# How reverse-skill Integrates with IDA Pro for Binary Analysis

> Automate binary analysis with reverse-skill's IDA Pro integration. Leverage a PowerShell and Python library for seamless, GUI-free analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-11

---

**reverse-skill provides a dedicated `ida-reverse` skill that wraps IDA Pro's MCP server behind PowerShell automation scripts and a 72-function Python-style library, enabling fully automated binary analysis without direct GUI interaction.**

The open-source reverse-skill framework bridges commercial IDA Pro capabilities into automated reverse engineering workflows. According to the zhaoxuya520/reverse-skill source code, the `ida-reverse` skill operates through a three-stage pipeline that handles server lifecycle, binary ingestion, and rich analysis operations—all callable through standardized MCP tools.

## Three-Stage Integration Workflow

### Stage 1: Bootstrap and Launch the MCP Server

Before any analysis begins, reverse-skill ensures the IDA Pro MCP HTTP service is running. The `scripts/start.ps1` script performs aggressive cleanup of stale processes to prevent database file locks, then launches `idalib-mcp` on `127.0.0.1:13337`.

Key operations in `skills/ida-reverse/scripts/start.ps1`:

```powershell

# Kill orphaned workers that lock .id0/.id1/.nam files

taskkill /F /T /IM idalib-mcp.exe 2>$null

# Launch new server instance (port auto-increments if occupied)

Start-Process -FilePath "$env:IDADIR\idalib-mcp.exe" `
    -ArgumentList "--http","--host","127.0.0.1","--port","13337" `
    -WindowStyle Hidden

```

The bootstrap system also checks [`../tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/../tool-index.md) for IDA presence and auto-installs the MCP plugin via [`scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scripts/bootstrap-reverse.sh) when missing.

### Stage 2: Open Target Binaries via HTTP Wrapper

The `scripts/open.ps1` script bypasses MCP schema validation bugs present in some AI-client adapters by invoking `idalib_open` through raw HTTP rather than native MCP calls.

This script in `skills/ida-reverse/scripts/open.ps1` handles:

- **System32 file auto-copying** to temporary folders for protected binaries
- **Stale database cleanup** (`.id*`, `.id0`, `.id1`, `.nam` files)
- **Long-running auto-analysis** with configurable timeouts
- **Progress polling** emitting `INFO:opening:…` every 10 seconds

```powershell
powershell -File "skills/ida-reverse/scripts/open.ps1" `
    -Path "C:\samples\suspected_malware.exe" `
    -TimeoutSeconds 600

```

Return values follow a strict protocol: `OK:<file_path>:<session_id>` on success, or `ERR:open_timeout_<X>s` if auto-analysis exceeds the deadline.

### Stage 3: Execute the 72-Function Analysis Toolbox

Once a session is established, reverse-skill exposes IDA Pro capabilities through `idapro_*` function calls defined in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md). The library spans ten operational categories:

| Category | Example Functions |
|----------|-----------------|
| **Survey** | `idapro_survey_binary`, `idapro_entity_query` |
| **Decompilation** | `idapro_decompile`, `idapro_pseudocode` |
| **Cross-reference** | `idapro_xrefs_to`, `idapro_xrefs_from` |
| **Search** | `idapro_find_bytes`, `idapro_find_string` |
| **Memory access** | `idapro_read_bytes`, `idapro_write_bytes` |
| **Patching** | `idapro_patch_bytes`, `idapro_apply_patches` |
| **Type system** | `idapro_set_type`, `idapro_export_funcs` |
| **Stack frames** | `idapro_get_frame`, `idapro_set_frame_size` |
| **Signatures** | `idapro_apply_sig`, `idapro_flirt_match` |
| **Debugger** | `idapro_start_debugger`, `idapro_set_bp` |

## Routing Integration and Evidence-First Policy

The `ida-reverse` skill is registered in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) with this entry:

| Binary Pattern | Skill Route |
|----------------|-------------|
| `exe`/`dll`/`so`/`elf` | `ida-reverse/` — IDA Pro decompile |

This enables automatic skill selection when the central router detects binary analysis requests.

