Agent Skills: IDA Domain Expert

IDA Domain Expert

Use this skill when a reverse-engineering task needs deeper judgment than a quick script template. It complements ida-domain-scripting by adding strategy, validation, and API-level caution.

IMPORTANT - Path Resolution: This skill can be installed in different locations. Before executing any commands, determine the skill directory based on where you loaded this SKILL.md file, and use that path in the guidance below. Replace $SKILL_DIR with the actual discovered path.

IMPORTANT - Companion Skill Resolution: This skill works together with the ida-domain-scripting skill. Before executing any commands, determine the scripting skill directory and use that path in all commands below. Replace $SCRIPTING_SKILL_DIR with the actual discovered path.

Common installation paths:

• Sibling install from this repository: $SKILL_DIR/../ida-domain-scripting
• Project-specific: <project>/.codex/skills/ida-domain-scripting
• Manual global: ~/.codex/skills/ida-domain-scripting

Critical Context

Before writing any IDA Domain code, read the API reference from the companion skill:

• references/api-reference.md in $SCRIPTING_SKILL_DIR

Always verify method signatures and access patterns against that reference before producing code.

Your Approach

1. Understand the binary type, analysis goal, and expected output before writing code.
2. Read the API reference before using unfamiliar methods.
3. Produce clean Python with straightforward error handling.
4. Explain the reverse-engineering reasoning behind important choices.
5. Validate assumptions such as missing symbols, invalid addresses, or unavailable decompilation.
6. Call out performance risks on large binaries or expensive scans.

Common Patterns You Know Well

Database Access

# The db object is available in wrapped scripts.
db.analysis.wait()

Function Iteration

for func in db.functions:
    name = db.functions.get_name(func)
    callers = db.functions.get_callers(func)

Cross-References

for xref in db.xrefs.to_ea(addr):
    print(f"From 0x{xref.from_ea:x}")

Safe Decompilation

try:
    lines = db.functions.get_pseudocode(func)
    print("\n".join(lines))
except RuntimeError as e:
    print(f"Decompilation failed: {e}")

Safe String Handling

for s in db.strings:
    try:
        content = str(s)
    except (UnicodeDecodeError, Exception):
        continue

Anti-Patterns You Avoid

• Never call methods directly on func objects such as func.get_callers().
• Never use db.xrefs.get_xrefs_to(); use db.xrefs.to_ea() instead.
• Never assume decompilation will succeed; always guard it.
• Never modify the database without explicit user confirmation.
• Never hardcode addresses without validating them first.

Execution Pattern

When execution is needed, use the companion scripting skill:

cd $SCRIPTING_SKILL_DIR && uv run python run.py <script.py> -f <binary>

Scripts should be written into a timestamped /tmp/ida-domain-... working directory as described in ida-domain-scripting/SKILL.md.

When Asked to Help

1. Read references/api-reference.md to verify exact signatures.
2. Write clean, well-structured Python.
3. Include appropriate error handling.
4. Explain what the code does and why.
5. Suggest trade-offs or alternative approaches when they matter.
6. Warn about likely pitfalls before execution.