{"owner":"mrexodia","repo":"ida-pro-mcp","hasSkills":true,"totalSkillsCount":58,"totalTokensCount":42969,"categories":["plugin-manifest","claude-rule","anthropic-skill"],"hasMcp":false,"mcpConfig":null,"found":[".claude-plugin/plugin.json",".codex-plugin/plugin.json",".kimi-plugin/plugin.json","CLAUDE.md","ida-plugin.json","skills/idapython/SKILL.md","skills/idapython/docs/ida_auto.md","skills/idapython/docs/ida_bitrange.md","skills/idapython/docs/ida_bytes.md","skills/idapython/docs/ida_dbg.md","skills/idapython/docs/ida_dirtree.md","skills/idapython/docs/ida_diskio.md","skills/idapython/docs/ida_entry.md","skills/idapython/docs/ida_expr.md","skills/idapython/docs/ida_fixup.md","skills/idapython/docs/ida_fpro.md","skills/idapython/docs/ida_frame.md","skills/idapython/docs/ida_funcs.md","skills/idapython/docs/ida_gdl.md","skills/idapython/docs/ida_graph.md","skills/idapython/docs/ida_hexrays.md","skills/idapython/docs/ida_ida.md","skills/idapython/docs/ida_idaapi.md","skills/idapython/docs/ida_idc.md","skills/idapython/docs/ida_idd.md","skills/idapython/docs/ida_idp.md","skills/idapython/docs/ida_ieee.md","skills/idapython/docs/ida_kernwin.md","skills/idapython/docs/ida_libfuncs.md","skills/idapython/docs/ida_lines.md","skills/idapython/docs/ida_loader.md","skills/idapython/docs/ida_merge.md","skills/idapython/docs/ida_mergemod.md","skills/idapython/docs/ida_moves.md","skills/idapython/docs/ida_nalt.md","skills/idapython/docs/ida_name.md","skills/idapython/docs/ida_netnode.md","skills/idapython/docs/ida_offset.md","skills/idapython/docs/ida_pro.md","skills/idapython/docs/ida_problems.md","skills/idapython/docs/ida_range.md","skills/idapython/docs/ida_regfinder.md","skills/idapython/docs/ida_registry.md","skills/idapython/docs/ida_search.md","skills/idapython/docs/ida_segment.md","skills/idapython/docs/ida_segregs.md","skills/idapython/docs/ida_srclang.md","skills/idapython/docs/ida_strlist.md","skills/idapython/docs/ida_tryblks.md","skills/idapython/docs/ida_typeinf.md","skills/idapython/docs/ida_ua.md","skills/idapython/docs/ida_undo.md","skills/idapython/docs/ida_xref.md","skills/idapython/docs/idaapi.md","skills/idapython/docs/idadex.md","skills/idapython/docs/idautils.md","skills/idapython/docs/idc.md","skills/idapython/docs/init.md"],"skills":{".claude-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.claude-plugin%2Fplugin.json -->",".codex-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.codex-plugin%2Fplugin.json -->",".kimi-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.kimi-plugin%2Fplugin.json -->","CLAUDE.md":"# CLAUDE.md\n\nGuidance for working in this repository.\n\n## What this project is\n\nIDA Pro MCP Server: exposes IDA Pro / idalib functionality to MCP clients.\n\nMain pieces:\n- `src/ida_pro_mcp/server.py`: MCP server entrypoint\n- `src/ida_pro_mcp/idalib_server.py`: headless idalib server\n- `src/ida_pro_mcp/ida_mcp/`: IDA/plugin-side APIs\n\nImportant API modules:\n- `api_core.py`: IDB metadata, functions, strings, imports\n- `api_analysis.py`: decompilation, disassembly, xrefs, paths, pattern search\n- `api_memory.py`: bytes/ints/strings, patching\n- `api_types.py`: structs, type inference, type application\n- `api_modify.py`: comments, renaming, asm patching\n- `api_stack.py`: stack frame operations\n- `api_sigmaker.py`: signature creation, scanning, xref signatures (uses sigmaker.py)\n- `api_debug.py`: debugger control, unsafe / low priority for tests\n- `api_python.py`: execute Python in IDA context\n- `api_resources.py`: `ida://` MCP resources\n\n## Core implementation rules\n\n### IDA thread safety\nAll IDA SDK calls must run on the main thread.\nUse:\n```python\nfrom .rpc import tool\nfrom .sync import idasync\n\n@tool\n@idasync\ndef my_tool(...):\n    ...\n```\n\n### API conventions\n- Prefer batch-first APIs.\n- Many functions accept either a comma-separated string or a list.\n- Use full type hints and `Annotated[...]` descriptions.\n- The function docstring becomes the MCP tool description.\n\nExample:\n```python\ndef my_api(addrs: Annotated[str, \"Addresses (0x401000, main) or list\"]) -> list[dict]:\n    ...\n```\n\n### Common helpers\n- Parse addresses with `parse_address()`\n- Normalize batch input with `normalize_list_input()` / `normalize_dict_list()`\n- Use shared pagination / filtering helpers from `utils.py`\n\n### Unsafe operations\nDebugger or destructive operations should be marked unsafe:\n```python\nfrom .rpc import tool, unsafe\n\n@unsafe\n@tool\n@idasync\ndef dangerous_op(...):\n    ...\n```\n\n## Development commands\n\n### Run\n```bash\nuv run ida-pro-mcp\nuv run ida-pro-mcp --transport http://127.0.0.1:8744/sse\nuv run idalib-mcp --stdio path/to/binary\nuv run idalib-mcp --host 127.0.0.1 --port 8745 path/to/binary\nuv run ida-pro-mcp --unsafe\n```\n\n### MCP inspector\n```bash\nuv run mcp dev src/ida_pro_mcp/server.py\n```\n\n### Install / uninstall\n```bash\nuv run ida-pro-mcp --install\nuv run ida-pro-mcp --uninstall\n```\n\n## Testing and coverage\n\n### Run tests\nUse the headless test runner:\n```bash\nuv run ida-mcp-test tests/crackme03.elf -q\nuv run ida-mcp-test tests/typed_fixture.elf -q\nuv run ida-mcp-test tests/crackme03.elf -c api_analysis\nuv run ida-mcp-test tests/typed_fixture.elf -p \"*stack*\"\n```\n\nNotes:\n- Use `uv run ...`\n- Non-interactive output should show failures only plus a summary\n- Binary-specific tests should use `@test(binary=\"...\")` with the executable basename\n\n### Coverage\nMeasure coverage across both maintained fixtures:\n```bash\nuv run coverage erase\nuv run coverage run -m ida_pro_mcp.test tests/crackme03.elf -q\nuv run coverage run --append -m ida_pro_mcp.test tests/typed_fixture.elf -q\nuv run coverage report --show-missing\n```\n\nCurrent fixture intent:\n- `tests/crackme03.elf`: compact general regression fixture\n- `tests/typed_fixture.elf`: typed globals / structs / locals / stack coverage fixture\n\n### Test expectations\n- Prefer semantic assertions, not weak \"field exists\" checks\n- Prefer round-trip tests for mutating APIs\n- If tests expose clearly wrong API behavior, fix the API instead of weakening the test\n- Focus on IDA-facing modules, not server/config plumbing\n- Expect some IDA / Hex-Rays variance; guarded assertions or runtime skips are acceptable when justified\n\n### Generic-test sanity check\nWhen adding generic tests, also try a non-fixture binary to avoid ELF-specific assumptions:\n```bash\nuv run ida-mcp-test \"C:\\CodeBlocks\\x64dbg\\bin\\x64\\x64dbg.dll\" -q\n```\n\n## Scope priorities\n\nHigh priority:\n- `api_analysis.py`\n- `api_types.py`\n- `api_modify.py`\n- `api_stack.py`\n- `api_memory.py`\n- `api_core.py`\n- `api_resources.py`\n- `utils.py`\n- `framework.py`\n\nLower priority:\n- `api_debug.py`\n- MCP transport / hosting details\n- install / config mutation logic\n\n## Practical notes\n\n- Server/plugin Python: 3.11+\n- IDA Pro 8.3+; 9.0 recommended\n- IDA Free is not supported\n- If IDA uses the wrong Python, use `idapyswitch`\n","ida-plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=ida-plugin.json -->","skills/idapython/SKILL.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2FSKILL.md -->","skills/idapython/docs/ida_auto.md":"# ida_auto\n\nAutoanalysis queue management and IDA status indicators.\n\n## Key Functions\n\n### Auto State Management\n- `get_auto_state()` - Get current autoanalyzer state (AU_NONE when idle)\n- `set_auto_state(new_state)` - Set autoanalyzer state\n- `auto_is_ok()` - Check if all queues empty (analysis finished)\n- `is_auto_enabled()` / `enable_auto(enable)` - Get/set autoanalyzer enabled state\n\n### Queue Operations\n- `auto_mark(ea, type)` - Add single address to queue (sorted)\n- `auto_mark_range(start, end, type)` - Add address range to queue\n- `auto_unmark(start, end, type)` - Remove range from queue\n- `auto_cancel(ea1, ea2)` - Remove range from AU_CODE/AU_PROC/AU_USED queues\n\n### Analysis Planning\n- `plan_ea(ea)` / `plan_range(sEA, eEA)` - Plan reanalysis\n- `auto_make_code(ea)` - Plan to make code\n- `auto_make_proc(ea)` - Plan to make code+function\n- `reanalyze_callers(ea, noret)` - Reanalyze all callers of address\n- `revert_ida_decisions(ea1, ea2)` - Delete IDA-generated analysis for range\n\n### Synchronous Analysis\n- `auto_wait()` - Process all queues and wait (returns false if cancelled)\n- `auto_wait_range(ea1, ea2)` - Process range and wait (returns step count or -1)\n- `plan_and_wait(ea1, ea2, final_pass=True)` - Analyze range synchronously\n- `auto_make_step(ea1, ea2)` - Analyze one address in range\n\n### Queue Types (atype_t)\n- `AU_CODE` (1) - Convert to instruction\n- `AU_PROC` (3) - Convert to procedure start\n- `AU_USED` (6) - Reanalyze\n- `AU_TYPE` (8) - Apply type information\n- `AU_FINAL` (13) - Final pass\n\n### IDA State (idastate_t)\n- `st_Ready` - IDA idle\n- `st_Think` - Autoanalysis on\n- `st_Waiting` - Waiting for input\n- `st_Work` - IDA busy\n\n## See Also\nFull docs: skill/docs/ida_auto.rst\n","skills/idapython/docs/ida_bitrange.md":"# ida_bitrange\n\nBitfield and bit-level range operations (low-priority, specialized use).\n\n## Key Class\n\n### bitrange_t\nRepresents a range of bits within a larger value.\n\n- `init(bit_ofs, size_in_bits)` - Initialize offset and size\n- `reset()` - Make empty\n- `empty()` - Check if empty\n- `bitoff()` / `bitsize()` / `bytesize()` - Get offset/size\n- `mask64()` - Convert to 64-bit mask\n- `has_common(r)` - Check overlap with another bitrange\n- `intersect(r)` - Intersect two ranges\n- `create_union(r)` - Union including hole between ranges\n- `shift_down(cnt)` / `shift_up(cnt)` - Shift range left/right\n\n## See Also\nFull docs: skill/docs/ida_bitrange.rst\n","skills/idapython/docs/ida_bytes.md":"# ida_bytes\n\nByte-level operations: reading, writing, patching, flags, and data type creation.\n\n## Navigation\n\n### Head/Item Navigation\n- `next_head(ea, maxea)` / `prev_head(ea, minea)` - Next/prev item head\n- `get_item_head(ea)` - Get start of item containing ea\n- `get_item_end(ea)` - Get address after item\n- `get_item_size(ea)` - Get item size in bytes\n- `next_chunk(ea, maxea)` / `prev_chunk(ea, minea)` - Next/prev contiguous chunk\n- `next_unknown(ea, maxea)` / `prev_unknown(ea, minea)` - Next/prev undefined byte\n\n## Reading Bytes\n\n### Single Values\n- `get_byte(ea)` / `get_word(ea)` / `get_dword(ea)` / `get_qword(ea)` - Read values\n- `get_original_byte(ea)` - Read original file byte (before patches)\n- `get_wide_byte(ea)` / `get_wide_word(ea)` - Read with byte size from inf.cc.size_i/size_s\n- `get_data_value(ea, size)` - Read data item value (up to 64 bits)\n\n### Bulk Operations\n- `get_bytes(ea, size, gmb_flags=GMB_READALL)` - Read byte array\n- `get_bytes_and_mask(ea, size, gmb_flags)` - Read bytes + mask (for wildcards)\n- `get_strlit_contents(ea, length, strtype)` - Extract string literal\n\n## Writing/Patching Bytes\n\n### Patching (modifies IDB + file)\n- `patch_byte(ea, value)` / `patch_word(ea)` / `patch_dword(ea)` / `patch_qword(ea)` - Patch values\n- `patch_bytes(ea, buf)` - Patch byte array\n- `revert_byte(ea)` - Revert to original file byte\n\n### IDB Only (no file modification)\n- `put_byte(ea, value)` / `put_word(ea)` / `put_dword(ea)` / `put_qword(ea)` - Update IDB only\n- `put_bytes(ea, buf)` - Update byte array in IDB\n\n## Flags & Type Checking\n\n### Item Type\n- `is_code(flags)` / `is_data(flags)` / `is_unknown(flags)` - Check item type\n- `is_byte(ea)` / `is_word(ea)` / `is_dword(ea)` / `is_qword(ea)` - Check data size\n- `is_strlit(ea)` - Check if string literal\n- `is_struct(ea)` - Check if structure\n- `is_tail(ea)` - Check if tail byte (not item head)\n\n### Flag Operations\n- `get_flags(ea)` - Get flags for address\n- `get_full_flags(ea)` - Get full flags (includes hidden/extra data)\n\n## Creating Data Items\n\n### Basic Types\n- `create_byte(ea, length, force=False)` - Create byte array\n- `create_word(ea, length, force)` - Create word array\n- `create_dword(ea, length, force)` - Create dword array\n- `create_qword(ea, length, force)` - Create