idac

Use idac for IDA-backed reverse engineering through a live IDA GUI, an existing .i64 / .idb, or a binary that IDA can open. Prefer first-class idac commands, then idac py exec, then external or ad hoc tooling only when idac cannot cover the task.

Critical defaults

• Work from the binary first. Do not search the web or external source trees unless the user explicitly asks for that or the task is specifically about external correlation.
• Run one idac command at a time for each target. Use batch, decompilemany, and --out artifacts for broad work instead of background parallel commands.
• Use decompile --f5 or decompilemany --f5 during type or prototype recovery. --f5 is an alias for --no-cache.
• Preview supported persistent mutations first, then commit only after the preview confirms the intended change. Outside batch mode, preview requires -o/--out.
• Before function prototype set, run function prototype show. Run function prototype check first when the declaration uses a custom calling convention (__usercall, __userpurge, __spoils) or references newly imported types; declare missing support types before dependent prototypes.
• Before importing large headers, validate with type check --decl-file ....
• After type or prototype mutations, run misc reanalyze, then reread pseudocode or locals before rename-heavy cleanup. Calibrate local renames from fresh function locals list --json output using --local-id or --index; see idac docs workflows for selector calibration.
• Before executing a mutation batch, run batch <batch.idac> --lint --out <lint.json> and fix reported issues.
• Context selection: omit -c for one live GUI session, use -c pid:<pid> for multiple GUI sessions, and use -c "db:/path" for headless work.
• When working in an idac workspace, keep audit notes append-only and factual. Distinguish proven facts from inferred names, types, and semantics.

When this guide is installed as a skill, the reference files sit alongside it; otherwise use idac docs TOPIC for the same material. For CLI syntax, prefer targeted help such as idac type class --help; use idac --full-help only when the command surface itself is unclear.

When not to use

• The task is not IDA-backed and the user wants standalone RE tooling.
• The task is source-level debugging or runtime inspection; use a debugger directly.
• A first-class idac command already covers the task; do not start with raw IDAPython.
• The task is static analysis, linting, or vulnerability scanning outside IDA-driven reverse-engineering work.

Choose the path

What is the task?
│
├─ Read-only inspection (decompile, list, xrefs, strings, ctree, microcode)
│   └─ Run `idac docs cli`
│
├─ Mutation (rename, retype, prototype, type declare)
│   └─ Run `idac docs workflows`
│
├─ C++ class or vtable recovery
│   └─ Run `idac docs class-recovery` and `idac docs ida-cpp-type-details`
│
├─ Context/target selection, backend state, or bridge trouble
│   └─ Run `idac docs targets` or `idac docs troubleshooting`
│
└─ No first-class command covers the task
    └─ Use `idac py exec` with a small explicit script

First commands

Use only the commands that match the current target state:

# always: discover live GUI and headless targets
idac targets list --json
# headless binary import
idac database open "/path/to/binary" --json
# headless database or imported binary context
idac database show -c "db:/path/to/binary" --json
# single live GUI session: omit -c
idac function list "init|open|close" --demangle --regex -i --json --out /tmp/functions.json
# one of several live GUI sessions: select the pid from targets list
idac decompile "sub_08041337" -c "pid:1234" -o /tmp/sub_08041337.c
# single live GUI session: omit -c
idac decompile "sub_08041337" -o /tmp/sub_08041337.c
# current context
idac xrefs "sub_08041337" --json
idac disasm --start "0x100000460" --end "0x1000004a0"

Mutation outline

Use idac docs workflows (workflows.md) for exact syntax.

1. Discovery and read-only audit.
2. Preview each persistent mutation.
3. Lint mutation batches before running them.
4. Commit the mutation.
5. Run misc reanalyze after type or prototype changes.
6. Reread pseudocode or locals; calibrate local selectors from fresh JSON.
7. Verify final readback and, when working in a workspace, record the pass in the workspace audit log (audit/<target>-recovery.md) if one exists.

For headless db: work, checkpoint with database save; database close saves by default, and database close --discard abandons pending changes. Live GUI edits remain in the IDA session.

Class recovery outline

Use idac docs class-recovery (class-recovery.md) for the full workflow and idac docs ida-cpp-type-details (ida-cpp-type-details.md) before importing C++ class or vtable declarations.

Python escape hatch

Use py exec only when no first-class command covers the task cleanly:

idac py exec --code "print(hex(idaapi.get_imagebase())); result = {'entry': hex(idc.get_inf_attr(idc.INF_START_EA))}"

Supported modes: --code, --stdin, --script. --script preserves IDAPython script semantics such as __file__, script-directory imports, and sys.argv when IDA exposes that helper. Add --persist only when later py exec calls in the same session must reuse Python globals. The execution scope includes the core ida* modules that idac imports itself, plus idautils, idc, and result.

Reference index