idamesh

Return a bounded linear disassembly starting at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved to the first instruction listed. ``count`` bounds how many instructions are rendered and is clamped to a server maximum. Each row carries its ``addr``, the opcode ``bytes`` as a hex string, and the rendered instruction ``text``. The result reports how many instructions were ``returned`` and a ``truncated`` flag. An out-of-range or unresolvable address yields an error result rather tha…

Search the database's named entities — functions, named globals, and imported symbols — as one filtered stream. ``query`` matches a case-insensitive substring of each entity's name (empty matches all). ``kind`` restricts the search to one entity kind (``"function"`` / ``"global"`` / ``"import"``) or spans all three when ``"any"``. ``limit`` caps how many matches are returned (clamped to a server maximum). Each match carries its ``name``, entry/slot ``address`` (``0x``-hex), the ``kind`` it came from, and the kind-specific extras — ``size`` for functions and globals, ``module`` and ``ordinal`` …

Create or update an enumeration type without destroying its existing members. ``name`` is the enum type name; ``members`` is an object mapping each member name to its integer value. The enum is created when missing; each supplied member is added when absent or updated when its value changed, while members already present and not listed are preserved. The result reports the enum ``name``, ``ok``, and its ``member_count`` afterward. This modifies the database. An invalid name, an empty or malformed member map, or a member the database refuses yields an error result rather than failing the protoc…

Execute an IDAPython script against the current database and return what it produced. ``code`` is Python source run on the database-owning thread with the IDA SDK in scope (``idaapi`` / ``idc`` / ``idautils`` and the ``ida_*`` modules pre-imported), so it may both read and mutate the database — use it for bulk work the structured tools do not cover (e.g. rename every function matching a pattern in one pass). Whatever the script ``print``s is returned as ``stdout``; if it binds a top-level ``result`` variable, its ``repr`` is returned as ``result``. A syntax error or an exception raised by the …

Export this database's user annotations as a portable record. Returns the user names, line/function comments, and (when ``include_types``) prototypes the user set, each keyed by effective address, plus a ``provenance`` block (input path, SHA-256, imagebase, IDA version) that identifies the binary. ``funcs`` optionally restricts the export to the given functions — each a hex literal (``0x…``), decimal literal (bare digits are decimal; hex needs ``0x``), or symbol name — resolved first; omit it to export the whole database. This is the source half of the merge-back and is read-only. An unresolva…

Export the database's functions as a compact bulk list suitable for feeding into other tools. ``offset`` skips that many functions from the start; ``count`` caps how many are returned (clamped to a server maximum). Each row carries just the function ``name`` and its entry ``address`` (``0x`` hex). The result carries the ``total`` function count and a ``truncated`` flag; while ``truncated`` is true, request the next page with ``offset`` advanced by the rows returned. ``count`` echoes the (clamped) requested page size and ``next_cursor`` is currently always null: page by ``offset``. Read-only.

Search the loaded image for a byte ``pattern`` and return the addresses where it matches. ``pattern`` is an IDA-style hexadecimal byte pattern that may contain wildcards — for example ``"48 8B ?? 05"``, where ``??`` (or ``?``) matches any byte. ``limit`` caps how many matches are returned (clamped to a server maximum). The result echoes the ``pattern`` and lists each match's ``address`` as ``0x`` hex, with ``truncated`` set when the cap elided further matches. An unparseable pattern yields an error result rather than failing the protocol request.