qword array\n- `create_float(ea)` / `create_double(ea)` / `create_packed_real(ea)` - Create floats\n\n### String & Struct\n- `create_strlit(ea, length, strtype)` - Create string literal\n- `create_struct(ea, size, tid)` - Apply structure at address\n- `del_items(ea, flags=0, nbytes=1)` - Undefine items in range\n\n## Searching\n\n### Pattern Search\n- `find_bytes(bs, range_start, range_size, mask, flags)` - Find byte pattern\n- `bin_search(start, end, pattern, flags)` - Binary pattern search\n- `parse_binpat_str(pattern, radix, strlits)` - Parse pattern string to compiled form\n\n### Simple Search\n- `find_byte(sEA, size, value, flags)` - Find single byte value\n- `find_byter(sEA, size, value, flags)` - Find byte (reverse direction)\n\n## Operand Representation\n\n### Number Display\n- `op_hex(ea, n)` / `op_dec(ea, n)` / `op_oct(ea, n)` / `op_bin(ea, n)` - Set operand radix\n- `op_chr(ea, n)` - Display as character\n- `op_num(ea, n)` - Display as number (default radix)\n- `toggle_sign(ea, n)` - Toggle sign display\n\n### Complex Types\n- `op_offset(ea, n, reftype, target, base, tdelta)` - Create offset reference\n- `op_enum(ea, n, enum_id, serial)` - Apply enum\n- `op_stroff(ea, n, path, path_len, delta)` - Create structure offset\n- `op_stkvar(ea, n)` - Reference stack variable\n\n## Comments\n- `get_cmt(ea, rptble)` / `set_cmt(ea, comm, rptble)` - Get/set comment\n- `append_cmt(ea, str, rptble)` - Append to comment\n\n## Constants\n\n### Item Type Flags\n- `FF_CODE` / `FF_DATA` / `FF_TAIL` / `FF_UNK` - Main type flags\n- `FF_BYTE` / `FF_WORD` / `FF_DWORD` / `FF_QWORD` - Data size flags\n\n### Search Flags\n- `BIN_SEARCH_FORWARD` / `BIN_SEARCH_BACKWARD` - Search direction\n- `BIN_SEARCH_CASE` / `BIN_SEARCH_NOCASE` - Case sensitivity\n- `BIN_SEARCH_NOSHOW` - Suppress progress dialog\n\n## See Also\nFull docs: skill/docs/ida_bytes.rst\n","skills/idapython/docs/ida_dbg.md":"# ida_dbg\n\nDebugger control and tracing (unsafe operations require --unsafe flag).\n\n## Process Control\n\n### Start/Stop\n- `start_process(path, args, sdir)` / `request_start_process(...)` - Start debugging\n- `attach_process(pid, event_id)` / `request_attach_process(...)` - Attach to process\n- `detach_process()` / `request_detach_process()` - Detach from process\n- `exit_process()` / `request_exit_process()` - Terminate debugged process\n- `get_process_state()` / `set_process_state(state)` - Get/set state (DSTATE_SUSP/RUN/NOTASK)\n\n### Execution\n- `suspend_process()` / `continue_process()` - Pause/resume execution\n- `step_into()` / `step_over()` - Single step (into/over calls)\n- `step_until_ret()` - Run until return\n- `run_to(ea)` - Run until address\n- `run_to_backwards(ea)` / `continue_backwards()` - Reverse execution (if debugger supports)\n\n### State\n- `is_debugger_busy()` - Check if debugger processing request\n- `get_running_request()` / `is_request_running()` - Query pending requests\n- `invalidate_dbg_state(what)` - Invalidate cached state (DBGINV_MEMORY/REGS/ALL)\n\n## Threads\n\n- `get_thread_qty()` - Get thread count\n- `getn_thread(idx)` - Get thread ID by index\n- `get_current_thread()` - Get current thread ID\n- `select_thread(tid)` - Switch to thread\n- `suspend_thread(tid)` / `resume_thread(tid)` - Pause/resume thread\n\n## Breakpoints\n\n### Management\n- `add_bpt(ea, size, bpt_type)` - Add breakpoint (BPT_BRK/BPT_TRACE)\n- `del_bpt(ea)` - Delete breakpoint\n- `enable_bpt(ea, enable)` - Enable/disable breakpoint\n- `update_bpt(bpt)` - Update breakpoint properties\n- `get_bpt_qty()` / `getn_bpt(idx)` / `get_bpt(ea)` - Query breakpoints\n\n### Breakpoint Types\n- `BPT_BRK` - Stop execution\n- `BPT_TRACE` - Log and continue\n- `BPT_ENABLED` - Breakpoint active\n- `BPT_LOWCND` - Has condition\n\n### Location Types\n- `BPLT_ABS` - Absolute address\n- `BPLT_REL` - Relative to module\n- `BPLT_SYM` - Symbol name\n- `BPLT_SRC` - Source file:line\n\n## Registers\n\n- `get_dbg_reg_info(reg_name)` - Get register info\n- `get_sp_val()` / `get_ip_val()` - Get stack/instruction pointer\n- `is_reg_integer(reg_name)` / `is_reg_float(reg_name)` - Check register type\n\n## Tracing\n\n### Step Trace\n- `enable_step_trace(enable)` / `is_step_trace_enabled()` - Enable/check step tracing\n- `set_step_trace_options(opts)` / `get_step_trace_options()` - Configure tracing\n- `ST_OVER_DEBUG_SEG` / `ST_OVER_LIB_FUNC` / `ST_SKIP_LOOPS` - Step options\n\n### Instruction/Function/Block Trace\n- `enable_insn_trace(enable)` / `enable_func_trace(enable)` / `enable_bblk_trace(enable)` - Enable tracing\n- `set_insn_trace_options(opts)` / `set_func_trace_options(opts)` - Configure\n- `IT_LOG_SAME_IP` / `FT_LOG_RET` / `BT_LOG_INSTS` - Trace options\n\n### Trace Events\n- `get_tev_qty()` - Get trace event count\n- `get_tev_info(tev)` - Get trace event details\n- `get_insn_tev_reg_val(tev, reg)` - Get register value at instruction event\n- `clear_trace()` - Clear trace buffer\n- `set_trace_size(size)` - Set trace buffer size\n\n## Event Types\n\n### Debug Events\n- `dbg_process_start` / `dbg_process_exit` - Process lifetime\n- `dbg_thread_start` / `dbg_thread_exit` - Thread lifetime\n- `dbg_library_load` / `dbg_library_unload` - Module events\n- `dbg_bpt` / `dbg_exception` - Exception events\n- `dbg_step_into` / `dbg_step_over` / `dbg_run_to` - Step events\n\n### Trace Event Types\n- `tev_insn` - Instruction execution\n- `tev_call` - Function call\n- `tev_ret` - Function return\n- `tev_bpt` - Breakpoint hit\n- `tev_mem` - Memory access\n\n## Debugger Options (DOPT_*)\n- `DOPT_START_BPT` - Break on process start\n- `DOPT_ENTRY_BPT` - Break on entry point\n- `DOPT_THREAD_BPT` - Break on new thread\n- `DOPT_LIB_BPT` - Break on library load\n- `DOPT_SUSPEND_ON_EXCEPTION` - Stop on exception\n\n## DBG_Hooks\nOverride methods to receive debugger events (use `ida_dbg.DBG_Hooks` base class).\n\n## See Also\nFull docs: skill/docs/ida_dbg.rst\n","skills/idapython/docs/ida_dirtree.md":"# ida_dirtree\n\nDirectory tree organization for IDA items (types, functions, names, etc).\n\n## Overview\nProvides virtual directory structure over collections accessed by inode (ID). Used for organizing local types, structures, enums, functions, names, bookmarks, etc.\n\n## Standard Trees\n- `DIRTREE_LOCAL_TYPES` - Local type library\n- `DIRTREE_FUNCS` - Function list\n- `DIRTREE_NAMES` - Named locations\n- `DIRTREE_IMPORTS` - Imported functions\n- `DIRTREE_BPTS` - Breakpoints\n- `get_std_dirtree(id)` - Access standard tree\n\n## Key Classes\n\n### dirtree_t\nMain directory tree interface.\n\n- `chdir(path)` / `getcwd()` - Navigate directories\n- `mkdir(path)` / `rmdir(path)` - Create/delete directories\n- `link(path/inode)` / `unlink(path/inode)` - Add/remove items\n- `rename(from, to)` - Rename entry\n- `resolve_path(path)` - Convert path to direntry_t\n- `get_abspath(cursor/relpath)` - Get absolute path\n- `isdir(path/de)` / `isfile(path/de)` - Check entry type\n- `findfirst(ff, pattern)` / `findnext(ff)` - Iterate entries\n- `traverse(visitor)` - Depth-first traversal with callback\n\n### direntry_t\nRepresents a directory entry (inode or directory).\n\n- `idx` - inode_t or diridx_t\n- `isdir` - True if directory, false if file\n- `valid()` - Check if entry exists\n\n### dirtree_cursor_t\nCursor for navigating tree.\n\n- `parent` - Parent directory index\n- `rank` - Index within parent\n- `is_root_cursor()` / `set_root_cursor()` - Root operations\n\n### dirspec_t\nSpecialization interface (defines how inodes map to items).\n\n- `get_name(inode, name_flags)` - Get item name\n- `get_inode(dirpath, name)` - Lookup inode by name\n- `rename_inode(inode, newname)` - Rename item\n- `unlink_inode(inode)` - Notification when unlinked\n\n## Error Codes\n- `DTE_OK` - Success\n- `DTE_ALREADY_EXISTS` - Item exists\n- `DTE_NOT_FOUND` - Item not found\n- `DTE_NOT_DIRECTORY` - Not a directory\n- `DTE_NOT_EMPTY` - Directory not empty\n- `DTE_BAD_PATH` - Invalid path\n\n## See Also\nFull docs: skill/docs/ida_dirtree.rst\n","skills/idapython/docs/ida_diskio.md":"# ida_diskio\n\nFile I/O and IDA directory/resource management.\n\n## IDA Directories\n\n### Path Queries\n- `idadir(subdir)` - Get IDA install directory or subdirectory\n- `get_user_idadir()` - Get user data directory ($IDAUSR or default)\n- `get_ida_subdirs(subdir, flags)` - List all search paths for resource\n- `getsysfile(filename, subdir)` - Search for file in IDA paths\n\n### Subdirectory Constants\n- `CFG_SUBDIR` - Configuration files\n- `IDC_SUBDIR` - IDC scripts\n- `IDS_SUBDIR` - IDS files (function signatures)\n- `IDP_SUBDIR` - Processor modules\n- `LDR_SUBDIR` - Loader modules\n- `SIG_SUBDIR` - FLIRT signatures\n- `TIL_SUBDIR` - Type libraries\n- `PLG_SUBDIR` - Plugins\n- `THM_SUBDIR` - Themes\n\n### Search Flags\n- `IDA_SUBDIR_IDP` - Append processor name\n- `IDA_SUBDIR_IDADIR_FIRST` - Search $IDADIR before $IDAUSR\n- `IDA_SUBDIR_ONLY_EXISTING` - Only return existing directories\n\n## File Operations\n\n### Standard I/O Wrappers (use instead of C stdio)\n- `fopenRT(file)` / `fopenWT(file)` - Open text read/write\n- `fopenRB(file)` / `fopenWB(file)` - Open binary read/write\n- `fopenM(file)` - Open for modification\n- `fopenA(file)` - Open for append\n\n## Linput (IDA Binary Input)\n\n### Creation\n- `open_linput(file, remote)` - Open file as linput\n- `create_memory_linput(start, size)` - Create from IDB memory range\n- `create_bytearray_linput(s)` - Create from Python bytes\n- `create_generic_linput(gl)` - Create from custom reader\n\n### Operations\n- `qlgetz(li, fpos)` - Read null-terminated string at position\n- `get_linput_type(li)` - Get linput type (LINPUT_LOCAL/RFILE/PROCMEM/GENERIC)\n- `close_linput(li)` - Close linput\n\n### Linput Types\n- `LINPUT_LOCAL` - Local file\n- `LINPUT_RFILE` - Remote file\n- `LINPUT_PROCMEM` - Process memory\n- `LINPUT_GENERIC` - Custom reader\n\n### generic_linput_t\nBase class for custom binary readers.\n\n- `filesize` - Total size\n- `blocksize` - Read block size\n- `read(off, buffer, nbytes)` - Read bytes at offset\n\n## File Enumeration\n- `enumerate_files(path, fname, callback)` - Enumerate files matching pattern\n\n## Platform Folders\n- `get_special_folder(csidl)` - Get OS-specific folders\n  - `CSIDL_APPDATA` - Application data\n  - `CSIDL_LOCAL_APPDATA` - Local app data\n  - `CSIDL_PROGRAM_FILES` - Program files directory\n\n## See Also\nFull docs: skill/docs/ida_diskio.rst\n","skills/idapython/docs/ida_entry.md":"# ida_entry\n\nEntry point and exported function management - addresses, names, and ordinal numbers.\n\n## Key Functions\n\n- `get_entry_qty() -> int` - Get number of entry points\n- `add_entry(ord, ea, name, makecode, flags=0) -> bool` - Add entry point with ordinal number\n- `get_entry(ord) -> ea_t` - Get address by ordinal number\n- `get_entry_ordinal(idx) -> int` - Get ordinal by index (0..get_entry_qty()-1)\n- `get_entry_name(ord) -> str` - Get entry point name by ordinal\n- `rename_entry(ord, name, flags=0) -> bool` - Rename entry point\n- `set_entry_forwarder(ord, name, flags=0) -> bool` - Set forwarder name (for DLL exports)\n- `get_entry_forwarder(ord) -> str` - Get forwarder name\n\n## Flags (AEF_*)\n\n- `AEF_UTF8` - Name is UTF-8 encoded (default)\n- `AEF_IDBENC` - Name is IDB encoded (implies AEF_NODUMMY)\n- `AEF_NODUMMY` - Prepend '_' if name begins with dummy suffix\n- `AEF_WEAK` - Make name weak\n- `AEF_NOFORCE` - Append to comment if name exists (unless old name is weak)\n\n## See Also\nFull docs: skill/docs/ida_entry.rst\n","skills/idapython/docs/ida_expr.md":"# ida_expr\n\nIDC language interpreter - compile/execute IDC scripts, evaluate expressions, manipulate IDC values and objects.