IDAPython

Use modern ida_* modules. Avoid legacy idc module.

Module Router

Core Patterns

Iterate functions

python
1for ea in idautils.Functions():
2    name = ida_funcs.get_func_name(ea)
3    func = ida_funcs.get_func(ea)

Iterate instructions in function

python
1for head in idautils.FuncItems(func_ea):
2    insn = ida_ua.insn_t()
3    if ida_ua.decode_insn(insn, head):
4        print(f"{head:#x}: {insn.itype}")

Cross-references

python
1for xref in idautils.XrefsTo(ea):
2    print(f"{xref.frm:#x} -> {xref.to:#x} type={xref.type}")

Read/write bytes

python
1data = ida_bytes.get_bytes(ea, size)
2ida_bytes.patch_bytes(ea, b"\x90\x90")

Names

python
1name = ida_name.get_name(ea)
2ida_name.set_name(ea, "new_name", ida_name.SN_NOCHECK)

Decompile function

python
1cfunc = ida_hexrays.decompile(ea)
2if cfunc:
3    print(cfunc)  # pseudocode
4    for lvar in cfunc.lvars:
5        print(f"{lvar.name}: {lvar.type()}")

Walk ctree (decompiled AST)

python
1class MyVisitor(ida_hexrays.ctree_visitor_t):
2    def visit_expr(self, e):
3        if e.op == ida_hexrays.cot_call:
4            print(f"Call at {e.ea:#x}")
5        return 0
6
7cfunc = ida_hexrays.decompile(ea)
8MyVisitor().apply_to(cfunc.body, None)

Apply type

python
1tif = ida_typeinf.tinfo_t()
2if ida_typeinf.parse_decl(tif, None, "int (*)(char *, int)", 0):
3    ida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)

Create structure

python
1udt = ida_typeinf.udt_type_data_t()
2m = ida_typeinf.udm_t()
3m.name = "field1"
4m.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)
5m.offset = 0
6m.size = 4
7udt.push_back(m)
8tif = ida_typeinf.tinfo_t()
9tif.create_udt(udt, ida_typeinf.BTF_STRUCT)
10tif.set_named_type(ida_typeinf.get_idati(), "MyStruct")

Strings list

python
1for s in idautils.Strings():
2    print(f"{s.ea:#x}: {str(s)}")

Wait for analysis

python
1ida_auto.auto_wait()  # Block until autoanalysis completes

Key Constants

Critical Rules

1. NEVER convert hex/decimal manually — use int_convert MCP tool
2. Wait for analysis: Call ida_auto.auto_wait() before reading results
3. Thread safety: IDA SDK calls must run on main thread (use @idasync)
4. 64-bit addresses: Always assume ea_t can be 64-bit

Anti-Patterns

Detailed API Reference

For comprehensive documentation on any module, read docs/<module>.md:

• High-use: ida_bytes, ida_funcs, ida_hexrays, ida_typeinf, ida_name, idautils
• Medium-use: ida_segment, ida_xref, ida_ua, ida_frame, ida_kernwin
• Specialized: ida_dbg (debugger), ida_nalt (netnode storage), ida_regfinder (register tracking)

Full RST sources from hex-rays.com available at docs/<module>.rst.