Identify cryptography in the loaded image by its constant signatures. Scans for the magic constants that reference implementations embed — the AES S-box and inverse S-box, the MD5 / SHA-1 / SHA-256 initialization vectors, the reversed CRC-32 polynomial, the Base64 alphabets, and the like — and reports each hit's ``address`` (``0x`` hex), the ``algorithm`` the constant belongs to, and a ``constant`` label naming which constant matched. ``limit`` caps how many matches are returned across the whole signature table (clamped to a server maximum); ``truncated`` is set when the cap elided further ma…

List the dangerous imported APIs the image calls and where it calls them. Matches the module's imports against a classification of historically dangerous C-runtime and OS functions — the unbounded string copies (``strcpy`` / ``strcat`` / ``gets`` / ``sprintf`` …), the raw memory moves, the format-string sinks (``printf`` family), the input parsers (``scanf`` family), and the command launchers (``system`` / ``exec*`` / ``popen`` …) — and, for each one imported, collects every call site: its ``address`` (``0x`` hex) and the enclosing ``function`` name. Results are grouped under each ``api``; ``…

Search the strings IDA extracted from the binary for those whose value matches a Python regular expression. ``pattern`` is applied with ``re.search`` against each string's decoded value. ``limit`` caps how many matches are returned (clamped to a server maximum). The result echoes the ``pattern`` and lists each match's ``address`` (``0x`` hex) and matching ``value``, with ``truncated`` set when the cap elided further matches. An invalid regular expression yields an error result rather than failing the protocol request.

Invalidate the decompiler cache for the function at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first and mapped to its enclosing function. The stale cached pseudocode is dropped so the next ``decompile`` regenerates fresh output after type, rename, operand, or data edits. The result reports the resolved ``address`` (``0x`` hex) and ``ok``. An address in no function, an unavailable decompiler, or an unresolvable address yields an error result rather than failing the protocol…

Return a compact summary of the function at or containing ``address``, without decompiling it. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved and mapped to its owning function first. The summary reports the function's ``address`` and ``name``, its byte ``size``, its control-flow ``block_count`` and ``edge_count``, and its call degree — ``caller_count`` functions reach it and ``callee_count`` functions it calls. An out-of-range, unresolvable, or out-of-function address yields an error result…

Filter the database's functions by a conjunction of predicates. ``name`` matches a case-insensitive substring of the function name (empty matches all). ``min_size`` and ``max_size`` bound the function's byte size inclusively; a ``max_size`` of ``0`` leaves the upper end unbounded. ``is_library`` and ``is_thunk`` are tri-state — omit (null) to ignore the flag, or pass ``true`` / ``false`` to require it. ``limit`` caps how many matches are returned (clamped to a server maximum). Each match carries the function ``name``, entry ``address`` (``0x``-hex), byte ``size``, and its ``is_library`` / ``is…

Read ``size`` raw bytes starting at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved to the start of the region first. The result echoes the resolved ``address`` (``0x`` hex) and ``size``, and returns the ``bytes`` as a lowercase hex string. An out-of-range or unresolvable address, or an unreadable region, yields an error result rather than failing the protocol request.

Read the value of a named global as an integer. ``name`` may be a symbol name or an address (hexadecimal, or decimal: bare digits are decimal, hex needs ``0x``); it is resolved to the global first. ``size`` bytes are read and decoded under the database's byte order and, when ``signed`` is true, as a two's-complement value — exactly as ``get_int`` does. The result echoes the resolved ``name`` and ``address`` (``0x`` hex), the ``size`` and ``signed`` interpretation, the decoded ``value``, and its ``hex`` rendering. An unresolvable name or unreadable region yields an error result rather than fail…

Read an integer of ``size`` bytes at ``address`` and decode it. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. The bytes are interpreted under the database's byte order and, when ``signed`` is true, as a two's-complement value. The result reports the resolved ``address`` (``0x`` hex), the ``size`` and ``signed`` interpretation, the decoded ``value``, and the ``hex`` rendering of the bytes read. An out-of-range or unresolvable address, or a short read, yields an error result rather th…

Describe the loaded database: input file identity, processor and bitness, byte order, entry point and image base, and coarse counts of functions and segments. ``string_count`` is currently always null (the string list is built on demand; use ``list_strings`` for strings). Call this first to orient on an unfamiliar target before enumerating or decompiling anything.