\n\n## Key Functions\n\n### Expression Evaluation\n- `eval_expr(rv, where, line) -> str` - Compile and evaluate expression at address context\n- `eval_idc_expr(rv, where, line) -> str` - Same as eval_expr but forces IDC interpreter\n\n### Script Execution\n- `compile_idc_file(line) -> str` - Compile IDC file\n- `compile_idc_text(line) -> str` - Compile IDC text\n- `compile_idc_snippet(func, text, resolver=None, only_safe_funcs=False) -> str` - Compile text into named function\n- `exec_idc_script(result, path, func, args, argsnum) -> str` - Compile and execute function from file\n- `exec_system_script(file, complain_if_no_file=True) -> bool` - Compile and execute \"main\" from system file\n\n### IDC Value Manipulation\n- `idcv_long(v) -> error_t` - Convert to 32/64-bit number\n- `idcv_int64(v) -> error_t` - Convert to 64-bit number\n- `idcv_num(v) -> error_t` - Convert to long (\"true\"→1, \"false\"→0)\n- `idcv_string(v) -> error_t` - Convert to string\n- `idcv_float(v) -> error_t` - Convert to float\n- `idcv_object(v, icls=None) -> error_t` - Create IDC object\n- `move_idcv(dst, src) -> error_t` - Move value (efficient, no copy)\n- `copy_idcv(dst, src) -> error_t` - Shallow copy (objects copied by reference)\n- `deep_copy_idcv(dst, src) -> error_t` - Deep copy objects\n- `free_idcv(v)` - Free VT_STR/VT_OBJ storage\n- `swap_idcvs(v1, v2)` - Swap two variables\n\n### Object/Attribute Access\n- `get_idcv_attr(res, obj, attr, may_use_getattr=False) -> error_t` - Get object attribute\n- `set_idcv_attr(obj, attr, value, may_use_setattr=False) -> error_t` - Set object attribute\n- `del_idcv_attr(obj, attr) -> error_t` - Delete attribute\n- `first_idcv_attr(obj) -> str`, `last_idcv_attr(obj) -> str` - Iterate attributes\n- `get_idcv_slice(res, v, i1, i2, flags=0) -> error_t` - Get slice of string/object\n- `set_idcv_slice(v, i1, i2, _in, flags=0) -> error_t` - Set slice\n\n### Class/Variable Management\n- `add_idc_class(name, super=None) -> idc_class_t*` - Create IDC class\n- `find_idc_class(name) -> idc_class_t*` - Find existing class\n- `add_idc_gvar(name) -> idc_value_t*` - Add global variable\n- `find_idc_gvar(name) -> idc_value_t*` - Find global variable\n- `find_idc_func(prefix, n=0) -> str` - Find IDC function by prefix\n\n## idc_value_t Class\n\nCore IDC value container with variant type support.\n\n### Attributes\n- `vtype: char` - Type (VT_LONG, VT_FLOAT, VT_STR, VT_OBJ, VT_FUNC, VT_PVOID, VT_INT64, VT_REF)\n- `num: int` - Integer value (VT_LONG)\n- `i64: int64` - 64-bit integer (VT_INT64)\n- `e: fpvalue_t` - Float value (VT_FLOAT)\n- `obj: idc_object_t*` - Object reference (VT_OBJ)\n\n### Methods\n- `clear()` - Free storage\n- `qstr() -> str`, `c_str() -> str` - Get string value\n- `set_string(...)`, `set_long(v)`, `set_int64(v)`, `set_float(f)` - Set typed values\n- `is_zero() -> bool`, `is_integral() -> bool`, `is_convertible() -> bool` - Type checks\n\n## Value Types (VT_*)\n- `VT_LONG` - Integer\n- `VT_INT64` - 64-bit integer\n- `VT_FLOAT` - Floating point\n- `VT_STR` - String\n- `VT_OBJ` - Object\n- `VT_FUNC` - Function\n- `VT_PVOID` - void pointer\n- `VT_REF` - Reference\n\n## Compilation Flags (CPL_*)\n- `CPL_DEL_MACROS` - Delete macros after compilation\n- `CPL_USE_LABELS` - Allow program labels\n- `CPL_ONLY_SAFE` - Only thread-safe functions\n\n## Function Flags (EXTFUN_*)\n- `EXTFUN_BASE` - Requires open database\n- `EXTFUN_NORET` - Does not return\n- `EXTFUN_SAFE` - Thread-safe, callable from any thread\n\n## See Also\nFull docs: skill/docs/ida_expr.rst\n","skills/idapython/docs/ida_fixup.md":"# ida_fixup\n\nRelocation/fixup information for loaders - manage target addresses, offsets, and displacement values.\n\n## Key Functions\n\n- `get_fixup(fd, source) -> bool` - Get fixup information at address\n- `exists_fixup(source) -> bool` - Check if fixup exists\n- `set_fixup(source, fd)` - Set fixup information (loaders use this)\n- `del_fixup(source)` - Delete fixup\n- `get_first_fixup_ea() -> ea_t` - Get first fixup address\n- `get_next_fixup_ea(ea) -> ea_t` - Next fixup after ea\n- `get_prev_fixup_ea(ea) -> ea_t` - Previous fixup before ea\n- `get_fixup_value(ea, type) -> int` - Read bytes and convert to operand value (get relocation addend)\n- `patch_fixup_value(ea, fd) -> bool` - Update bytes from fixup data\n- `get_fixup_desc(source, fd) -> str` - Get description comment\n- `calc_fixup_size(type) -> int` - Calculate fixup size in bytes (-1 on error)\n- `contains_fixups(ea, size) -> bool` - Check if range contains fixups\n- `gen_fix_fixups(from, to, size)` - Relocate bytes when moving segments/rebasing\n\n## fixup_data_t Class\n\nFixup metadata container.\n\n### Attributes\n- `sel: sel_t` - Target segment selector (BADSEL for absolute)\n- `off: ea_t` - Target offset\n- `displacement: adiff_t` - Displacement from target\n\n### Methods\n- `get_type() -> fixup_type_t`, `set_type(type)` - Fixup type access\n- `set_type_and_flags(type, flags=0)` - Set both type and flags\n- `is_custom() -> bool` - Is processor-specific fixup\n- `get_flags() -> int` - Get flags\n- `is_extdef() -> bool`, `set_extdef()`, `clr_extdef()` - Target is symbol vs segment offset\n- `is_unused() -> bool`, `set_unused()`, `clr_unused()` - IDA ignores this fixup\n- `has_base() -> bool` - Is relative fixup (vs segment-relative)\n- `was_created() -> bool` - Was created by IDA (not in original file)\n- `get_base() -> ea_t`, `set_base(new_base)` - Base address for relative fixups\n- `set(source)` - set_fixup wrapper\n- `get(source) -> bool` - get_fixup wrapper\n- `calc_size() -> int` - Fixup size\n\n## Fixup Types (FIXUP_*)\n\n- `FIXUP_OFF8`, `FIXUP_OFF16`, `FIXUP_OFF32`, `FIXUP_OFF64` - Unsigned offsets (8/16/32/64-bit)\n- `FIXUP_OFF8S`, `FIXUP_OFF16S`, `FIXUP_OFF32S` - Signed offsets\n- `FIXUP_SEG16` - 16-bit segment selector\n- `FIXUP_PTR16` - 32-bit pointer (16:16 base:offset)\n- `FIXUP_PTR32` - 48-bit pointer (16:32 base:offset)\n- `FIXUP_HI8`, `FIXUP_HI16` - High 8/16 bits of offset\n- `FIXUP_LOW8`, `FIXUP_LOW16` - Low 8/16 bits of offset\n- `FIXUP_CUSTOM` - Start of custom (processor-specific) types\n\n## Fixup Flags (FIXUPF_*)\n\n- `FIXUPF_REL` - Relative to linear address `base` (else segment-relative)\n- `FIXUPF_EXTDEF` - Target is symbol (else segment offset)\n- `FIXUPF_UNUSED` - Ignored by IDA, disables operand conversion\n- `FIXUPF_CREATED` - Not present in input file\n- `FIXUPF_LOADER_MASK` - Loader-specific flags (not stored in DB)\n\n## See Also\nFull docs: skill/docs/ida_fixup.rst\n","skills/idapython/docs/ida_fpro.md":"# ida_fpro\n\nSystem-independent FILE* operations - cross-module file I/O (use these instead of C stdlib functions).\n\n## qfile_t Class\n\nIDA's FILE* wrapper for cross-module compatibility.\n\n### Constructor Methods\n- `open(filename, mode) -> bool` - Open file (fopen-style mode string)\n- `from_fp(fp) -> qfile_t*` - Wrap existing FILE*\n- `from_capsule(pycapsule) -> qfile_t*` - Wrap Python capsule\n- `tmpfile() -> qfile_t*` - Create temporary file\n\n### File Operations\n- `close()` - Close file\n- `opened() -> bool` - Check if open\n- `flush()` - Flush buffers\n- `size() -> int64` - Get file size\n- `filename() -> str` - Get filename\n\n### Reading\n- `read(size) -> str` - Read bytes (None on error)\n- `readbytes(size, big_endian) -> str` - Read with endianness conversion\n- `gets(len) -> str` - Read line (None on EOF)\n- `get_byte() -> int` - Read single byte (None on EOF)\n\n### Writing\n- `write(buf) -> int` - Write bytes (0 on error, else bytes written)\n- `writebytes(size, big_endian) -> int` - Write with endianness conversion\n- `puts(str) -> int` - Write string\n- `put_byte(chr)` - Write single byte\n\n### Positioning\n- `seek(offset, whence=SEEK_SET) -> int` - Seek (returns new position, not 0 like fseek)\n- `tell() -> int` - Get current position\n\n## Functions\n\n- `qfclose(fp)` - Close FILE*\n\n## Move Flags (QMOVE_*)\n- `QMOVE_CROSS_FS` - Allow cross-filesystem moves\n- `QMOVE_OVERWRITE` - Overwrite existing files\n- `QMOVE_OVR_RO` - Overwrite read-only files\n\n## Important\n\n**Never mix C stdlib FILE* functions with IDA kernel functions.** Each module has its own FILE* state when statically linked. Use qfile_t for all file I/O in plugins.\n\n## See Also\nFull docs: skill/docs/ida_fpro.rst\n","skills/idapython/docs/ida_frame.md":"# ida_frame\n\nFunction stack frame manipulation - local variables, register variables, stack pointer tracking.\n\n## Frame Structure\n\n```\n+------------------------------------------------+\n| function arguments                             |\n+------------------------------------------------+\n| return address                                 |\n+------------------------------------------------+\n| saved registers (SI, DI, etc)                  |\n+------------------------------------------------+ <- typical BP\n|                                                |\n| local variables                                |\n|                                                |\n+------------------------------------------------+ <- SP\n```\n\nAccess via: `tinfo_t::get_func_frame(pfn)` or `get_func_frame(out, pfn)` + `tinfo_t::get_udt_details()`\n\n## Key Functions\n\n### Frame Management\n- `add_frame(pfn, frsize, frregs, argsize) -> bool` - Create frame (frsize=locals, frregs=saved regs, argsize=purged bytes)\n- `del_frame(pfn) -> bool` - Delete frame\n- `set_frame_size(pfn, frsize, frregs, argsize) -> bool` - Resize frame\n- `get_frame_size(pfn) -> asize_t` - Full size (locals + saved regs + retaddr + purged bytes)\n- `get_frame_retsize(pfn) -> int` - Return address size\n- `get_func_frame(out, pfn) -> bool` - Get frame type info\n\n### Frame Parts\n- `frame_off_args(pfn) -> ea_t` - Arguments section start\n- `frame_off_retaddr(pfn) -> ea_t` - Return address section start\n- `frame_off_savregs(pfn) -> ea_t` - Saved registers section start\n- `frame_off_lvars(pfn) -> ea_t` - Local variables section start\n- `get_frame_part(range, pfn, part)` - Get part offsets (FPC_ARGS/FPC_RETADDR/FPC_SAVREGS/FPC_LVARS)\n\n### Stack Variables\n- `define_stkvar(pfn, name, off, tif, repr=None) -> bool` - Define stack var (negative off=locals, positive=args)\n- `add_frame_member(pfn, name, offset, tif, repr=None, etf_flags=0) -> bool` - Add member to frame type\n- `set_frame_member_type(pfn, offset, tif, repr=None, etf_flags=0) -> bool` - Change member type\n- `delete_frame_members(pfn, start_offset, end_offset) -> bool` - Delete members in range\n- `build_stkvar_name(pfn, v) -> str` - Auto-generate stack var name\n- `calc_stkvar_struc_offset(pfn, insn, n) -> ea_t` - Calculate stack var offset in frame\n- `calc_frame_offset(pfn, off, insn=None, op=None) -> int` - Calculate offset in frame from SP/BP offset\n- `build_stkvar_xrefs(out, pfn, start_offset, end_offset)` - Get xrefs to stack frame range\n\n### Utilities\n- `is_funcarg_off(pfn, frameoff) -> bool` - Is offset in arguments range\n- `lvar_off(pfn, frameoff) -> int` - Convert to local var offset\n- `is_anonymous_member_name(name) -> bool` - Prefixed with \"anonymous\"\n- `is_dummy_member_name(name) -> bool` - Auto-generated name\n- `is_special_frame_member(tid) -> bool` - Is retaddr or saved regs slot\n- `soff_to_fpoff(pfn, soff) -> int` - Convert struct offset to FP-relative\n- `update_fpd(pfn, fpd) -> bool` - Update frame pointer delta\n- `set_purged(ea, nbytes, override_old_value) -> bool` - Set purged bytes (__stdcall/__pascal)\n\n### Register Variables\n- `add_regvar(pfn, ea1, ea2, canon, user, cmt) -> int` - Define register variable in range\n- `find_regvar(pfn, ea, canon) -> regvar_t*` - Find register variable definition\n- `has_regvar(pfn, ea) -> bool` - Check if regvar exists\n- `rename_regvar(pfn, v, user) -> int` - Rename register variable\n- `set_regvar_cmt(pfn, v, cmt) -> int` - Set comment\n- `del_regvar(pfn, ea1, ea2, canon) -> int` - Delete register variable\n- `free_regvar(v)` - Free regvar_t\n\n### Stack Pointer Tracking\n- `get_spd(pfn, ea) -> int` - Get SP delta before instruction (initial SP - current SP)\n- `get_effective_spd(pfn, ea) -> int` - Get SP delta used by instruction (differs for \"pop [esp+N]\")\n- `get_sp_delta(pfn, ea) -> int` - Get SP modification at location (0 if no change point)\n- `add_auto_stkpnt(pfn, ea, delta) -> bool` - Add automatic SP change point\n- `add_user_stkpnt(ea, delta) -> bool` - Add user-defined SP change point\n- `del_stkpnt(pfn, ea) -> bool` - Delete SP change point\n- `set_auto_spd(pfn, ea, new_spd) -> bool` - Set cumulative SP delta at address\n- `recalc_spd(cur_ea) -> bool` - Recalculate SP for non-fallthrough instructions\n- `recalc_spd_for_basic_block(pfn, cur_ea) -> bool` - Recalculate SP for basic block\n\n## regvar_t Class\n\nRegister variable definition (extends range_t).