miunasu/ida-skill

Overview

This skill automates static malware and binary reverse engineering using IDA Pro and IDAPython. It extracts disassembly, decompiled pseudocode, imports, strings, cross-references, and other structural artifacts to speed analyst workflows. The toolset is designed to produce consumable reports and artifacts without executing the sample.

How this skill works

The skill drives IDA to build an i64 database, run IDAPython scripts, and export artifacts like analysis.txt, imports.txt, and filtered string lists. It provides helper scripts to run inline code or full scripts against the IDA database, plus utilities for function-level analysis, crypto identification, YARA rule generation, and byte dumping. Outputs focus on function addresses, names, call relationships, and annotated findings for triage and deeper analysis.

When to use it

• Initial static triage for unknown PE samples
• Mapping program entry points, imports, and exports
• Identifying suspicious functions and call chains
• Extracting strings and correlating them to code locations
• Generating YARA rules or extracting raw byte ranges

Best practices

• Always perform static-only analysis; do not execute or debug samples
• Start from OEP and follow a top-down analysis strategy (entry → main → key functions)
• Avoid loading entire raw string dumps into agents—use grep or subagents for targeted extraction
• Rename functions and document addresses and cross-references as you confirm behavior
• Use IDAPython snippets via exec_ida.py for repeatable queries and automation

Example use cases

• Run init_analysis.py to create an i64 database and produce analysis.txt and imports.txt for triage
• Use exec_ida.py with a short IDAPython snippet to print the entry point or decompile a specific function
• Use findcrypt.py to detect embedded cryptographic constants and propose likely algorithms
• Run reai.py to summarize function semantics and recursively analyze call chains with LLM assistance
• Generate YARA rules from recovered code ranges using mkyara.py for signature-based detection