All operations enforce reverse-skill's **hard-gate evidence policy**: imports must be identified via `idapro_survey_binary(detail_level="minimal")` or `idapro_entity_query(kind="imports")` and stored as `E-imports` before deeper analysis proceeds.

## Complete Workflow Example

```powershell

# 1. Configure environment

$env:IDADIR = "C:\Program Files\IDA Pro 8.4"
pip install git+https://github.com/mrexodia/ida-pro-mcp.git
ida-pro-mcp --install  # Streamable HTTP + Global mode

# 2. Start MCP server (background, hidden)

powershell -File "skills/ida-reverse/scripts/start.ps1"

# 3. Open binary with 10-minute timeout

powershell -File "skills/ida-reverse/scripts/open.ps1" `
    -Path "C:\analysis\sample.dll" -TimeoutSeconds 600

# 4. Mandatory evidence collection

idapro_survey_binary(detail_level="minimal")
idapro_entity_query(kind="imports")  # Stored as E-imports

# 5. Decompile entry point

idapro_decompile(addr="DllEntryPoint")

# 6. Trace data flow from suspicious string

idapro_xrefs_to(addrs="\"C:\\Windows\\Temp\\evil.dat\"")

# 7. Patch and export findings

idapro_set_comments(items=@{
    addr="0x180002A40";
    comment="C2 beacon initialization - flagged IOC-2024-001"
})
idapro_export_funcs(addrs="*"; format="c_header") > sample.h

# 8. Cleanup

idapro_idalib_close(session_id=$sessionId)

```

## Critical Implementation Files

| Path | Purpose |
|------|---------|
| [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) | Complete tool definitions and workflow documentation |
| `skills/ida-reverse/scripts/start.ps1` | MCP server lifecycle management |
| `skills/ida-reverse/scripts/open.ps1` | Binary ingestion with timeout handling |
| [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) | Central router configuration |
| [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) | Automated tool installation |

## Summary

- **reverse-skill integrates IDA Pro** through the `ida-reverse` skill using PowerShell automation and a 72-function MCP toolbox
- **Three-stage pipeline**: server bootstrap (`start.ps1`), binary ingestion (`open.ps1`), analysis execution (`idapro_*` functions)
- **HTTP wrapper bypasses** MCP schema validation issues in AI client adapters
- **Automatic cleanup** prevents database lock conflicts from orphaned `idalib-mcp` processes
- **Evidence-first enforcement** requires import identification before deep analysis
- **Router integration** enables automatic skill selection for binary file types

## Frequently Asked Questions

### Does reverse-skill ship with IDA Pro binaries?

No. According to the source code in [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh), the skill requires `IDADIR` to point to an existing IDA Pro installation. The framework only installs the open-source MCP plugin (`ida-pro-mcp`) and provides automation wrappers around the commercial software.

### Why does the open.ps1 script use raw HTTP instead of native MCP calls?

The `skills/ida-reverse/scripts/open.ps1` implementation sidesteps schema-validation bugs present in some AI-client MCP adapters. Direct `idalib_open` calls through standard MCP could fail validation; the HTTP wrapper ensures reliable binary ingestion while maintaining the same functional interface.

### What happens if IDA's auto-analysis exceeds the timeout?

The `open.ps1` script emits `INFO:opening:…` progress lines every 10 seconds and terminates with `ERR:open_timeout_Xs` if the deadline passes. The session is not established, allowing callers to retry with longer timeouts or investigate stuck analysis.

### How does reverse-skill route binary analysis requests to IDA?

The [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) file maps file extensions (`exe`, `dll`, `so`, `elf`) to the `ida-reverse/` skill prefix. When the central router detects these patterns, it automatically invokes IDA Pro capabilities rather than other reverse engineering tools listed in [`skills/reverse-engineering/tools.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools.md).