\n\n### Attributes\n- `canon: str` - Canonical register name (case-insensitive)\n- `user: str` - User-defined name\n- `cmt: str` - Comment near definition\n\n## Error Codes\n\n- `REGVAR_ERROR_OK` - Success\n- `REGVAR_ERROR_ARG` - Bad function arguments\n- `REGVAR_ERROR_RANGE` - Bad definition range\n- `REGVAR_ERROR_NAME` - Name can't be accepted\n\n## Flags\n\n- `STKVAR_VALID_SIZE` - dtyp contains correct variable type (off for \"lea\")\n- `STKVAR_KEEP_EXISTING` - Don't create new var if one exists\n\n## See Also\nFull docs: skill/docs/ida_frame.rst\n","skills/idapython/docs/ida_funcs.md":"# ida_funcs\n\nFunction management - define, modify, analyze functions and function chunks. Includes FLIRT signature support.\n\n## Architecture\n\nFunctions consist of:\n- **Entry chunk** - function start (required)\n- **Tail chunks** - optional additional code ranges shared between functions\n- Each tail has an **owner** function\n\n## func_t Class\n\nCore function descriptor (extends range_t).\n\n### Key Attributes\n- `flags: uint64` - Function flags (FUNC_*)\n- `frame: int` - Frame structure netnode ID\n- `frsize: asize_t` - Local variables size\n- `frregs: ushort` - Saved registers size\n- `argsize: asize_t` - Purged bytes on return (__stdcall/__pascal)\n- `fpd: asize_t` - Frame pointer delta (usually 0)\n- `color: bgcolor_t` - User-defined color\n- `points: stkpnt_t*`, `pntqty: int` - SP change points\n- `regvars: regvar_t*`, `regvarqty: int` - Register variables\n- `regargs: regarg_t*`, `regargqty: int` - Register arguments (temporary, cleared when type determined)\n- `tails: range_t*`, `tailqty: int` - Function tails\n- `owner: ea_t` - Tail owner address\n- `referers: ea_t*`, `refqty: int` - Parent functions using this tail\n\n### Methods\n- `is_far() -> bool` - Far function\n- `does_return() -> bool` - Returns to caller\n- `analyzed_sp() -> bool` - SP-analysis performed\n- `need_prolog_analysis() -> bool` - Needs prolog analysis\n- `get_name() -> str` - Function name\n- `get_prototype() -> tinfo_t` - Function prototype\n- `get_frame_object() -> tinfo_t` - Frame structure\n- `addresses()`, `code_items()`, `data_items()`, `head_items()`, `not_tails()` - Iterators\n\n## Key Functions\n\n### Querying Functions\n- `get_func(ea) -> func_t*` - Get function by address (returns entry chunk)\n- `getn_func(n) -> func_t*` - Get function by index (0..get_func_qty()-1)\n- `get_func_qty() -> size_t` - Total function count\n- `get_func_num(ea) -> int` - Get function index (-1 if not found)\n- `get_prev_func(ea) -> func_t*`, `get_next_func(ea) -> func_t*` - Navigate functions\n- `func_contains(pfn, ea) -> bool` - Does function contain address\n- `is_same_func(ea1, ea2) -> bool` - Do addresses belong to same function\n- `get_func_chunknum(pfn, ea) -> int` - Get chunk number (-1=not contained, 0=entry, >0=tail)\n\n### Creating/Modifying Functions\n- `add_func(ea1, ea2=BADADDR) -> bool` - Create function (auto-determines bounds if ea2=BADADDR)\n- `add_func_ex(pfn) -> bool` - Create from func_t struct\n- `del_func(ea) -> bool` - Delete function\n- `update_func(pfn) -> bool` - Update function info (don't use for start/end changes)\n- `set_func_start(ea, newstart) -> int` - Move start address (returns MOVE_FUNC_*)\n- `set_func_end(ea, newend) -> bool` - Move end address\n- `find_func_bounds(nfn, flags) -> int` - Auto-determine boundaries (returns FIND_FUNC_*)\n- `reanalyze_function(pfn, ea1=None, ea2=None, analyze_parents=False)` - Reanalyze function\n\n### Function Information\n- `get_func_name(ea) -> str` - Get name\n- `get_func_cmt(pfn, repeatable) -> str`, `set_func_cmt(pfn, cmt, repeatable) -> bool` - Comments\n- `get_func_ranges(ranges, pfn) -> ea_t` - Get all ranges\n- `calc_func_size(pfn) -> asize_t` - Total size including tails\n- `get_func_bitness(ea) -> int` - Bitness (0=16, 1=32, 2=64, -1=error)\n- `get_func_bits(ea) -> int` - Bits (16/32/64)\n- `get_func_bytes(ea) -> bytes` - Function bytes\n- `is_visible_func(pfn) -> bool`, `set_visible_func(pfn, visible)` - Visibility control\n- `is_finally_visible_func(pfn) -> bool` - Final visibility after all checks\n\n### Function Analysis\n- `func_does_return(ea) -> bool` - Does function return\n- `reanalyze_noret_flag(ea)` - Reanalyze non-return flag\n- `set_noret_insn(ea, noret)` - Mark instruction as non-returning\n- `calc_thunk_func_target(pfn) -> ea_t` - Get thunk target\n- `set_func_name_if_jumpfunc(pfn, name)` - Auto-name jump functions\n\n### Function Chunks (Tails)\n- `get_fchunk(ea) -> func_t*` - Get chunk by address (entry or tail)\n- `getn_fchunk(n) -> func_t*` - Get chunk by index\n- `get_fchunk_qty() -> size_t` - Total chunk count\n- `get_fchunk_num(ea) -> int` - Get chunk index\n- `get_prev_fchunk(ea) -> func_t*`, `get_next_fchunk(ea) -> func_t*` - Navigate chunks\n- `append_func_tail(pfn, tail_ea1, tail_ea2) -> bool` - Add tail to function\n- `remove_func_tail(pfn, tail_ea) -> bool` - Remove tail\n- `set_tail_owner(tail, owner_ea) -> bool` - Change tail owner\n- `get_fchunk_referer(ea, idx) -> ea_t` - Get parent function using tail\n- `func_tail_iterator_set(pfn, fti)` - Initialize tail iterator\n- `func_parent_iterator_set(pfn, fpi)` - Initialize parent iterator\n\n### Locking\n- `lock_func_range(pfn, lock)` - Lock function pointer (prevents deletion/move)\n- `is_func_locked(pfn) -> bool` - Check if locked\n- `lock_func(pfn)`, `lock_func_with_tails_t(pfn)` - RAII lock helpers\n\n### FLIRT Signatures\n- `plan_to_apply_idasgn(name) -> int` - Plan signature application (returns IDASGN_*)\n- `apply_idasgn_to(name, ea, may_show_wait_box) -> int` - Apply signature at address\n- `get_idasgn_qty() -> int` - Number of loaded signatures\n- `get_current_idasgn() -> str` - Current signature name\n- `calc_idasgn_state(n) -> int` - Signature state (IDASGN_*)\n- `del_idasgn(n)` - Delete signature\n- `get_idasgn_title(n) -> str` - Get signature title\n- `get_idasgn_desc(n) -> str` - Get description\n- `get_idasgn_desc_with_matches(n) -> str` - Get description with match count\n- `apply_startup_sig(ea1, ea2)` - Apply startup signature\n- `try_to_add_libfunc(pfn, ea) -> int` - Try to add library function (returns LIBFUNC_*)\n\n### Register Arguments\n- `read_regargs(pfn) -> dyn_regarg_array` - Read register arguments\n- `add_regarg(pfn, reg, type, name) -> bool` - Add register argument\n\n## Function Flags (FUNC_*)\n\n- `FUNC_NORET` - Doesn't return\n- `FUNC_FAR` - Far function\n- `FUNC_LIB` - Library function\n- `FUNC_STATICDEF` - Static\n- `FUNC_FRAME` - Uses frame pointer (BP)\n- `FUNC_USERFAR` - User-specified far\n- `FUNC_HIDDEN` - Hidden chunk\n- `FUNC_THUNK` - Jump/thunk function\n- `FUNC_BOTTOMBP` - BP points to stack frame bottom\n- `FUNC_NORET_PENDING` - Non-return analysis pending\n- `FUNC_SP_READY` - SP-analysis complete\n- `FUNC_FUZZY_SP` - SP changes untraceably (e.g., \"and esp, 0FFFFFFF0h\")\n- `FUNC_PROLOG_OK` - Prolog analyzed\n- `FUNC_PURGED_OK` - argsize validated\n- `FUNC_TAIL` - Function tail chunk\n- `FUNC_LUMINA` - Info from Lumina\n- `FUNC_OUTLINE` - Outlined code, not real function\n- `FUNC_REANALYZE` - Frame changed, needs reanalysis\n- `FUNC_UNWIND` - Exception unwind handler\n- `FUNC_CATCH` - Exception catch handler\n\n## Return Codes\n\n### MOVE_FUNC_*\n- `MOVE_FUNC_OK` - Success\n- `MOVE_FUNC_NOCODE` - No instruction at newstart\n- `MOVE_FUNC_BADSTART` - Bad new start\n- `MOVE_FUNC_NOFUNC` - No function at ea\n- `MOVE_FUNC_REFUSED` - Plugin refused\n\n### FIND_FUNC_* (flags)\n- `FIND_FUNC_NORMAL` - Stop on undefined byte\n- `FIND_FUNC_DEFINE` - Create instruction on undefined byte\n- `FIND_FUNC_IGNOREFN` - Ignore existing function boundaries\n- `FIND_FUNC_KEEPBD` - Don't modify boundaries, just create instructions\n\n### FIND_FUNC_* (results)\n- `FIND_FUNC_OK` - Ready for add_func()\n- `FIND_FUNC_EXIST` - Already exists\n- `FIND_FUNC_UNDEF` - Has unexplored bytes\n\n### IDASGN_*\n- `IDASGN_OK` - Success\n- `IDASGN_BADARG` - Bad argument\n- `IDASGN_APPLIED` - Already applied\n- `IDASGN_CURRENT` - Current signature\n- `IDASGN_PLANNED` - Planned for application\n\n### LIBFUNC_*\n- `LIBFUNC_FOUND` - Found and added\n- `LIBFUNC_NONE` - Not found\n- `LIBFUNC_DELAY` - Delayed (needs more analysis)\n\n## Iterators\n\n- `func_tail_iterator_t` - Iterate function tails\n- `func_item_iterator_t` - Iterate function items (addresses/code/data/heads)\n- `func_parent_iterator_t` - Iterate parent functions using tail\n\n## See Also\nFull docs: skill/docs/ida_funcs.rst\n","skills/idapython/docs/ida_gdl.md":"# ida_gdl\n\nLow level graph drawing operations - flow charts and call graphs.\n\n## Key Classes\n\n### FlowChart\nPythonic flowchart class for determining basic blocks.\n- `FlowChart(f, bounds, flags)` - Create flow chart for function\n- `size` - Number of blocks in flow chart\n- `refresh()` - Refresh flow chart\n- Iterate blocks directly: `for bb in fc: ...`\n\n### BasicBlock\nBasic block within a flowchart.\n- `id` - Block number\n- `start_ea`, `end_ea` - Address range\n- `type` - Block type (fcb_normal, fcb_ret, fcb_noret, etc.)\n- `preds()` - Iterator over predecessor blocks\n- `succs()` - Iterator over successor blocks\n\n### qflow_chart_t\nLow-level flow chart builder (use FlowChart instead for Python).\n- `create(title, pfn, ea1, ea2, flags)` - Build flow chart\n- `nsucc(node)`, `npred(node)` - Successor/predecessor counts\n- `succ(node, i)`, `pred(node, i)` - Get nth successor/predecessor\n\n## Key Functions\n\n- `gen_flow_graph(filename, title, pfn, ea1, ea2, gflags)` - Generate flow graph to .dot/.gdl\n- `gen_simple_call_chart(filename, wait, title, gflags)` - Simple call graph\n- `is_ret_block(btype)` - Check if block returns\n- `is_noret_block(btype)` - Check if block never returns\n\n## Constants\n\n**Block types**: fcb_normal, fcb_indjump, fcb_ret, fcb_cndret, fcb_noret, fcb_enoret, fcb_extern, fcb_error\n\n**Flow chart flags**: FC_NOEXT (no external blocks), FC_CALL_ENDS (calls end blocks), FC_NOPREDS (skip predecessors)\n\n**Chart generation**: CHART_GEN_DOT, CHART_GEN_GDL, CHART_WINGRAPH, CHART_NOLIBFUNCS\n\n## See Also\nFull docs: skill/docs/ida_gdl.rst\n","skills/idapython/docs/ida_graph.md":"# ida_graph\n\nGraph view management - custom graph visualization and interaction (medium priority for typical reverse engineering).\n\n## Key Classes\n\n### GraphViewer\nPythonic class for creating custom graph views.\n- Override `OnRefresh()` - Populate graph nodes/edges\n- Override `OnGetText(node)` - Get node display text\n- Override `OnDblClick(node)` - Handle double-click\n- Override `OnClick(node)` - Handle single-click\n- `Show()` - Display graph viewer\n- `Close()` - Close graph viewer\n\n### interactive_graph_t\nLow-level interactive graph implementation (use GraphViewer instead for Python).\n\n### mutable_graph_t\nAbstract graph structure for manipulation.\n- `create_mutable_graph()` - Create new graph\n- `delete_mutable_graph(g)` - Delete graph\n\n## Key Functions\n\n### Graph Creation\n- `create_graph_viewer(title, gid, callback)` - Create graph viewer widget\n- `create_interactive_graph(title)` - Create interactive graph\n- `create_disasm_graph(ea)` - Create disassembly graph at address\n\n### Graph Manipulation\n- `get_node_info(graph, node)` - Get node display info (color, text, etc.)