.
• C++/STL noise — let FLIRT/Lumina signature matching collapse library functions before reading business logic.
• Packed samples — repair the IAT first (ImportREC for x86, Scylla for x64). If repair fails, switch to dynamic API tracing instead of grinding on a broken static view (reverse-eng-deobfuscation).
• "No database bound" = nothing is open yet; function name not found = search first with list_funcs + filter, names must be exact.
• Analyze untrusted binaries in an isolated VM — loading a hostile sample is itself an action.

Verify success

You can state the algorithm or check in pseudocode, name the exact functions/addresses involved, and show a confirming observation — a bypassed check on a patched copy, a recovered plaintext/key, or a crash explained — with every renamed symbol traceable back to its original address for the report.

References

ida-pro-mcp (github.com/mrexodia/ida-pro-mcp); Hex-Rays documentation; FLIRT/Lumina signatures.

---

Portions adapted from reverse-skill by zhaoxuya520, MIT License.