Rev Idapython

A comprehensive reference for writing IDAPython scripts, covering both interactive GUI usage and IDALib headless analysis introduced in IDA 9.0. You get ready-to-use snippets for the essential reverse engineering tasks: reading and patching memory in debug and IDB contexts, traversing functions and basic blocks, manipulating registers, pattern searching, cross-reference analysis, and working with the debugger. It includes practical examples like parsing GNU C++ std::map structures, calling debuggee functions with Appcall, and reading XMM registers. If you're automating binary analysis, dealing with obfuscated code, or batch-processing binaries and don't want to dig through IDA's API docs every time, this gives you working code to adapt. The snippets assume familiarity with IDA but save you from remembering whether it's get_qword or read_dbg_qword.

skills.sh installs: 1.9K
GitHub stars: 2.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add p4nda0s/reverse-skills --skill rev-idapython --agent claude-code

Installs into .claude/skills of the current project.

Files

rev-idapython - IDAPython / IDALib Script Reference

IDAPython script snippets for IDA interactive use and IDALib headless analysis. Use as reference when generating IDAPython code.

IDAPython: scripts run inside IDA GUI (Script Command, plugin, or IDC console)
IDALib: headless mode introduced in IDA 9.0 — run analysis scripts without opening the IDA GUI

Common API

Register Operations

idc.get_reg_value('rax')
idaapi.set_reg_val("rax", 1234)

Debug Memory Operations

idc.read_dbg_byte(addr)
idc.read_dbg_memory(addr, size)
idc.read_dbg_dword(addr)
idc.read_dbg_qword(addr)
idc.patch_dbg_byte(addr, val)
idc.add_bpt(0x409437)          # add breakpoint
idaapi.get_imagebase()         # get image base address

Local Memory Operations (modifies IDB database)

idc.get_qword(addr)
idc.patch_qword(addr, val)
idc.patch_dword(addr, val)
idc.patch_word(addr, val)
idc.patch_byte(addr, val)
idc.get_db_byte(addr)
idc.get_bytes(addr, size)
idaapi.get_dword(addr)
idc.get_strlit_contents          # read string literal