Read a string starting at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. At most ``max_length`` bytes are scanned, auto-detecting the terminator and encoding. The result reports the resolved ``address`` (``0x`` hex), the decoded ``value``, and its ``length`` in characters (not bytes: it can be smaller than the byte count for multi-byte text). An out-of-range or unresolvable address, or the absence of a string, yields an error result rather than failing the protocol reque…

Save a compressed ``.i64`` snapshot of this database to ``path``. Writes a compressed copy to the given destination without disturbing the live database or its loose working files, so a session stays open and editable after the snapshot. The result reports the destination ``path``, ``ok``, and the written file ``size`` in bytes. This writes a file (but does not modify the open database). A destination that cannot be written, or a save the database refuses, yields an error result rather than failing the protocol request.

List the module's imported symbols as a bounded page grouped by their originating library. ``offset`` skips that many imports from the start; ``count`` caps how many are returned (clamped to a server maximum). Each row carries the symbol name, its import-table address, the module it is drawn from, and its ordinal when the platform links by ordinal. The result carries the total count and a ``truncated`` flag so a caller can page through the whole table.

Filter the module's imported symbols. ``name`` matches a case-insensitive substring of the imported symbol name and ``module`` a case-insensitive substring of the originating library; either empty leaves that axis unfiltered, and the two combine as a conjunction. ``limit`` caps how many matches are returned (clamped to a server maximum). Each match carries the symbol ``name``, its import-table ``address`` (``0x``-hex), the ``module`` it is drawn from, and its ``ordinal`` when the platform links by ordinal; ``truncated`` is set when the cap elided further matches. Read-only.

Filter the decoded instructions of the function at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved to the containing function, which is decoded and scanned. ``mnemonic`` requires an exact (case-insensitive) mnemonic when non-empty. ``operand_kind`` requires the instruction to carry at least one operand of that kind (``"reg"`` / ``"imm"`` / ``"mem"`` / ``"phrase"``); ``"any"`` does not filter. ``operand_reg`` requires the instruction to reference that register in some operand, ma…

Reinterpret an integer ``value`` across every representation at a given bit width. ``value`` may be written in hexadecimal (``0x…``), binary (``0b…``), octal (``0o…``), plain decimal, or as a quoted character literal (``'A'``), with an optional leading sign. ``bits`` sets the width the unsigned and two's-complement ``signed`` views are computed at. The result reports the ``decimal`` value, its ``unsigned`` and ``signed`` interpretations, its ``hex`` / ``binary`` / ``octal`` renderings, and the ASCII ``char`` when the value is printable. This tool reads no database. An unparseable value or an o…

List the database's functions in address order as a bounded page. ``offset`` skips that many functions from the start; ``count`` caps how many are returned (clamped to a server maximum). The result carries the total function count and a ``truncated`` flag so a caller can page through the whole set.

List the database's named global (data) symbols in address order as a bounded page. ``offset`` skips that many globals from the start; ``count`` caps how many are returned (clamped to a server maximum). Each row carries the symbol name, its address, item size in bytes, and its declared type when known. The result carries the total count and a ``truncated`` flag so a caller can page through the whole set.

List the strings IDA extracted from the binary as a bounded page in address order. ``offset`` skips that many strings from the start; ``count`` caps how many are returned (clamped to a server maximum). Each row carries the string's ``address`` (``0x`` hex), its byte ``length``, its encoding ``type`` (for example a C/ASCII or a Unicode string), and its decoded ``value``. The result carries the total count and a ``truncated`` flag so a caller can page through the whole set.

Find functions whose name contains ``query`` (case-insensitive). ``limit`` caps how many matches are returned (clamped to a server maximum). The result echoes the ``query`` and lists each match's function ``name`` and entry ``address`` (``0x`` hex), with ``truncated`` set when the cap elided further matches. Read-only.