\n- `set_node_info(graph, node, info, flags)` - Set node properties\n- `del_node_info(graph, node)` - Delete node info\n- `viewer_set_node_info(viewer, node, info, flags)` - Set node info in viewer\n\n### Graph Navigation\n- `viewer_get_curnode(viewer)` - Get currently selected node\n- `viewer_center_on(viewer, node)` - Center view on node\n- `viewer_fit_window(viewer)` - Zoom to fit\n- `viewer_get_selection(viewer)` - Get selected items\n\n### Graph Groups\n- `viewer_create_groups(viewer, groups)` - Create node groups\n- `viewer_delete_groups(viewer, groups)` - Delete groups\n- `viewer_set_groups_visibility(viewer, groups, visible)` - Show/hide groups\n\n## Constants\n\n**Node info flags**: NIF_BG_COLOR, NIF_FRAME_COLOR, NIF_EA, NIF_TEXT, NIF_FLAGS, NIF_ALL\n\n**Layout types**: layout_digraph, layout_tree, layout_circle, layout_polar_tree, layout_orthogonal, layout_radial_tree\n\n**Graph item types**: git_none, git_edge, git_node, git_tool, git_text\n\n## See Also\nFull docs: skill/docs/ida_graph.rst\n","skills/idapython/docs/ida_hexrays.md":"# ida_hexrays\n\nHex-Rays decompiler - microcode and ctree (AST) representations. **Critical for decompilation work.**\n\n## Core Architecture\n\n**Two representations**:\n- **Microcode**: Low-level optimized IR (mba_t, mblock_t, minsn_t, mop_t)\n- **Ctree**: High-level AST-like C code (cfunc_t, cinsn_t, cexpr_t)\n\n## Key Functions\n\n### Decompilation\n- `decompile(ea, hf=None, flags=0)` - Decompile function at address, returns cfuncptr_t\n- `decompile_func(pfn, hf=None, flags=0)` - Decompile func_t object\n- `gen_microcode(mbr, hf=None, retlist=None, flags=0, reqmat=MMAT_GLBOPT3)` - Generate microcode only\n\n### Callbacks\n- `install_hexrays_callback(callback)` - Register event hook (hxe_maturity, hxe_print_func, etc.)\n\n## Ctree Classes (High-Level)\n\n### cfunc_t\nDecompiled function - the main result.\n- `body` - Root cinsn_t (function body)\n- `lvars` - List of local variables (lvar_t)\n- `mba` - Underlying microcode (mba_t)\n- `get_pseudocode()` - Get text as list of lines\n- `build_c_tree()` - Rebuild ctree from microcode\n- `verify(allow_cot_empty)` - Validate ctree integrity\n\n### cinsn_t\nC statement (if, for, while, return, expression, block, etc.).\n- `op` - Statement type (cit_block, cit_if, cit_for, cit_while, cit_return, etc.)\n- `ea` - Associated address\n- `cif`, `cfor`, `cwhile`, `creturn`, `cexpr` - Type-specific data unions\n- Access via: `insn.cif.expr` (if condition), `insn.cblock` (compound statement)\n\n### cexpr_t\nC expression (operators, variables, constants, calls, etc.).\n- `op` - Expression type (cot_var, cot_num, cot_call, cot_add, cot_cast, etc.)\n- `type` - Expression type info (tinfo_t)\n- `x`, `y`, `z` - Operands (for binary/ternary ops)\n- `n` - Number value (cnumber_t)\n- `v` - Variable reference (var_ref_t)\n- `obj_ea` - Global variable/function address\n- `print1()` - Format as text\n\n### citem_t\nBase class for cinsn_t and cexpr_t.\n- `ea` - Address\n- `op` - Opcode (ctype_t enum)\n- `contains_label()` - Has goto label\n\n## Microcode Classes (Low-Level)\n\n### mba_t\nMicrocode array - function as basic blocks.\n- `qty` - Number of blocks\n- `get_mblock(n)` - Get block by index\n- `natural` - Natural (entry) block array\n- `vars` - Local variables (lvars_t)\n- `maturity` - Optimization level (MMAT_ZERO to MMAT_LVARS)\n- `build_graph()` - Construct CFG\n- `optimize_local(blk)` - Optimize single block\n- `optimize_global()` - Global optimization pass\n\n### mblock_t\nBasic block in microcode.\n- `head`, `tail` - First/last instruction (minsn_t)\n- `start`, `end` - Address range\n- `type` - Block type (BLT_STOP, BLT_1WAY, BLT_2WAY, BLT_NWAY)\n- `nsucc()`, `npred()` - Successor/predecessor counts\n- `succ(n)`, `pred(n)` - Get nth successor/predecessor\n- `for_all_insns(visitor)` - Iterate instructions\n- `insert_into_block(ins, where)` - Add instruction\n\n### minsn_t\nMicrocode instruction.\n- `opcode` - Operation (m_mov, m_add, m_call, m_ldx, m_stx, etc.)\n- `l`, `r`, `d` - Left, right, destination operands (mop_t)\n- `ea` - Instruction address\n- `next`, `prev` - Linked list pointers\n- `is_assert()` - Check if assertion\n- `equal_mops(other)` - Compare operands\n- `for_all_ops(visitor)` - Iterate operands\n\n### mop_t\nMicrocode operand.\n- `t` - Operand type (mop_z=none, mop_r=register, mop_n=immediate, mop_S=stack, mop_v=global, mop_b=block, mop_f=case, mop_l=local var, mop_a=address, mop_h=helper, mop_str=string, mop_c=call, mop_fn=function, mop_p=pair, mop_sc=scattered)\n- `r` - Register number (if mop_r)\n- `nnn` - Immediate value (mnumber_t, if mop_n)\n- `g` - Global address (if mop_v)\n- `s` - Stack offset (stkvar_ref_t, if mop_S)\n- `l` - Local var reference (lvar_t, if mop_l)\n- `size` - Operand size in bytes\n- `is_reg(reg, size)` - Check if specific register\n- `is_const()` - Check if constant\n\n### lvar_t\nLocal variable (stack/register).\n- `name` - Variable name\n- `type` - Variable type (tinfo_t)\n- `location` - vdloc_t (register or stack location)\n- `defea` - Definition address\n- `width` - Size in bytes\n- `is_stk_var()`, `is_reg_var()` - Location checks\n- `set_lvar_type(tif)` - Change type\n\n## Key Event Types\n\n**Maturity levels** (microcode optimization stages):\n- MMAT_ZERO - Unoptimized\n- MMAT_GENERATED - After instruction generation\n- MMAT_PREOPTIMIZED - After pre-optimization\n- MMAT_LOCOPT - After local optimization\n- MMAT_CALLS - After call analysis\n- MMAT_GLBOPT1/2/3 - Global optimization passes\n- MMAT_LVARS - After local variable allocation\n\n**Callback events**:\n- hxe_maturity - Microcode maturity changed\n- hxe_print_func - About to print function\n- hxe_func_printed - Function printed\n- hxe_open_pseudocode - Pseudocode window opened\n- hxe_create_hint - Create hover hint\n\n## Common Patterns\n\n### Decompile and get text\n```python\ncfunc = ida_hexrays.decompile(ea)\nfor line in cfunc.get_pseudocode():\n    print(line.line)\n```\n\n### Modify variable name/type\n```python\ncfunc = ida_hexrays.decompile(ea)\nlvar = cfunc.lvars[0]\nlvar.name = \"new_name\"\nlvar.set_lvar_type(new_tinfo)\ncfunc.save_user_labels()\n```\n\n### Walk ctree\n```python\nclass visitor(ida_hexrays.ctree_visitor_t):\n    def visit_expr(self, e):\n        if e.op == ida_hexrays.cot_call:\n            print(f\"Call at {e.ea:#x}\")\n        return 0\n\ncfunc = ida_hexrays.decompile(ea)\nvisitor().apply_to(cfunc.body, None)\n```\n\n### Walk microcode\n```python\nmba = ida_hexrays.gen_microcode(...)\nfor blk in mba.natural:\n    ins = blk.head\n    while ins:\n        print(f\"{ins.ea:#x}: {ins.opcode}\")\n        ins = ins.next\n```\n\n## See Also\nFull docs: skill/docs/ida_hexrays.rst\n\n**External resources**:\n- https://hex-rays.com/blog/hex-rays-decompiler-primer\n- https://hex-rays.com/blog/microcode-in-pictures\n","skills/idapython/docs/ida_ida.md":"# ida_ida\n\nDatabase-wide configuration via the `inf` structure - processor info, file type, address ranges, and analysis flags.\n\n## Key Functions\n\n### Database Properties\n- `inf_get_min_ea()`, `inf_set_min_ea(ea)` - Database address range start\n- `inf_get_max_ea()`, `inf_set_max_ea(ea)` - Database address range end\n- `inf_get_start_ea()`, `inf_set_start_ea(ea)` - Entry point address\n- `inf_get_baseaddr()`, `inf_set_baseaddr(ea)` - Image base address\n- `inf_get_main()`, `inf_set_main(ea)` - Main function address\n\n### Architecture Info\n- `inf_is_16bit()`, `inf_is_32bit_exactly()`, `inf_is_64bit()` - Architecture bit width\n- `inf_set_32bit(v)`, `inf_set_64bit(v)` - Set architecture\n- `inf_is_be()`, `inf_set_be(v)` - Big-endian check/set\n- `inf_is_dll()`, `inf_set_dll(v)` - DLL vs executable\n\n### File Information\n- `inf_get_procname()`, `inf_set_procname(name)` - Processor name (x86, ARM, etc.)\n- `inf_get_filetype()`, `inf_set_filetype(ft)` - File type (f_PE, f_ELF, f_MACHO, etc.)\n- `inf_get_md5()`, `inf_get_sha256()` - File hashes\n- `inf_get_input_file_path()` - Original input file path\n- `inf_get_imagebase()` - PE/ELF image base\n\n### Analysis Flags\n- `inf_get_af()`, `inf_set_af(flags)` - Get/set all analysis flags\n- `inf_get_af2()`, `inf_set_af2(flags)` - Secondary analysis flags\n- Analysis flag constants: AF_CODE, AF_JUMPTBL, AF_PROC, AF_LVAR, AF_TRACE, AF_FLIRT, etc.\n\n### Display Options\n- `inf_is_graph_view()`, `inf_set_graph_view(v)` - Default to graph vs text view\n- `inf_get_indent()`, `inf_set_indent(n)` - Disassembly indentation\n- `inf_get_margin()`, `inf_set_margin(n)` - Right margin\n\n### Database State\n- `inf_is_auto_enabled()`, `inf_set_auto_enabled(v)` - Auto-analysis state\n- `inf_readonly_idb()`, `inf_set_readonly_idb(v)` - Read-only mode\n- `inf_get_database_change_count()` - Change counter (for caching)\n\n### Compiler Info\n- `inf_get_cc_id()`, `inf_set_cc_id(id)` - Calling convention ID\n- `inf_get_cc_size_i()`, `inf_get_cc_size_l()` - sizeof(int), sizeof(long)\n- `inf_get_abibits()`, `inf_set_abibits(bits)` - ABI flags\n\n## Key Constants\n\n**File types**: f_PE, f_ELF, f_MACHO, f_BIN, f_COFF, f_OMF, f_AOUT, f_HEX\n\n**Analysis flags**: AF_CODE (create instructions), AF_JUMPTBL (analyze jump tables), AF_PROC (create functions), AF_LVAR (local variables), AF_FLIRT (apply FLIRT signatures)\n\n**Loader flags**: LFLG_64BIT, LFLG_IS_DLL, LFLG_PC_FLAT (flat memory model)\n\n**Name display**: NM_REL_OFF (show offsets), NM_EA (show addresses), NM_SHORT (short names)\n\n**Demangling**: DEMNAM_GCC3 (GCC v3 ABI), DEMNAM_CMNT (show in comments), DEMNAM_NAME (show as name)\n\n## See Also\nFull docs: skill/docs/ida_ida.rst\n","skills/idapython/docs/ida_idaapi.md":"# ida_idaapi\n\nCore IDAPython infrastructure - plugin system, type definitions, and Python integration utilities.\n\n## Key Constants\n\n### Address Types\n- `ea_t` - Effective address type (int)\n- `BADADDR` - Invalid address sentinel\n- `BADADDR32` - 32-bit invalid address (0xFFFFFFFF)\n- `BADADDR64` - 64-bit invalid address (0xFFFFFFFFFFFFFFFF)\n\n### Plugin Return Codes\n- `PLUGIN_SKIP` - Plugin init failed, unload\n- `PLUGIN_OK` - Plugin loaded successfully\n- `PLUGIN_KEEP` - Keep plugin loaded\n\n## Key Functions\n\n- `require(modulename, package=None)` - Load or reload module (forces reload for development)\n- `notify_when(when, callback)` - Register event callbacks (NW_OPENIDB, NW_CLOSEIDB, etc.)\n- `as_cstr(s)` - Convert to C string\n- `as_uint32(v)`, `as_int32(v)`, `as_signed(v)` - Type conversions\n- `IDAPython_ExecScript(path)` - Execute Python script\n- `set_script_timeout(seconds)`, `disable_script_timeout()` - Script execution limits\n\n## Key Classes\n\n### plugin_t\nBase class for IDA plugins.\n- Override `init()`, `run()`, `term()` methods\n- Set `flags`, `comment`, `help`, `wanted_name`, `wanted_hotkey`\n\n### plugmod_t\nModern plugin module interface (IDA 7.2+).\n- Override `run(arg)` method\n- Supports multiple plugin instances\n\n## See Also\nFull docs: skill/docs/ida_idaapi.rst\n","skills/idapython/docs/ida_idc.md":"# ida_idc\n\nMarked positions (bookmarks) in IDA database - low priority module with limited scope.\n\n## Key Functions\n\n- `mark_position(ea, lnnum, x, y, slot, comment)` - Create bookmark at address in slot (0-1023)\n- `get_marked_pos(slot)` - Get address of bookmark in slot\n- `get_mark_comment(slot)` - Get comment for bookmark in slot\n\n## See Also\nFull docs: skill/docs/ida_idc.rst\n","skills/idapython/docs/ida_idd.md":"# ida_idd\n\nInterface to debugger modules - defines structures for target processor debugging and API.\n\n## Key Classes/Functions\n\n### debug_event_t\nDebug event information container\n- `eid()` - get event type (PROCESS_STARTED, BREAKPOINT, EXCEPTION, etc.)\n- `modinfo()` - module info for PROCESS_STARTED/LIB_LOADED\n- `exc()` - exception details for EXCEPTION events\n- `bpt()` - breakpoint addresses\n\n### debugger_t\nDebugger module interface\n- `get_debug_event(event, timeout_ms)` - wait for debug event\n- `resume(event)` - continue execution\n- `read_registers(tid, clsmask, values)` - read thread registers\n- `write_register(tid, regidx, value)` - write thread register\n- `read_memory(nbytes, ea, buffer, size)` - read process memory\n- `write_memory(nbytes, ea, buffer, size)` - write process memory\n- `update_bpts(nbpts, bpts, nadd, ndel)` - add/delete breakpoints\n\n### regval_t\nRegister value container\n- `set_int(x)` - set integer value\n- `set_float(v)` - set floating point\n- `pyval(dtype)` - get Python value\n\n### Python Helpers\n- `dbg_read_memory(ea, sz)` - read debuggee memory, returns bytes or None\n- `dbg_write_memory(ea, buffer)` - write bytes to debuggee\n- `dbg_get_registers()` - get register definitions\n- `dbg_get_memory_info()` - get memory layout\n\n## Event Types\n- PROCESS_STARTED, PROCESS_EXITED, PROCESS_ATTACHED, PROCESS_DETACHED\n- THREAD_STARTED, THREAD_EXITED\n- BREAKPOINT, STEP, EXCEPTION\n- LIB_LOADED, LIB_UNLOADED\n\n## See Also\nFull docs: skill/docs/ida_idd.rst\n","skills/idapython/docs/ida_idp.md":"# ida_idp\n\nInterface to processor modules - defines target assembler and processor features.