Decompile a function using the Hex-Rays decompiler. Pass a function name or hex address (e.g. '0x401000' or 'main'). Returns C-like pseudocode.

Get the assembly listing of a function. Pass a function name or hex address (e.g. '0x401000' or 'main').

Disassemble an arbitrary address range. Pass hex addresses (e.g. '0x401000', '0x401100').

Read raw bytes from an address. Returns hex dump. Default reads 16 bytes.

List all functions in the binary. Optionally pass a filter string to match function names (case-insensitive).

Get detailed information about a function. Pass a function name or hex address.

List all segments (sections) in the binary with their permissions and sizes.

Get all cross-references TO an address (who calls/references this location). Pass hex address or name.

Get all cross-references FROM an address (what does this location call/reference). Pass hex address or name.

List all defined strings in the binary. Optionally filter by substring (case-insensitive).

List all imported functions grouped by module.

List all exported functions/symbols.

List all defined structures/unions in the IDA database with their members.

List all defined enumerations in the IDA database.

Rename a function. Pass the current name or hex address, and the new name.

Rename any address (global variable, label, etc). Pass hex address and new name.

Set a comment at an address. Use is_repeatable=True for repeatable comments that propagate to xrefs.

Set a function's type/prototype. Pass function name or address, and C-style prototype (e.g. 'int __cdecl func(int a, char *b)').

Set the type at an address. Pass hex address and C-style type declaration.

Create a new structure type. Pass a name and list of fields, each with 'name' and 'type' keys. Example fields: [{"name": "size", "type": "int"}, {"name": "data", "type": "char *"}]

Search through disassembly text for a string. Matches against instruction mnemonics, operands, and comments.

Search for a byte pattern in the binary. Pass hex bytes with optional spaces (e.g. '90 90 90' or 'CC CC' or '48 8B 05').

Start the debugger for the currently loaded binary. Optionally pass command-line arguments and binary path.

Check if the debugger is currently active and whether execution is suspended.

Set a breakpoint at an address. Pass hex address or function name.

Delete a breakpoint at an address.

List all currently set breakpoints with their status.

Enable or disable a breakpoint without removing it.

Step into the next instruction (follows calls into functions).

Step over the next instruction (executes calls without entering them).

Continue process execution until the next breakpoint or event.

Suspend (pause) the running process.

Terminate the debugged process and stop the debugger.

Read all CPU register values. Requires the debugger to be active and suspended.

Read memory from the debugged process. Requires active debugger. Returns hex dump.

Get the current call stack trace. Requires active debugger.

Patch bytes at an address in the IDA database. Pass hex bytes with optional spaces (e.g. '90 90 90' for NOP sled, 'EB 05' for short jump).

Execute arbitrary IDAPython code inside the IDA session. Set 'result' or 'output' variable in your script to return data. Example: 'import idc; result = idc.get_screen_ea()'

Load a type information library (.til) file into the current database.

List all loaded type information libraries (TILs) in the current database.

Apply a type signature to a call site (callee). Useful when the function pointer type is unknown at a call instruction.

Get all functions that call a given function. Higher-level than xrefs — groups by calling function and shows call sites.

Get all functions called by a given function. Shows what a function depends on.

Convert bytes at an address into code (disassembled instruction). Optionally undefine 'size' bytes first.

Convert bytes at an address into data. Types: byte, word, dword, qword, float, double.

Define a C-style string at an address. Pass length=0 to auto-detect (null-terminated).

Undefine (delete) items at an address, reverting them to raw bytes.

Create a new function at a given address range. If end_address is empty, IDA will auto-detect the function boundary.

Delete/undefine a function at an address. The code remains but is no longer treated as a function.

Add a bookmark at an address with optional description. Bookmarks persist in the IDA database.

List all bookmarks in the IDA database.

Delete a bookmark by slot number (get slot numbers from list_bookmarks).

Get all local variables and arguments of a decompiled function. Requires Hex-Rays. Pass function name or address.

Rename a local variable or argument in a decompiled function. Requires Hex-Rays.

List named global data variables in the binary. Optionally filter by substring.

Get the control flow graph (basic blocks and edges) of a function. Shows predecessors and successors for each block. Essential for understanding branch logic.

Read the comment at an address. Set is_repeatable=True for repeatable comments.

Get all comments within a function (both regular and repeatable). Pass function name or address.

Read the function-level comment (appears above/below the function header in disassembly).

Set a function-level comment. These appear above (anterior) or below (posterior) the function header.

Get the complete stack frame layout of a function — all stack variables, their offsets, sizes, and the overall frame geometry.

Change how an operand is displayed. operand_num: 0 for first, 1 for second. display_type: hex, decimal, octal, binary, char, default.

Change the type of a local variable in a decompiled function. Requires Hex-Rays. Pass C-style type (e.g. 'SOCKET', 'struct sockaddr_in *').

Get the color of an instruction, function, or segment. Returns hex RGB value.

Set the color of an instruction, function, or segment. Color is RGB as integer (e.g. 0xFF0000 for red, 0x00FF00 for green). item_type: instruction, function, segment.

Calculate a hash of a function's raw bytes. Useful for identifying identical/similar functions across binaries. Algorithms: md5, sha1, sha256.

Check if a function contains exception handling (try/catch/throw). Returns the decompiled code if exception handling is found.

Get the Hex-Rays intermediate representation (microcode) for a function. Maturity levels: generated, preoptimized, locopt, calls, glbopt1, glbopt2, glbopt3, lvars.

Save the IDA database. Pass a path to save to a specific location, or leave empty to save in-place.

Apply a FLIRT signature file (.sig) to identify library functions in stripped binaries. Pass the signature name (e.g. 'vc64rtf' for MSVC runtime).

List all FLIRT signatures currently applied to the database.

Create a new memory segment. permissions: bitmask (4=read, 2=write, 1=execute, 7=rwx). seg_class: CODE, DATA, BSS, STACK, etc.

Delete the segment containing the given address. The data is kept but the segment definition is removed.

Change the read/write/execute permissions of the segment containing the given address.

Create an array at an address. element_type: byte, word, dword, qword. count: number of elements.

Jump IDA's cursor to an address. This moves the user's view in the IDA GUI to the specified location.

Produce a clean assembly listing for a function, suitable for copy-paste or file export.

Produce clean C pseudocode for a function, suitable for copy-paste or file export. Requires Hex-Rays.

Execute IDC script code (IDA's native scripting language). Returns the evaluation result.

Trigger a registered IDA UI action by name (e.g. 'ToggleBnds', 'MakeCode'). Use list_ida_actions to see available actions.

List all registered IDA UI actions that can be triggered with run_ida_action.

List all threads in the debugged process. Requires active debugger.

Switch the debugger's active thread. Pass the thread ID from list_debugger_threads.

Set a hardware watchpoint (data breakpoint). Triggers when memory at address is accessed. watch_type: write, read, execute.

Get metadata about the currently loaded binary (filename, architecture, bitness, entry point).

Check if IDA's auto-analysis has completed. Some tools may return incomplete results if analysis is still running.

Check connectivity to IDA Pro. Returns 'Connected' if the IDA plugin is running and reachable.