Define a data item at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. Supply a C ``type`` declaration (e.g. ``"int"`` or ``"char[16]"``) to define a typed item sized to that type; otherwise supply a ``size`` in bytes (1/2/4/8 → byte/word/dword/qword) to define a primitive item. At least one of ``type`` or ``size`` must be given. The result reports the resolved ``address`` (``0x`` hex), the ``type`` in force afterward, the item ``size`` in bytes, and ``ok``. This modifies …

Overwrite the raw bytes at ``address`` with ``bytes``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. ``bytes`` is the replacement data as a hexadecimal string, with whitespace between octets tolerated (``"90 90"`` and ``"9090"`` are equivalent). The result reports the resolved ``address`` (``0x`` hex), the ``size`` in bytes written, and ``ok`` (always true: failures are error results). This modifies the database. An empty or malformed hex payload, or an unresolvable/unwritable addre…

Assemble the single instruction ``assembly`` and patch it at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. ``assembly`` is one line in the database architecture's syntax (e.g. ``"jmp 0x401000"`` or ``"nop"``), encoded by IDA's native assembler as if placed at the resolved address and written there. The result reports the resolved ``address`` (``0x`` hex), the encoded ``bytes`` as a lowercase hex string, the ``size`` written, and ``ok`` (always true: failures are error r…

Interpret the memory at ``address`` as the aggregate type named ``struct``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal, or a symbol name; it is resolved first (bare digits are decimal; hex needs 0x). The struct's field layout drives the decode: primitive fields (1/2/4/8-byte int, char, or pointer) are rendered as an integer/hex ``value`` under the database's byte order, while larger, aggregate, array, or floating-point fields are rendered as a raw hex-bytes ``value``. The result reports the ``struct`` name, the resolved ``address`` (``0x`` hex), the aggregate ``s…

Set the user name of the item at ``address`` to ``name``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first, and may point at a function or a data item. The result reports the resolved ``address`` (``0x`` hex), the ``old_name`` that was in force beforehand, the new ``name``, and ``ok``. This modifies the database. An empty or invalid identifier, a name that clashes with an existing symbol, or an unresolvable address yields an error result rather than failing the protocol request.

Search the database's aggregate (struct and union) types for those whose name contains ``query`` (case-insensitive); an empty ``query`` lists every struct/union. ``limit`` caps how many matches are returned (clamped to a server maximum). The result echoes the ``query`` and lists each match's ``name``, total byte ``size``, and ``member_count``, with ``truncated`` set when the cap elided further matches. Field-level layout is available through ``read_struct`` and ``type_inspect``. Read-only.

Search the rendered disassembly listing for a substring. Each defined item's line is rendered to plain text (control tags stripped) and tested for a case-insensitive match against ``text``. ``limit`` caps how many matches are returned (clamped to a server maximum). The result echoes the query ``text`` and lists each match's ``address`` (``0x`` hex) and the matching ``line``, with ``truncated`` set when the cap elided further matches. Read-only.

Report server liveness and whether a database is currently bound and ready to serve reads, along with the server version and the MCP protocol revisions this endpoint can negotiate. ``uptime_s`` is the seconds since this server started. Safe to poll at any time.

Attach ``comment`` at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. By default the text is written as the item comment at that address; set ``function`` to route it to the enclosing function's comment instead, and set ``repeatable`` to use the repeatable slot (echoed at every cross-reference) rather than the anchored one. An empty ``comment`` clears the chosen slot. The result reports the resolved ``address`` (``0x`` hex), the ``comment`` written, and ``ok``. This modif…

Set the display representation of an instruction operand. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first and should point at an instruction. ``operand`` is the zero-based operand index. ``type`` names the representation to apply — a numeric base (``"hex"``, ``"dec"``, ``"oct"``, ``"bin"``, ``"char"``) or ``"offset"``. The result reports the resolved ``address`` (``0x`` hex), the ``operand`` index, the ``type`` in force afterward, and ``ok``. This modifies the database. An out-of-range…

Apply the C declaration ``type`` to the function or data item at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. ``type`` is a C declaration or function prototype (e.g. ``int f(char *)`` or ``unsigned int``) parsed against the local type library and applied at the address. The result reports the resolved ``address`` (``0x`` hex), the item ``name`` after the change, the ``type`` applied, and ``ok``. This modifies the database. An unparseable declaration, a type that cannot…