\n\n## Key Classes/Functions\n\n### Instruction Analysis\n- `is_call_insn(insn)` - is instruction a call?\n- `is_ret_insn(insn, flags)` - is instruction a return?\n- `is_indirect_jump_insn(insn)` - is instruction an indirect jump?\n- `is_basic_block_end(insn, call_stops_block)` - does instruction end a basic block?\n- `has_cf_chg(feature, opnum)` - does instruction modify operand?\n- `has_cf_use(feature, opnum)` - does instruction use operand value?\n\n### Processor Info\n- `get_ph()` - get processor_t structure\n- `get_ash()` - get assembler asm_t structure\n- `set_processor_type(processor_name, level)` - change processor module\n- `get_idp_name()` - get current processor name\n- `str2reg(regname)` - convert register name to index\n- `get_reg_name(regidx, width)` - get register name\n\n### processor_t\nGlobal processor structure (accessed via `ph`)\n- `ph.id` - processor ID (PLFM_386, PLFM_ARM, PLFM_MIPS, etc.)\n- `ph.flag` - processor flags (PR_SEGS, PR_USE32, PR_USE64, etc.)\n- `ph.cnbits` / `ph.dnbits` - code/data address bits\n- `ph_get_instruc()` - get instruction names\n\n### Instruction Features (CF_*)\n- CF_STOP - doesn't continue execution\n- CF_CALL - call instruction\n- CF_CHG1..CF_CHG8 - modifies operand 1-8\n- CF_USE1..CF_USE8 - uses operand 1-8\n- CF_JUMP - indirect jump/call\n\n## See Also\nFull docs: skill/docs/ida_idp.rst\n","skills/idapython/docs/ida_ieee.md":"# ida_ieee\n\nIEEE floating point conversion utilities.\n\n## Key Classes/Functions\n\n### fpvalue_t\nIEEE floating point value representation (internal format)\n- `from_str(p)` - parse from string\n- `to_str(buf, bufsize, mode)` - convert to string\n- `from_sval(x)` / `to_sval(round)` - convert to/from signed integer\n- `from_int64(x)` / `to_int64(round)` - convert to/from 64-bit int\n- `from_uint64(x)` / `to_uint64(round)` - convert to/from unsigned 64-bit\n- `from_10bytes(fpval)` / `to_10bytes(fpval)` - 10-byte float conversions\n- `from_12bytes(fpval)` / `to_12bytes(fpval)` - 12-byte float conversions\n- `fadd(y)`, `fsub(y)`, `fmul(y)`, `fdiv(y)` - arithmetic operations\n- `eabs()`, `negate()` - absolute value and negation\n- `is_negative()` - check sign\n- `get_kind()` - get value kind (FPV_NORM, FPV_NAN, FPV_PINF, FPV_NINF)\n\n## Error Codes\n- REAL_ERROR_OK, REAL_ERROR_FORMAT, REAL_ERROR_RANGE\n- REAL_ERROR_BADDATA, REAL_ERROR_FPOVER, REAL_ERROR_BADSTR\n- REAL_ERROR_ZERODIV, REAL_ERROR_INTOVER\n\n## See Also\nFull docs: skill/docs/ida_ieee.rst\n","skills/idapython/docs/ida_kernwin.md":"# ida_kernwin\n\nInterface between kernel and UI - dialogs, menus, choosers, custom viewers, and UI utilities.\n\n## Key Functions\n\n### User Interaction\n- `msg(fmt, ...)` - print to output window\n- `warning(fmt, ...)` / `error(fmt, ...)` - show warning/error dialog\n- `ask_yn(defval, fmt, ...)` - yes/no question\n- `ask_str(defval, hist, fmt, ...)` - string input\n- `ask_long(defval, fmt, ...)` - integer input\n- `ask_addr(defval, fmt, ...)` - address input\n- `ask_file(forsave, defval, fmt, ...)` - file chooser\n\n### Navigation\n- `jumpto(ea, opnum=-1, uijmp_flags=0)` - jump to address\n- `get_screen_ea()` - current cursor address\n- `read_selection()` - get selected address range\n- `choose_func(title)` - let user choose a function\n- `choose_name(ea, title)` - let user choose a name\n\n### UI Elements\n- `find_widget(title)` - find widget by title\n- `activate_widget(widget, take_focus)` - activate widget\n- `close_widget(widget, flags)` - close widget\n- `open_*_window(ea)` - open disasm/hex/exports/imports/etc window\n\n### Actions\n- `register_action(desc)` - register menu action\n- `unregister_action(name)` - unregister action\n- `attach_action_to_menu(path, name, flags)` - add action to menu\n- `attach_action_to_toolbar(toolbar, name)` - add to toolbar\n- `update_action_*()` - update action state/label/icon/etc\n\n### Choosers (Lists)\n- `Choose` class - create custom list windows\n- `choose_refresh()` - refresh chooser\n- `get_chooser_obj(title)` - get chooser Python object\n\n### Custom Viewers\n- `create_empty_widget(title)` - empty widget\n- `create_code_viewer(widget, custviewer, flags)` - code viewer\n- `simplecustviewer_t` - simple text viewer\n\n### Misc\n- `execute_sync(func, reqf)` - execute in UI thread\n- `refresh_idaview()` / `refresh_idaview_anyway()` - refresh disassembly\n- `beep(type)` - system beep\n- `get_highlight(viewer)` - get highlighted identifier\n- `set_highlight(viewer, text, flags)` - set highlight\n\n## Widget Types (BWN_*)\nDISASM, HEXVIEW, OUTPUT, FUNCS, NAMES, STRINGS, SEGS, IMPORTS, EXPORTS, PSEUDOCODE, etc.\n\n## See Also\nFull docs: skill/docs/ida_kernwin.rst\n","skills/idapython/docs/ida_libfuncs.md":"# ida_libfuncs\n\nFLIRT signature library metadata and access.\n\n## Key Functions\n\n- `get_idasgn_header_by_short_name(out_header, name)` - get signature header by short name\n- `get_idasgn_path_by_short_name(name)` - get full path to signature file\n\n## idasgn_header_t\n\nSignature file header structure\n- `processor_id` - target processor\n- `file_formats` - supported file formats\n- `ostype` - OS type (OSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_UNIX, etc.)\n- `apptype` - application type (APPT_CONSOLE, APPT_GRAPHIC, APPT_LIBRARY, APPT_DRIVER, etc.)\n- `libname_length` - library name length\n- `number_of_modules` - module count\n- `ctype_name` - compiler type name\n\n## Constants\n\n### OS Types\nOSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_OS2, OSTYPE_NETW, OSTYPE_UNIX, OSTYPE_OTHER\n\n### Application Types\n- APPT_CONSOLE, APPT_GRAPHIC, APPT_PROGRAM, APPT_LIBRARY, APPT_DRIVER\n- APPT_1THREAD, APPT_MTHREAD\n- APPT_16BIT, APPT_32BIT, APPT_64BIT\n\n## See Also\nFull docs: skill/docs/ida_libfuncs.rst\n","skills/idapython/docs/ida_lines.md":"# ida_lines\n\nLine rendering and text generation for disassembly output.\n\n## Key Functions\n\n### Line Generation\n- `generate_disasm_line(ea, flags)` - generate disassembly line at ea\n- `generate_many_lines(ea, flags)` - generate multiple lines (includes function header, etc.)\n- `tag_remove(tagged_line)` - remove color tags from line\n- `tag_skipcode(p)` - skip color tag at position\n- `tag_advance(p, cnt)` - advance by cnt printable characters\n\n### Color Tags\n- `SCOLOR_*` constants - color tag markers (instructions, registers, comments, etc.)\n- Lines contain embedded color codes (e.g., `\\x01` for instruction color)\n\n### Line Prefix/Suffix\n- `gl_comm` / `set_gl_comm(start, end)` - comment delimiters\n- `inf_get_indent()` - get indentation amount\n\n## Common Use Cases\n\nGenerate colored disassembly:\n```python\nline = ida_lines.generate_disasm_line(ea, 0)\nplain = ida_lines.tag_remove(line)\n```\n\n## Low Priority\n\nThis module is mostly for display formatting. Core analysis uses ida_ua (instruction decoding) and ida_bytes (data access) instead.\n\n## See Also\nFull docs: skill/docs/ida_lines.rst\n","skills/idapython/docs/ida_loader.md":"# ida_loader\n\nLoader and file operations - loading binaries, database management, file I/O, and plugin loading.\n\n## Key Functions\n\n### Database Operations\n- `save_database(outfile=None, flags=-1, root=None, attr=None)` - Save database with optional new filename\n- `flush_buffers()` - Flush buffers to disk\n- `is_trusted_idb()` - Check if database is trusted\n- `get_path(pt)` / `set_path(pt, path)` - Get/set file paths (PATH_TYPE_CMD, PATH_TYPE_IDB, PATH_TYPE_ID0)\n\n### File Loading\n- `load_binary_file(filename, li, neflags, fileoff, basepara, binoff, nbytes)` - Load binary into database\n- `file2base(li, pos, ea1, ea2, patchable)` - Load file portion into address range\n- `mem2base(mem, ea, fpos)` - Load from memory buffer\n- `reload_file(file, is_remote)` - Reload input file bytes without losing analysis\n- `base2file(fp, pos, ea1, ea2)` - Unload database to binary file\n\n### File Type Detection\n- `get_basic_file_type(li)` - Recognize file type (libraries, zip, etc.)\n- `get_file_type_name()` - Get current file type name (from idainfo.filetype)\n\n### Output Generation\n- `gen_file(otype, fp, ea1, ea2, flags)` - Generate output files (MAP, EXE, IDC, LST, ASM, DIF)\n- `gen_exe_file(fp)` - Generate executable file from database\n\n### File/Memory Mapping\n- `get_fileregion_offset(ea)` - Get file offset for linear address (returns -1 if unmapped)\n- `get_fileregion_ea(offset)` - Get linear address for file offset (returns BADADDR if not found)\n\n### Plugin Management\n- `load_plugin(name)` - Load plugin by name or path\n- `run_plugin(plg, arg)` - Run loaded plugin with argument\n- `load_and_run_plugin(name, arg)` - Load and run plugin in one call\n- `find_plugin(name, load_if_needed=False)` - Find plugin, optionally loading it\n- `get_plugin_options(plugin)` - Get -Oplugin:options from command line\n\n### Import/IDS\n- `set_import_ordinal(modnode, ea, ord)` - Set ordinal import entry info\n- `set_import_name(modnode, ea, name)` - Set named import entry info\n- `load_ids_module(fname)` - Load and apply IDS file\n\n### Archives\n- `process_archive(temp_file, li, module_name, neflags, defmember, loader)` - Process archive file\n- `extract_module_from_archive(fname, is_remote=False)` - Extract module from archive interactively\n\n### Snapshots\n- `build_snapshot_tree(root)` - Build snapshot tree structure\n\n## Key Classes\n\n### snapshot_t\nDatabase snapshot representation.\n- `id` - Snapshot ID (qtime64_t timestamp)\n- `flags` - Snapshot flags (SSF_AUTOMATIC, etc.)\n- `desc` - Description string (max 128 chars)\n- `filename` - Snapshot filename\n- `children` - Child snapshots\n\n### plugin_info_t\nPlugin metadata.\n- `path` - Full plugin path\n- `name` - Short name (appears in menu)\n- `hotkey` - Current hotkey\n- `flags` - Plugin flags\n- `comment` - Plugin comment\n\n### loader_t\nLoader module interface (low-priority: advanced loader development only).\n\n### idp_desc_t / idp_name_t\nProcessor module metadata (low-priority: processor module development).\n\n## Key Flags\n\n### Load Flags (NEF_*)\n- `NEF_FIRST` - First file loaded into database\n- `NEF_SEGS` - Create segments\n- `NEF_CODE` - Load as code segment\n- `NEF_RELOAD` - Reload at same place (don't recreate segments/fixups)\n- `NEF_FLAT` - Autocreate FLAT group (PE)\n\n### Database Flags (DBFL_*)\n- `DBFL_KILL` - Delete unpacked database\n- `DBFL_COMP` - Collect garbage\n- `DBFL_BAK` - Create backup file\n- `DBFL_TEMP` - Temporary database\n\n### Output File Types (OFILE_*)\n- `OFILE_MAP` - MAP file\n- `OFILE_EXE` - Executable\n- `OFILE_IDC` - IDC script\n- `OFILE_LST` - Disassembly listing\n- `OFILE_ASM` - Assembly\n- `OFILE_DIF` - Difference\n\n## See Also\nFull docs: skill/docs/ida_loader.rst\n","skills/idapython/docs/ida_merge.md":"# ida_merge\n\nIDA Teams merge functionality - 3-way merging of IDB files (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for IDA Teams only. Handles merging of base_idb, local_idb, and remote_idb databases with conflict resolution.\n\n## Key Concepts\n\n- **base_idb**: Common ancestor database (middle pane in UI)\n- **local_idb**: Local database receiving merge result (left pane)\n- **remote_idb**: Remote database merging into local (right pane)\n\n## Merge Phases\nMerges occur in phases: global settings, segmentation, bytes, names, functions, types, debugger settings, etc.\n\n## Key Functions\n\n- `is_diff_merge_mode()` - Check if in merge/diff mode\n- `create_nodeval_merge_handler()` / `create_nodeval_merge_handlers()` - Create merge handlers for custom data\n- `destroy_moddata_merge_handlers()` - Destroy module data merge handlers\n- `get_ea_diffpos_name()` - Get name of EA difference position\n\n## Key Classes\n\n### merge_data_t\nMerge operation data container.