
ida-no-mcp-decompiler-exporter
Export IDA Pro decompiled code and memory for AI-assisted reverse engineering
- Installs
- 211
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/reason-machines/mcp-skills --skill ida-no-mcp-decompiler-exporter- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads ida-no-mcp-decompiler-exporter automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
IDA NO MCP Decompiler Exporter
Skill by ara.so — MCP Skills collection.
IDA-NO-MCP is a plugin for IDA Pro that exports decompiled code, disassembly, strings, imports, exports, and memory dumps into AI-friendly formats. Instead of complex MCP integrations, it generates organized source files that can be directly analyzed by AI IDEs like Cursor or Claude Code.
What It Does
- Exports decompiled C code: Each function as a separate
.cfile with metadata (address, callers, callees) - Automatic fallback: Falls back to disassembly (
.asm) when decompilation fails - Memory dumps: Exports all memory segments as hexdump files (1MB chunks)
- Metadata extraction: Strings, imports, exports tables
- Smart filtering: Skips library functions and invalid functions automatically
- Detailed logging: Tracks successes, fallbacks, failures, and skipped functions
Installation
Plugin Mode (Recommended)
-
Copy
INP.pyto your IDA plugins directory:- Windows:
%APPDATA%\Hex-Rays\IDA Pro\plugins\ - Linux/macOS:
~/.idapro/plugins/
- Windows:
-
Restart IDA Pro
-
Use the plugin:
- Shortcut:
Ctrl-Shift-E(quick export) - Menu:
Edit→Plugins→Export for AI
- Shortcut:
Script Mode
Run INP.py directly from IDA's script window (Alt-F7) or via command line:
# From IDA script window
execfile('/path/to/INP.py')
Output Structure
After export, the IDB directory contains:
your_binary.idb/
├── decompile/ # Decompiled C code (.c files)
├── disassembly/ # Fallback assembly (.asm files)
├── memory/ # Memory dumps (hexdump format)
├── strings.txt # All strings with addresses
├── imports.txt # Import table
├── exports.txt # Export table
├── disassembly_fallback.txt # List of fallback functions
├── decompile_failed.txt # Complete failures
└── decompile_skipped.txt # Skipped library/invalid functions
Function Export Format
Each exported function includes metadata headers:
/*
* func-name: sub_401000
* func-address: 0x401000
* export-type: decompile
* callers: 0x402000, 0x403000
* callees: 0x404000, 0x405000
*/
__int64 __fastcall sub_401000(__int64 a1, int a2)
{
// Decompiled code here
return result;
}
For disassembly fallback (.asm files):
/*
* func-name: sub_401000
* func-address: 0x401000
* export-type: disassembly
* callers: 0x402000, 0x403000
* callees: 0x404000, 0x405000
*/
sub_401000 proc near
push rbp
mov rbp, rsp
; ... assembly code
ret
sub_401000 endp
Key Plugin Components
Core Export Logic
import idaapi
import idc
import idautils
import ida_hexrays
import ida_funcs
import os
def export_decompiled_code(func_ea):
"""Export decompiled code for a function"""
try:
# Get function name
func_name = idc.get_func_name(func_ea)
# Get callers and callees
callers = [hex(xref.frm) for xref in idautils.XrefsTo(func_ea, 0)]
callees = []
for item_ea in idautils.FuncItems(func_ea):
for xref in idautils.XrefsFrom(item_ea, 0):
if xref.type in [ida_xref.fl_CN, ida_xref.fl_CF]:
callees.append(hex(xref.to))
# Try decompilation
cfunc = idaapi.decompile(func_ea)
if cfunc:
decompiled = str(cfunc)
# Build metadata header
header = f"""/*
* func-name: {func_name}
* func-address: {hex(func_ea)}
* export-type: decompile
* callers: {', '.join(callers) if callers else 'none'}
* callees: {', '.join(callees) if callees else 'none'}
*/
"""
return header + decompiled
except Exception as e:
print(f"Decompilation failed for {hex(func_ea)}: {e}")
return None
Memory Export
def export_memory_segment(seg_ea, output_dir):
"""Export memory segment as hexdump"""
seg = idaapi.getseg(seg_ea)
if not seg:
return
seg_start = seg.start_ea
seg_end = seg.end_ea
seg_size = seg_end - seg_start
max_size = 1024 * 1024 # 1MB chunks
chunk_num = 0
while seg_start < seg_end:
chunk_end = min(seg_start + max_size, seg_end)
filename = f"{hex(seg_start)}--{hex(chunk_end)}.txt"
with open(os.path.join(output_dir, filename), 'w') as f:
addr = seg_start
while addr < chunk_end:
# Read 16 bytes per line
line_bytes = []
ascii_chars = []
for i in range(16):
if addr + i >= chunk_end:
break
byte = idc.get_wide_byte(addr + i)
line_bytes.append(f"{byte:02X}")
ascii_chars.append(chr(byte) if 32 <= byte <= 126 else '.')
