# rev-idapython

A snippet reference for IDAPython and IDALib: scripts inside IDA and headless analysis for reverse engineering.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1900 installs · ★ 2314
- Author: P4nda0s
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-idapython/SKILL.md
- Updated: 2026-05-06
- HTML: https://affpapa.org/en/nevibecode/skills/rev-idapython

## What it does

The skill feeds your agent ready IDAPython snippets. Register reads and writes, debug memory patching, local memory calls that modify the IDB, disassembly helpers, function and basic block traversal, byte pattern search, cross-reference lookups.

Debugging gets its own section. Appcall examples show how to invoke functions in the debuggee, there are helpers for C and C++ strings, a walker for GNU `std::map`, XMM register reads, and a step-over loop that waits for the next debug event. For headless work the skill covers IDALib, the mode added in IDA 9.0 that runs analysis without the GUI. Handy when you have a pile of binaries and no wish to open each one.

This is a reference, not a runner. It does not analyse anything on its own; it shows the agent what correct code looks like, and the agent writes your script. So test the output against your IDA build — several calls depend on specific modules such as `ida_bytes`, `ida_funcs` and `ida_idd`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-idapython -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rev-idapython/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rev-idapython/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-idapython -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rev-idapython/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-idapython -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rev-idapython/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install P4nda0s/reverse-skills rev-idapython
```

2. **Manually: put the files in place**
- File: `.github/skills/rev-idapython/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-idapython -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/P4nda0s/reverse-skills --path skills/rev-idapython
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rev-idapython/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-idapython -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-idapython/SKILL.md

## When to use it
- write an IDAPython script that walks functions and basic blocks
- read a C or C++ string out of a debuggee's memory
- find a byte pattern with a wildcard such as `55 ??`
- walk a GNU `std::map` container
- batch-analyse binaries headless through IDALib

## Example prompts
- write an IDAPython script that lists every function and its basic blocks
- help me read a std::string at this address in the IDA debugger
- build a headless IDALib script to process a folder of binaries

## Similar
- [ctf-rev](https://affpapa.org/en/nevibecode/skills/ctf-rev.md) — skill · 321 installs
- [reverse-engineering-tools](https://affpapa.org/en/nevibecode/skills/reverse-engineering-tools.md) — skill · 544 installs
- [binary-protection-bypass](https://affpapa.org/en/nevibecode/skills/binary-protection-bypass.md) — skill · 3700 installs
- [reverse-skill-router](https://affpapa.org/en/nevibecode/skills/reverse-skill-router.md) — skill · 1500 installs
- [leanrea](https://affpapa.org/en/nevibecode/skills/leanrea.md) — skill · 1300 installs
- [malware-analysis-dragonflyTomb-avast](https://affpapa.org/en/nevibecode/skills/malware-analysis-dragonflytomb-avast.md) — skill · 1000 installs

From the same set: [p4nda0s/reverse-skills](https://affpapa.org/en/nevibecode/by/p4nda0s/reverse-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md