\n\n### merge_handler_params_t\nParameters for creating merge handlers.\n\n### merge_node_helper_t / merge_node_info_t\nHelpers for merging netnode data.\n\n## Merge Kinds (MERGE_KIND_*)\nExtensive list including: NETNODE, INF, SEGMENTS, FUNC, FRAME, EXPORTS, IMPORTS, ENUMS, STRUCTS, TILS, TINFO, BYTEVAL, FLAGS, CREFS, DREFS, BPTS, DEBUGGER, etc.\n\n## See Also\nFull docs: skill/docs/ida_merge.rst\n","skills/idapython/docs/ida_mergemod.md":"# ida_mergemod\n\nHelper functions for plugin/processor module merging in IDA Teams (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for plugin/processor developers needing to merge custom module data. Used in response to `ev_create_merge_handlers` event.\n\n## Key Function\n\n- `create_std_modmerge_handlers(mhp, helper, merge_node_info=None)` - Create standard merge handlers for module data\n\n## Merge Sources Supported\n1. Data fields inside moddata (plugmod_t/procmod_t)\n2. Values in module netnode\n3. Values in arbitrary netnodes\n4. Data fields in auxiliary structures\n5. Indexed arrays in netnodes\n\n## See Also\nFull docs: skill/docs/ida_mergemod.rst\nExamples: plugins/mex1, plugins/mex2, plugins/mex3, plugins/ex_merge_ldrdata\n","skills/idapython/docs/ida_moves.md":"# ida_moves\n\nNavigation history, bookmarks, and location tracking in IDA views.\n\n## Key Classes\n\n### lochist_entry_t\nLocation history entry combining place and renderer info.\n- `rinfo` - Renderer information (renderer_info_t)\n- `plce` - Place pointer (place_t*)\n- `place()` / `set_place(p)` - Get/set place\n- `is_valid()` - Check if entry is valid\n- `renderer_info()` - Get renderer info reference\n\n### navstack_entry_t\nNavigation stack entry extending lochist_entry_t.\n- `widget_id` - Widget identifier\n- `ud_str` - User-defined string\n- Inherits all lochist_entry_t members\n\n### navstack_t\nNavigation history stack (back/forward navigation).\n- `init(defpos, stream_name, flags)` - Initialize stack\n- `set_current(e, in_charge)` / `get_current(out, widget_id)` - Set/get current position\n- `stack_jump(try_to_unhide, e)` - Jump to entry\n- `stack_back(out, cnt, try_to_unhide)` / `stack_forward(out, cnt, try_to_unhide)` - Navigate backward/forward\n- `stack_nav(out, forward, cnt, try_to_unhide)` - Generic navigation\n- `stack_index()` / `stack_size()` - Get current index/size\n- `stack_clear(new_tip)` - Clear stack with new tip\n- `get_stack_entry(out, index)` / `set_stack_entry(index, e)` - Get/set entry at index\n- `is_history_enabled()` - Check if history is enabled\n\n### bookmarks_t\nBookmark management (static methods).\n- `mark(e, index, title, desc, ud)` - Create/update bookmark\n- `get(out, index, ud)` - Get bookmark entry\n- `get_desc(e, index, ud)` - Get bookmark description\n- `find_index(e, ud)` - Find bookmark index\n- `size(e, ud)` - Get bookmark count\n- `erase(e, index, ud)` - Delete bookmark\n- `get_dirtree_id(e, ud)` - Get dirtree ID for bookmark\n\n### renderer_info_t\nView renderer state (graph position, zoom, cursor).\n- `rtype` - Renderer type (tcc_renderer_type_t)\n- `gli` - Graph location info (graph_location_info_t)\n- `pos` - Position info (renderer_info_pos_t)\n\n### graph_location_info_t\nGraph view location and zoom state.\n- `zoom` - Zoom level\n- `orgx` / `orgy` - Origin coordinates\n\n### segm_move_info_t / segm_move_infos_t\nSegment relocation tracking (for when segments move).\n- `to` - Target address\n- `size` - Size moved\n- `find(ea)` - Find move info for address\n\n## Constants\n\n### Location State Flags (LSEF_*)\n- `LSEF_PLACE` - Place component\n- `LSEF_RINFO` - Renderer info component\n- `LSEF_PTYPE` - Place type component\n- `LSEF_ALL` - All components\n\n### Unhide Flags (UNHID_*)\n- `UNHID_SEGM` - Unhid segment at target\n- `UNHID_FUNC` - Unhid function at target\n- `UNHID_RANGE` - Unhid range at target\n\n### Other Constants\n- `MAX_MARK_SLOT` - Maximum bookmark slot number\n- `LHF_HISTORY_DISABLED` - History disabled flag\n- `DEFAULT_CURSOR_Y` / `DEFAULT_LNNUM` - Default cursor position\n\n## See Also\nFull docs: skill/docs/ida_moves.rst\n","skills/idapython/docs/ida_nalt.md":"# ida_nalt\n\nNetnode-based storage for various analysis information - switch tables, references, types, strings, imports, metadata.\n\n## Key Functions\n\n### Netnode Access\n- `ea2node(ea)` / `node2ea(node)` - Convert between addresses and netnodes\n- `end_ea2node(ea, size)` - Get netnode for address range end\n- `getnode(ea)` - Get netnode for address\n\n### Address Flags (AFL_*)\nExtensive flag system for tracking analysis state at addresses.\n\n#### Query Flags\n- `get_aflags(ea)` / `set_aflags(ea, flags)` / `del_aflags(ea)` - Get/set/delete flags\n- `upd_abits(ea, set, clr)` / `set_abits(ea, bits)` / `clr_abits(ea, bits)` - Update address bits\n- `is_hidden_item(ea)` / `hide_item(ea)` / `unhide_item(ea)` - Item visibility\n- `is_hidden_border(ea)` / `hide_border(ea)` / `unhide_border(ea)` - Border visibility\n- `is_colored_item(ea)` / `set_colored_item(ea)` / `clr_colored_item(ea)` - Colored items\n- `is_usersp(ea)` / `set_usersp(ea)` / `clr_usersp(ea)` - User stack pointer\n- `uses_modsp(ea)` / `set_usemodsp(ea)` / `clr_usemodsp(ea)` - Modified stack pointer\n- `is_libitem(ea)` / `set_libitem(ea)` / `clr_libitem(ea)` - Library item\n- `is_noret(ea)` / `set_noret(ea)` / `clr_noret(ea)` - No-return function\n- `is_notcode(ea)` / `set_notcode(ea)` / `clr_notcode(ea)` - Not code\n- `is_notproc(ea)` / `set_notproc(ea)` / `clr_notproc(ea)` - Not procedure\n- `is_type_guessed_by_ida(ea)` / `set_type_guessed_by_ida(ea)` - IDA type guess\n- `is_func_guessed_by_hexrays(ea)` / `set_func_guessed_by_hexrays(ea)` - Hex-Rays function guess\n- `is_data_guessed_by_hexrays(ea)` / `set_data_guessed_by_hexrays(ea)` - Hex-Rays data guess\n- `is_type_determined_by_hexrays(ea)` / `set_type_determined_by_hexrays(ea)` - Hex-Rays type determination\n\n### Type Information\n- `get_tinfo(tif, ea)` / `set_tinfo(ea, tif)` / `del_tinfo(ea)` - Address type info\n- `get_op_tinfo(tif, ea, opnum)` / `set_op_tinfo(ea, opnum, tif)` / `del_op_tinfo(ea, opnum)` - Operand type info\n- `has_ti(ea)` / `has_ti0(ea)` / `has_ti1(ea)` - Check if type info exists\n\n### String Types\n- `get_str_type(ea)` / `set_str_type(ea, strtype)` / `del_str_type(ea)` - String type at address\n- `get_str_type_code(strtype)` - Get string type code\n- `get_str_term1(strtype)` / `get_str_term2(strtype)` - String terminators\n- `get_str_encoding_idx(ea)` / `set_str_encoding_idx(ea, idx)` - String encoding\n- `make_str_type(base, lyt)` - Construct string type code\n- `is_pascal(strtype)` - Check if Pascal string\n- `get_str_type_prefix_length(strtype)` - Get prefix length\n\n### References and Offsets\n- `get_refinfo(ri, ea, opnum)` / `set_refinfo(ea, opnum, type, target, base, tdelta)` / `del_refinfo(ea, opnum)` - Reference info\n- `set_refinfo_ex(ea, opnum, ri)` - Set reference info with refinfo_t\n- `get_custom_refinfo(out, cfmt)` / `find_custom_refinfo(cfmt)` - Custom reference formats\n- `get_reftype_by_size(size)` - Get reference type by size\n- `is_reftype_target_optional(rt)` - Check if target is optional\n\n### Switch Tables\n- `get_switch_info(si, ea)` / `set_switch_info(ea, si)` / `del_switch_info(ea)` - Switch info\n- `get_switch_parent(ea)` / `set_switch_parent(ea, parent)` / `del_switch_parent(ea)` - Switch parent\n\n### Arrays\n- `get_array_parameters(out, ea)` / `set_array_parameters(ea, params)` / `del_array_parameters(ea)` - Array display parameters\n\n### Custom Data Types\n- `get_custom_data_type_ids(out, ea)` / `set_custom_data_type_ids(ea, ids)` / `del_custom_data_type_ids(ea)` - Custom data types\n\n### Colors and Alignment\n- `get_item_color(ea)` / `set_item_color(ea, color)` / `del_item_color(ea)` - Item color\n- `get_alignment(ea)` / `set_alignment(ea, align)` / `del_alignment(ea)` - Alignment\n\n### Source Line Numbers\n- `get_source_linnum(ea)` / `set_source_linnum(ea, lnnum)` / `del_source_linnum(ea)` - Source line mapping\n\n### Absolute Base\n- `get_absbase(ea)` / `set_absbase(ea, base)` / `del_absbase(ea)` - Absolute segment base\n\n### File Metadata\n- `get_root_filename()` / `set_root_filename(path)` - Input file root name\n- `get_input_file_path()` - Input file full path\n- `dbg_get_input_path()` - Debugger input path\n- `retrieve_input_file_size()` - File size\n- `retrieve_input_file_crc32()` / `retrieve_input_file_md5()` / `retrieve_input_file_sha256()` - File hashes\n- `get_archive_path()` / `set_archive_path(path)` - Archive path\n- `get_loader_format_name()` / `set_loader_format_name(name)` - Loader format\n\n### IDB Version and Timing\n- `get_initial_ida_version()` / `get_initial_idb_version()` - IDA/IDB versions\n- `get_idb_ctime()` - IDB creation time\n- `get_elapsed_secs()` - Analysis elapsed time\n- `get_idb_nopens()` - IDB open count\n\n### Image Base\n- `get_imagebase()` / `set_imagebase(base)` - Image base address\n\n### String Encodings\n- `get_encoding_qty()` - Number of encodings\n- `get_encoding_name(idx)` - Encoding name\n- `add_encoding(name, bpu)` / `del_encoding(idx)` / `rename_encoding(idx, name)` - Manage encodings\n- `get_encoding_bpu(idx)` / `get_encoding_bpu_by_name(name)` - Bytes per unit\n- `get_strtype_bpu(strtype)` - String type bytes per unit\n- `get_default_encoding_idx()` / `set_default_encoding_idx(idx)` - Default encoding\n- `get_outfile_encoding_idx()` / `set_outfile_encoding_idx(idx)` - Output file encoding\n- `encoding_from_strtype(strtype)` - Get encoding from string type\n\n### Imports\n- `get_import_module_qty()` - Number of import modules\n- `get_import_module_name(idx)` - Import module name\n- `enum_import_names(idx, callback)` - Enumerate imports\n- `delete_imports()` - Delete all imports\n\n### GOT/PLT\n- `get_gotea()` / `set_gotea(ea)` - Global Offset Table address\n\n### Notepad\n- `get_ida_notepad_text()` / `set_ida_notepad_text(text)` - IDA notepad text\n\n### Source Debug Paths\n- `get_srcdbg_paths()` / `set_srcdbg_paths(paths)` - Source debug paths\n- `get_srcdbg_undesired_paths()` / `set_srcdbg_undesired_paths(paths)` - Undesired debug paths\n\n### Assembly Include\n- `get_asm_inc_file()` / `set_asm_inc_file(file)` - Assembly include file\n\n### IDS Modules\n- `get_ids_modnode()` / `set_ids_modnode(node)` - IDS module netnode\n\n### ABI\n- `get_abi_name()` - ABI name\n\n## Key Classes\n\n### switch_info_t\nSwitch statement information.\n- `flags` - Switch flags (SWI_*)\n- `ncases` - Number of cases (excluding default)\n- `jumps` - Jump table start address\n- `values` - Values table address (if SWI_SPARSE)\n- `lowcase` - Lowest case value\n- `defjump` - Default jump address (BADADDR if none)\n- `startea` - Start of switch idiom\n- `jcases` - Jump table entries (if SWI_INDIRECT)\n- `elbase` - Element base\n- `regnum` / `regdtype` - Switch expression register\n- `get_jtable_size()` / `set_jtable_size(size)` - Jump table size\n- `get_jtable_element_size()` / `set_jtable_element_size(size)` - Element size\n- `has_default()` / `is_sparse()` / `is_custom()` / `is_indirect()` / `is_subtract()` - Query flags\n\n### refinfo_t\nReference/offset information.\n- `target` - Reference target (BADADDR if none)\n- `base` - Base of reference (may be BADADDR)\n- `tdelta` - Offset from target\n- `flags` - Reference flags (REFINFO_*)\n- `type()` / `set_type(rt)` - Reference type (REF_OFF16, REF_OFF32, REF_OFF64, etc.)\n- `is_target_optional()` / `no_base_xref()` / `is_pastend()` / `is_rvaoff()` / `is_custom()` / `is_subtract()` / `is_signed()` - Query flags\n- `init()` - Initialize\n\n### array_parameters_t\nArray display parameters.\n- `flags` - Array flags (AP_*)\n- `lineitems` - Items per line\n- `alignment` - Item alignment (-1=don't align, 0=auto, else width)\n- `is_default()` - Check if default\n\n### opinfo_t\nOperand type information union (structure/enum/strpath/custom).