# Format: ADDRESS | HEX BYTES | ASCII
hex_part = ' '.join(line_bytes).ljust(48)
ascii_part = ''.join(ascii_chars)
f.write(f"{hex(addr)} | {hex_part} | {ascii_part}\n")
addr += 16
seg_start = chunk_end
chunk_num += 1
String Extraction
def export_strings(output_file):
"""Export all strings with metadata"""
with open(output_file, 'w', encoding='utf-8') as f:
strings = idautils.Strings()
for s in strings:
# Format: address, length, type, content
str_type = {
0: "ASCII",
1: "UTF-16LE",
2: "UTF-32LE"
}.get(s.strtype, "UNKNOWN")
f.write(f"{hex(s.ea)} | len={s.length} | {str_type} | {str(s)}\n")
Common Usage Patterns
Analyzing Exported Code with AI
After exporting, open the IDB directory in your AI IDE:
- Context-aware analysis: AI can read all
.cfiles and understand function relationships via caller/callee metadata - Vulnerability hunting: Ask AI to find buffer overflows, use-after-free, etc.
- Crypto detection: Identify cryptographic functions and constants
- Protocol analysis: Understand network protocol parsing logic
Adding Extra Context
Create additional directories alongside exports:
your_binary.idb/
├── decompile/ # Auto-generated
├── docs/ # Your reverse engineering notes
├── codes/ # Frida scripts, exploits, tools
└── apk/ # APK decompilation (for Android)
AI tools will index all content for comprehensive analysis.
Programmatic Integration
# Run export from IDA Python script
import INP
# Trigger export programmatically
INP.main() # Runs the full export process
# Or customize export paths
output_dir = "/custom/path/output"
INP.export_all(output_dir)
Configuration
The plugin works out-of-the-box with defaults but can be customized by editing INP.py:
# Skip library functions (default: True)
SKIP_LIB_FUNCS = True
# Maximum memory chunk size in bytes
MAX_CHUNK_SIZE = 1024 * 1024 # 1MB
# Progress reporting interval
PROGRESS_INTERVAL = 100 # Report every 100 functions
# Export types to include
EXPORT_DECOMPILE = True
EXPORT_DISASM_FALLBACK = True
EXPORT_MEMORY = True
EXPORT_STRINGS = True
EXPORT_IMPORTS = True
EXPORT_EXPORTS = True
Troubleshooting
Plugin doesn't appear in menu
- Verify
INP.pyis in the correct plugins directory - Check IDA output window for Python errors
- Ensure IDA has Hex-Rays Decompiler installed (for decompilation feature)
Decompilation fails for all functions
- Check if Hex-Rays Decompiler is licensed and active
- Some architectures may not support decompilation (will auto-fallback to disassembly)
- Check
decompile_failed.txtfor specific error messages
Out of memory during export
- Large binaries may need chunked processing
- Reduce
MAX_CHUNK_SIZEin the script - Export specific function ranges instead of entire binary
Special characters in function names
The plugin automatically sanitizes filenames:
- Replaces
/\:*?"<>|with underscores - Appends address suffix for duplicate names (e.g.,
main_401000.c)
Missing callers/callees data
- Ensure IDA has completed auto-analysis (Wait for "AU: idle" in status bar)
- Run "Reanalyze program" from Edit menu if needed
- Check if functions are properly recognized (Edit → Functions → Reanalyze program)
Integration with AI Workflows
Example: Finding vulnerabilities
# After export, ask AI in your IDE:
"Analyze all functions in decompile/ for buffer overflow vulnerabilities"
"Find all memcpy/strcpy calls and check bounds validation"
Example: Understanding malware behavior
"Trace the execution flow starting from entry point at 0x401000"
"Identify anti-debugging checks and obfuscation techniques"
"Extract C2 communication URLs from strings.txt and related functions"
Example: Protocol reverse engineering
"Find packet parsing functions using imports.txt and decompiled code"
"Document the binary protocol structure based on recv/send call patterns"
Advanced Tips
- Incremental analysis: Export once, iterate with AI on specific function subsets
- Version control: Commit exports to track understanding evolution
- Cross-reference: Combine with dynamic analysis (Frida logs, traces)
- Custom scripts: Write Python scripts that parse the exported metadata for automated analysis
FAQ
What does the ida-no-mcp-decompiler-exporter skill do?
