justasmasiulis/ida_buddy

★ 23PythonAudience · developerComplexity · 4/5Setup · hard

Mindmap

mindmap
  root((IDA Buddy))
    Read Commands
      Triage summary
      Disassemble
      Decompile
      Memory dump
      Symbol search
    Write Commands
      Rename address
      Add comment
      Define type
      Patch bytes
    Integration
      AI tool friendly
      Script automation
      Persistent worker
    Output Design
      Stdout results
      Stderr banners
      Hex addresses

mindmap root((IDA Buddy)) Read Commands Triage summary Disassemble Decompile Memory dump Symbol search Write Commands Rename address Add comment Define type Patch bytes Integration AI tool friendly Script automation Persistent worker Output Design Stdout results Stderr banners Hex addresses

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Let an AI assistant disassemble and decompile functions in a compiled binary to identify security vulnerabilities without opening IDA's GUI

USE CASE 2

Automate renaming, commenting, and type definitions across an IDA Pro database using scripts

USE CASE 3

Query IDA Pro analysis results from the command line and parse stdout output in your own tooling

Tech stack

PythonIDA Proidalib

Getting it running

Difficulty · hard Time to first run · 1h+

Requires a licensed, activated copy of IDA Pro already installed on your machine, idalib activation steps vary by platform and are shown for Windows in the README.

In plain English

IDA Pro is a professional program used by security researchers and engineers to examine compiled software, meaning programs distributed as binary files with no source code attached. This project, called idb (short for IDA Buddy), adds a command-line interface on top of IDA Pro so the analysis database can be queried and modified without opening IDA's graphical interface. The main use case is automated or AI-driven analysis. When an AI assistant or script needs to inspect a compiled program step by step, it benefits from short, structured text output rather than a graphical window. idb keeps a persistent background worker open per database, so after you open a binary once you can run many follow-up queries in the same session without restarting IDA each time. From the command line you can open a compiled file and see a triage summary, disassemble a specific function to read its machine instructions, decompile it to more readable pseudocode (using IDA's Hex-Rays add-on), dump raw memory bytes, search for symbol names, and trace which parts of the program call each other. Mutation commands let you rename addresses or variables, add comments, define new data types, and patch bytes in the database. Each mutation creates an undo point so changes can be rolled back. Output goes to stdout, banners, errors, and truncation notices go to stderr. That separation keeps the two streams clean for scripts that parse the results. Addresses default to hexadecimal in WinDbg style, with a prefix for decimal input when needed. Installing requires IDA Pro to be already installed and activated on the machine. Setup involves activating idalib, IDA's Python library interface, then installing idb via pip. The README shows the exact Windows commands. A built-in doctor command verifies the environment is ready.

Copy-paste prompts

Prompt 1

I want to use ida_buddy to let an AI analyze a compiled Windows binary. Walk me through activating idalib, installing idb via pip, and running a triage summary on a .exe file.

Prompt 2

Show me how to use idb to disassemble a function at a specific hex address, decompile it to pseudocode with Hex-Rays, then add a comment to that address in the database.

Prompt 3

I want to trace all callers of a suspicious function in a binary using ida_buddy. What command do I run and how do I parse the call graph output in a Python script?

Prompt 4

I am getting errors from the idb doctor command. Walk me through what each check validates and what I need to fix to get my IDA Pro environment ready for ida_buddy.

Open on GitHub → Explain another repo

← justasmasiulis on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.