# Rev Idapython

IDAPython and IDALib script reference for reverse engineering.

- Repository: https://github.com/P4nda0s/reverse-skills (2339 stars)
- Category: Testing
- License: see repository
- Last updated: 2026-05-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add P4nda0s/reverse-skills --skill rev-idapython -g -a claude-code -y`
Codex: `npx skills add P4nda0s/reverse-skills --skill rev-idapython -g -a codex -y`
Cursor: `npx skills add P4nda0s/reverse-skills --skill rev-idapython -g -a cursor -y`
Gemini CLI: `npx skills add P4nda0s/reverse-skills --skill rev-idapython -g -a gemini-cli -y`

## Description

IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompiler API, handle obfuscation, or batch-process binaries.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# rev-idapython - IDAPython / IDALib Script Reference

IDAPython script snippets for IDA interactive use and IDALib headless analysis. Use as reference when generating IDAPython code.

- **IDAPython**: scripts run inside IDA GUI (Script Command, plugin, or IDC console)
- **IDALib**: headless mode introduced in IDA 9.0, run analysis scripts without opening the IDA GUI

---

## Common API

### Register Operations

```python
idc.get_reg_value('rax')
idaapi.set_reg_val("rax", 1234)
```

### Debug Memory Operations

```python
idc.read_dbg_byte(addr)
idc.read_dbg_memory(addr, size)
idc.read_dbg_dword(addr)
idc.read_dbg_qword(addr)
idc.patch_dbg_byte(addr, val)
idc.add_bpt(0x409437)          # add breakpoint
idaapi.get_imagebase()         # get image base address
```

### Local Memory Operations (modifies IDB database)

```python
idc.get_qword(addr)
idc.patch_qword(addr, val)
idc.patch_dword(addr, val)
idc.patch_word(addr, val)
idc.patch_byte(addr, val)
idc.get_db_byte(addr)
idc.get_bytes(addr, size)
idaapi.get_dword(addr)
idc.get_strlit_contents          # read string literal
```

### Disassembly

```python
GetDisasm(addr)                  # get disassembly text
idc.next_head(ea)                # get next instruction address
idc.create_insn(addr)            # c, Make Code
ida_bytes.create_strlit          # create string, same as 'A' key
ida_funcs.add_func(addr)         # p, create function
idc.del_items(addr)              # U, undefine
```

### Address Conversion

```python
idc.get_name_ea(0, '_sub_6051')  # get address by function name
```

### Function Operations

```python
ida_funcs.get_func(ea)           # get function descriptor

# enumerate all functions
for func in idautils.Functions():
    print("0x%x, %s" % (func, idc.get_func_name(func)))
```

---

## Code Snippets

### Byte Pattern Search

```python
import ida_bytes
import ida_idaapi
import ida_funcs
import idc

The rest: https://github.com/P4nda0s/reverse-skills/blob/HEAD/skills/rev-idapython/SKILL.md