Export IDA Pro decompiled code and memory for AI-assisted reverse engineering
How do I install ida-no-mcp-decompiler-exporter?
Run npx skills add https://github.com/reason-machines/mcp-skills --skill ida-no-mcp-decompiler-exporter in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/ida-no-mcp-decompiler-exporter/ (personal) or .claude/skills/ida-no-mcp-decompiler-exporter/ (project).
Which AI agents can use ida-no-mcp-decompiler-exporter?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is ida-no-mcp-decompiler-exporter safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains ida-no-mcp-decompiler-exporter?
It is published by reason-machines in reason-machines/mcp-skills. It has 211 recorded installs.
More from reason-machines/mcp-skills
codebase-memory-mcp-intelligence
reason-machines/mcp-skills
High-performance code intelligence MCP server that indexes codebases into knowledge graphs for structural queries, call traces, and architecture analysis
playwright-mcp-server
reason-machines/mcp-skills
Browser automation MCP server using Playwright's accessibility tree for LLM-friendly web interaction
tradingview-mcp-assistant
reason-machines/mcp-skills
AI-assisted TradingView chart analysis and automation via Chrome DevTools Protocol for Claude Code
lanhu-mcp-collaboration
reason-machines/mcp-skills
AI-powered design collaboration server connecting Lanhu design platform with AI coding assistants for requirements analysis, UI design extraction, and team knowledge sharing
google-meta-ads-ga4-mcp
reason-machines/mcp-skills
MCP server for Google Ads, Meta Ads & GA4 — 250+ tools for campaign management, analytics & optimization across all platforms
chrome-devtools-mcp-automation
reason-machines/mcp-skills
Expert guidance for Chrome DevTools MCP server - browser automation, debugging, and performance analysis for AI agents
Popular ai & agents skills
google-agents-cli-publish
google/agents-cli
This skill should be used when the user wants to "publish an agent", "publish my ADK agent", "register an agent with Gemini", "publish to Gemini" (formerly Gemini Enterprise), or needs guidance on the agents-cli publish gemini command. Also use when the user wants to "manage agents in Agent Registry", "list/update/delete registered agents", or "register an MCP server". Covers ADK vs A2A registration modes, programmatic and interactive usage, flag reference, auto-detection from deployment metadata, Agent Registry fleet management, and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment (use google-agents-cli-deploy).
google-agents-cli-eval
google/agents-cli
This skill should be used when the user wants to "run an evaluation", "evaluate my agent", "evaluate my ADK agent", "write an eval dataset", "analyze eval failures", "compare eval results", "optimize agent", or needs guidance on the Gemini platform eval methodology and the Quality Flywheel. Covers eval metrics, dataset schema, LLM-as-judge scoring, and common failure causes. Applies to any agents-cli project, whatever framework the agent is written in. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), deployment (use google-agents-cli-deploy), or project scaffolding (use google-agents-cli-scaffold).
skill-creator
anthropics/skills
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
codex-pet
prime-skills/runcomfy-agent-skills
Codex Pet generator on RunComfy. Build a Codex-compatible Codex Pet spritesheet.webp + pet.json from a single reference image, drop it into ${CODEXHOME:-$HOME/.codex}/pets/ / and Codex picks it up as a custom Codex Pet next to the 8 built-ins. This skill produces the exact Codex Pet atlas Codex expects (1536x1872 PNG/WebP, 8 cols x 9 rows, 192x208 cells, 9 animation states — idle, running-right, running-left, waving, jumping, failed, waiting, running, review). Calls OpenAI GPT Image 2 edit ONCE via the local RunComfy CLI as runcomfy run openai/gpt-image-2/edit to produce a canonical Codex Pet pose, then assembles all 9 animation rows programmatically with ImageMagick micro-transforms — no Codex Pro, no $imagegen, no OPENAIAPIKEY required, only RUNCOMFYTOKEN. Triggers on "codex pet", "create codex pet", "make codex pet", "hatch codex pet", "/hatch image", "desktop pet codex", "codex pets", "spritesheet.webp", or any explicit ask to build a custom pet for OpenAI Codex.
full-output-enforcement
leonxlnx/taste-skill
Overrides default LLM truncation behavior. Enforces complete code generation, bans placeholder patterns, and handles token-limit splits cleanly. Apply to any task requiring exhaustive, unabridged output.
executing-plans
obra/superpowers
Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available