Return a one-call triage overview of the whole database, so an agent need not fan out to ``list_funcs`` / ``imports`` / ``list_strings`` separately to orient. The overview bundles the database ``metadata``, coarse ``counts`` (functions, imports, strings, segments), the ``entrypoints``, a ``roles`` histogram over an authored function-role taxonomy (``thunk`` / ``library`` / ``small-leaf`` / ``small`` / ``leaf`` / ``hub`` / ``dispatcher`` / ``large`` / ``ordinary``; ``minimal`` reports a tiny body as ``small`` since it skips the callee scan), a ``notable_imports`` shortlist tagged by category (`…

Trace the value at an instruction operand through one function, bounded. Follows the register or stack slot named by ``operand`` at ``address`` (hex/decimal/symbol; bare digits are decimal, hex needs ``0x``) through the containing function's decoded instructions: ``forward`` reports its subsequent uses, ``mov`` propagations, in-place transforms, and the redefinition that kills it; ``backward`` reports the writes that defined it, hopping to a source location on a copy. Each step carries its ``address`` (``0x`` hex), the ``insn`` text, a ``note`` naming the rule (``use`` / ``propagate`` / ``tra…

Find intra-procedural taint paths from input sources to dangerous sinks. Marks the return value of each input-producing call (``recv`` / ``read`` / ``fgets`` / ``ReadFile`` …) as tainted, propagates it forward through the function's decoded instructions, and reports each later dangerous-API call (``strcpy`` / ``system`` / ``memcpy`` …) whose tainted data reaches an argument. Each path carries the ``source`` and ``sink`` addresses (``0x`` hex), the sink ``api`` name, and the connecting ``steps``. Pass an ``address`` (hex/decimal/symbol; bare digits are decimal, hex needs ``0x``) to scope the s…

Inspect the definition of the type named ``name`` from the database's local type catalog. The result reports the type's ``name``, its coarse ``kind`` (e.g. struct / union / enum / typedef / pointer), its byte ``size``, and its ``members`` — one row per field with the member ``name``, rendered ``type``, byte ``offset`` from the start of the aggregate, and member ``size``. ``members`` is empty for non-aggregate types. An unknown type name yields an error result rather than failing the protocol request. Read-only.

Search the database's local type catalog for named types whose name contains ``query`` (case-insensitive); an empty ``query`` lists every named type. ``limit`` caps how many matches are returned (clamped to a server maximum). The result echoes the ``query`` and lists each match's ``name``, its coarse ``kind`` (e.g. struct / union / enum / typedef / pointer), and its byte ``size``, with ``truncated`` set when the cap elided further matches. Member detail is available through ``type_inspect``. Read-only.

Undefine the item at ``address``, reverting it to raw bytes. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved first. The function, code, or data definition covering the address is discarded. The result reports the resolved ``address`` (``0x`` hex) and ``ok``. This modifies the database and destroys the existing definition at the address. An address with nothing to undefine, or an unresolvable address, yields an error result rather than failing the protocol request.

Query the cross-references around ``address`` with kind/type filters. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved to a concrete anchor first. ``direction`` is ``"to"`` (edges pointing at the anchor) or ``"from"`` (the call edges leaving the function that owns it). ``kind`` filters on ``"code"`` / ``"data"`` and ``type`` on ``"call"`` / ``"jump"`` / ``"read"`` / ``"write"`` / ``"offset"`` / ``"ordinary"``; ``"any"`` leaves that axis unfiltered. ``limit`` caps how many edges are returned (…

List the cross-references that point at ``address``. The ``address`` may be a hexadecimal literal (``0x…``), a decimal literal (bare digits are decimal; hex needs ``0x``), or a symbol name; it is resolved to a concrete target first. Each edge carries the referring ``from`` address, the enclosing ``func`` name when the source is inside a function, the ``kind`` (``code``/``data``), and the finer ``type`` (``call``/``jump``/``read``/``write``/…). An out-of-range or unresolvable address yields an error result rather than failing the protocol request.