\n\n### strpath_t\nStructure path for nested structure member offsets.\n\n### enum_const_t\nEnumeration constant reference.\n\n## Key Constants\n\n### String Types (STRTYPE_*)\n- `STRTYPE_TERMCHR` / `STRTYPE_C` / `STRTYPE_C_16` / `STRTYPE_C_32` - C strings\n- `STRTYPE_PASCAL` / `STRTYPE_PASCAL_16` / `STRTYPE_PASCAL_32` - Pascal strings\n- `STRTYPE_LEN2` / `STRTYPE_LEN2_16` / `STRTYPE_LEN2_32` - 2-byte length prefix\n- `STRTYPE_LEN4` / `STRTYPE_LEN4_16` / `STRTYPE_LEN4_32` - 4-byte length prefix\n\n### String Layout (STRLYT_*)\n- `STRLYT_TERMCHR` / `STRLYT_PASCAL1` / `STRLYT_PASCAL2` / `STRLYT_PASCAL4` - Layout types\n\n### String Width (STRWIDTH_*)\n- `STRWIDTH_1B` / `STRWIDTH_2B` / `STRWIDTH_4B` - Character width\n\n### Reference Types (REF_*)\n- `REF_OFF16` / `REF_OFF32` / `REF_OFF64` - Full offsets\n- `REF_LOW8` / `REF_LOW16` / `REF_HIGH8` / `REF_HIGH16` - Partial offsets\n\n### Reference Info Flags (REFINFO_*)\n- `REFINFO_RVAOFF` - RVA offset\n- `REFINFO_PASTEND` - Past end of segment\n- `REFINFO_CUSTOM` - Custom format\n- `REFINFO_NOBASE` - No base\n- `REFINFO_SUBTRACT` - Subtract instead of add\n- `REFINFO_SIGNEDOP` - Signed operand\n\n### Switch Info Flags (SWI_*)\n- `SWI_SPARSE` - Sparse switch (has values table)\n- `SWI_V32` / `SWI_J32` - 32-bit values/jumps\n- `SWI_USER` - User-defined\n- `SWI_CUSTOM` - Custom switch\n- `SWI_INDIRECT` - Indirect jump table\n\n### Address Flags (AFL_*)\nExtensive flag set including: AFL_LINNUM, AFL_USERSP, AFL_PUBNAM, AFL_WEAKNAM, AFL_HIDDEN, AFL_MANUAL, AFL_NOBRD, AFL_ZSTROFF, AFL_LIB, AFL_TI, AFL_COLORED, AFL_NORET, AFL_FIXEDSPD, AFL_ALIGNFLOW, AFL_USERTI, AFL_RETFP, AFL_USEMODSP, AFL_NOTCODE, AFL_NOTPROC, and type guessing flags.\n\n### Root Info Indices (RIDX_*)\nDatabase-level metadata keys: RIDX_FILE_FORMAT_NAME, RIDX_MD5, RIDX_SHA256, RIDX_IDA_VERSION, RIDX_STR_ENCODINGS, RIDX_SRCDBG_PATHS, RIDX_DBG_BINPATHS, RIDX_ABINAME, RIDX_ARCHIVE_PATH, RIDX_PROBLEMS, etc.\n\n## See Also\nFull docs: skill/docs/ida_nalt.rst\n","skills/idapython/docs/ida_name.md":"# ida_name\n\nName management - getting, setting, validating, and demangling names at addresses.\n\n## Key Functions\n\n### Getting Names\n- `get_name(ea)` - Get name at address (simple form)\n- `get_colored_name(ea)` - Get name with color tags\n- `get_ea_name(ea, gtn_flags=0)` - Get name with flags (alias for get_name with flags)\n- `get_visible_name(ea, gtn_flags=0)` - Get visible name (respects hidden status)\n- `get_short_name(ea, gtn_flags=0)` - Get short form name\n- `get_long_name(ea, gtn_flags=0)` - Get long form name\n- `get_colored_short_name(ea, gtn_flags=0)` - Colored short name\n- `get_colored_long_name(ea, gtn_flags=0)` - Colored long name\n\n### Setting Names\n- `set_name(ea, name, flags=0)` - Set or delete name at address\n- `force_name(ea, name, flags=0)` - Force name (add suffix if needed)\n- `del_global_name(ea)` - Delete global name\n- `del_local_name(ea)` - Delete local name\n- `set_dummy_name(from_ea, ea)` - Generate autogenerated dummy name (loc_, sub_, etc.)\n- `make_name_auto(ea)` - Mark name as autogenerated\n- `make_name_user(ea)` - Mark name as user-defined\n- `make_name_public(ea)` - Make name public\n- `make_name_non_public(ea)` - Make name non-public\n- `make_name_weak(ea)` - Make name weak\n- `make_name_non_weak(ea)` - Make name non-weak\n\n### Name Lookup\n- `get_name_ea(from_ea, name)` - Get address for name (search from address)\n- `get_name_base_ea(from_ea, to_ea)` - Get base address for name\n- `get_name_value(from_ea, name)` - Get name value\n\n### Name Visibility\n- `hide_name(ea)` - Hide name from display\n- `show_name(ea)` - Show previously hidden name\n\n### Name Validation\n- `is_valid_cp(cp, kind, data=None)` - Check if codepoint is valid for name type\n- `is_ident_cp(cp)` - Check if codepoint is valid identifier character\n- `is_strlit_cp(cp, ranges=None)` - Check if valid in string literal\n- `is_visible_cp(cp)` - Check if codepoint is visible\n- `is_ident(name)` - Check if valid identifier\n- `is_uname(name)` - Check if valid user name\n- `is_valid_typename(name)` - Check if valid type name\n- `validate_name(name, type, flags=1)` - Validate name for type with flags\n- `cleanup_name(ea, name, flags=0)` - Clean up name (remove invalid chars)\n- `extract_name(line, x)` - Extract name from line at position\n\n### Name List\n- `get_nlist_size()` - Get name list size\n- `get_nlist_idx(ea)` - Get index in name list\n- `is_in_nlist(ea)` - Check if address is in name list\n- `get_nlist_ea(idx)` - Get address at name list index\n- `get_nlist_name(idx)` - Get name at name list index\n- `rebuild_nlist()` - Rebuild name list\n- `reorder_dummy_names()` - Reorder dummy names\n\n### Debug Names\n- `set_debug_name(ea, name)` - Set debug name (from debug info)\n- `get_debug_name(ea_ptr, how)` - Get debug name with transform\n- `del_debug_names(ea1, ea2)` - Delete debug names in range\n- `get_debug_name_ea(name)` - Get address for debug name\n- `get_debug_names(...)` - Get all debug names\n- `is_name_defined_locally(...)` - Check if name is locally defined\n\n### Name Demangling\n- `demangle_name(name, disable_mask, demreq=DQT_FULL)` - Demangle C++ name\n- `get_demangled_name(ea, inhibitor, demform, gtn_flags=0)` - Get demangled name at address\n- `get_mangled_name_type(name)` - Get mangled name type (CODE, DATA, UNKNOWN)\n\n### Utility\n- `calc_gtn_flags(fromaddr, ea)` - Calculate get name flags\n- `set_cp_validity(...)` / `get_cp_validity(...)` - Set/get codepoint validity\n\n## Key Flags\n\n### Set Name Flags (SN_*)\n- `SN_CHECK` - Fail if name contains invalid characters\n- `SN_NOCHECK` - Replace invalid characters silently with '_'\n- `SN_PUBLIC` / `SN_NON_PUBLIC` - Make public/non-public\n- `SN_WEAK` / `SN_NON_WEAK` - Make weak/non-weak\n- `SN_AUTO` / `SN_NON_AUTO` - Make autogenerated/non-autogenerated\n- `SN_NOLIST` - Exclude from name list\n- `SN_NOWARN` - Don't display warning if failed\n- `SN_LOCAL` - Create local name (requires function context)\n- `SN_IDBENC` - Name is in IDB encoding\n- `SN_FORCE` - Add numerical suffix if name exists (_123)\n- `SN_NODUMMY` - Prepend '_' if name begins with dummy suffix\n- `SN_DELTAIL` - Delete hindering item if tail byte conflicts\n- `SN_MULTI` - Add as alternative name comment if name exists\n- `SN_MULTI_FORCE` - Replace name, move old to comment\n\n### Get Name Flags (GN_*)\n- `GN_VISIBLE` - Get visible name\n- `GN_COLORED` - Include color tags\n- `GN_DEMANGLED` - Get demangled name\n- `GN_STRICT` - Strict name lookup\n- `GN_SHORT` - Short form\n- `GN_LONG` - Long form\n- `GN_LOCAL` - Include local names\n- `GN_ISRET` / `GN_NOT_ISRET` - Is/isn't return value\n- `GN_NOT_DUMMY` - Exclude dummy names\n\n### Get Name Ex Flags (GETN_*)\n- `GETN_APPZERO` - Append zero to result\n- `GETN_NOFIXUP` - Don't apply fixups\n- `GETN_NODUMMY` - Don't return dummy names\n\n### Get Near Comment Flags (GNCN_*)\n- `GNCN_NOSEG` - Don't include segment name\n- `GNCN_NOCOLOR` - No color tags\n- `GNCN_NOLABEL` - Don't include label\n- `GNCN_NOFUNC` - Don't include function name\n- `GNCN_SEG_FUNC` - Include segment and function\n- `GNCN_SEGNUM` - Include segment number\n- `GNCN_REQFUNC` - Require function\n- `GNCN_REQNAME` - Require name\n- `GNCN_NODBGNM` - No debug names\n- `GNCN_PREFDBG` - Prefer debug names\n\n### Debug Name Flags (DEBNAME_*)\n- `DEBNAME_EXACT` - Exact match\n- `DEBNAME_LOWER` - Convert to lowercase\n- `DEBNAME_UPPER` - Convert to uppercase\n- `DEBNAME_NICE` - Nice formatting\n\n### Demangling Flags (DQT_*)\n- `DQT_FULL` - Full demangling\n- `DQT_NAME_TYPE` - Name and type only\n- `DQT_COMPILER` - Compiler-specific\n- `DQT_NPURGED_2` / `DQT_NPURGED_4` / `DQT_NPURGED_8` - Number of purged bytes\n\n### Name Types (NT_*)\n- `NT_NONE` - No name\n- `NT_BYTE` - Byte name\n- `NT_LOCAL` - Local name\n- `NT_STKVAR` - Stack variable\n- `NT_ENUM` - Enum member\n- `NT_ABS` - Absolute symbol\n- `NT_SEG` - Segment\n- `NT_STROFF` - Structure offset\n- `NT_BMASK` - Bitmask\n- `NT_REGVAR` - Register variable\n\n### Validate Name Types (VNT_*)\n- `VNT_IDENT` - Identifier\n- `VNT_TYPE` - Type name\n- `VNT_UDTMEM` - User-defined type member\n- `VNT_STRLIT` - String literal\n- `VNT_VISIBLE` - Visible name\n\n### Cleanup Name Flags (CN_*)\n- `CN_KEEP_TRAILING_DIGITS` - Keep trailing digits\n- `CN_KEEP_UNDERSCORES` - Keep underscores\n\n### Mangling Flags (MNG_*)\nExtensive demangling control: MNG_NOTYPE, MNG_NORETTYPE, MNG_NOBASEDT, MNG_NOCALLC, MNG_NOTHROW, MNG_SHORT_FORM, MNG_LONG_FORM, etc.\n\n### Calling Conventions (MT_*)\n- `MT_CDECL` / `MT_PASCAL` / `MT_STDCALL` / `MT_FASTCALL` / `MT_THISCALL` / `MT_VECTORCALL` / `MT_REGCALL` - Calling conventions\n- `MT_SYSCALL` / `MT_INTERRUPT` - Special conventions\n\n### Compilers (MT_*)\n- `MT_MSCOMP` - Microsoft compiler\n- `MT_BORLAN` - Borland compiler\n- `MT_WATCOM` - Watcom compiler\n- `MT_GNU` / `MT_GCC3` - GNU/GCC compilers\n- `MT_OTHER` - Other compiler\n\n## Classes\n\n### ea_name_t\nAddress-name pair.\n\n### ea_name_vec_t\nVector of ea_name_t.\n\n### NearestName\nNearest name helper class.\n\n## Constants\n\n- `MAXNAMELEN` - Maximum name length (including terminator)\n- `FUNC_IMPORT_PREFIX` - Import function prefix\n- `MANGLED_CODE` / `MANGLED_DATA` / `MANGLED_UNKNOWN` - Mangled name types\n- Various ignore flags: `ignore_none`, `ignore_regvar`, `ignore_llabel`, `ignore_stkvar`, `ignore_glabel`\n\n## See Also\nFull docs: skill/docs/ida_name.rst\n","skills/idapython/docs/ida_netnode.md":"# ida_netnode\n\nLow-priority: Low-level database storage using B-tree structures. Most reverse engineering tasks use higher-level abstractions instead.\n\n## Key Classes/Functions\n\n### netnode\nPersistent storage object in IDA database. Each netnode has unique ID and may have name, value, and multiple sparse arrays.\n\n- `exist(name)` - check if named netnode exists\n- `create()` - create new netnode\n- `kill()` - delete netnode\n- `get_name()` - retrieve netnode name\n- `rename(newname)` - change netnode name\n- `altval(idx, tag)` - read 32-bit value from altvals array\n- `altset(idx, val, tag)` - write 32-bit value to altvals array\n- `supval(idx, tag)` - read arbitrary-sized object from supvals array\n- `supset(idx, value, tag)` - write arbitrary-sized object to supvals array\n- `hashval(key, tag)` - read value from hash by string key\n- `hashset(key, value, tag)` - write value to hash by string key\n- `getblob(start, tag)` - read large object spanning multiple indexes\n- `setblob(buf, start, tag)` - write large object\n\nArrays use tags to organize data: 'A' for altvals, 'S' for supvals, 'H' for hashvals.\n\n## See Also\nFull docs: skill/docs/ida_netnode.rst\n","skills/idapython/docs/ida_offset.md":"# ida_offset\n\nMedium-priority: Convert operands to offset references and calculate target addresses. Useful when analyzing code that references data structures or global variables.\n\n## Key Functions\n\n- `op_offset_ex(ea, n, ri)` - convert operand to reference using refinfo_t\n- `op_offset(ea, n, ri)` - alias for op_offset_ex\n- `op_plain_offset(ea, n, base)` - convert operand to reference with default type\n- `get_offbase(ea, n)` - get offset base value for operand\n- `get_offset_expression(ea, n, from, offset, flags)` - format offset as \"name+displ\" string\n- `calc_offset_base(ea, n)` - calculate offset base from fixup/segment info\n- `calc_target(from, ea, n, opval)` - calculate target address from offset reference\n- `calc_basevalue(target, base)` - calculate reference base value\n- `can_be_off32(ea)` - check if address contains valid OFF32, return target or BADADDR\n\nOperand numbers may be ORed with OPND_OUTER for Motorola outer offsets.\n\n## See Also\nFull docs: skill/docs/ida_offset.rst\n","skills/idapython/docs/ida_pro.md":"# ida_pro\n\nMedium-priority: Core types, constants, and utility functions. Foundation module for platform detection and common operations.\n\n## Key Constants\n\n- `IDA_SDK_VERSION` - SDK version (9.2)\n- `MAXSTR` - maximum string size\n- `BADDIFF` - invalid diff value\n- `FMT_EA` / `FMT_64` / `FMT_Z` - format string macros\n- `CP_UTF8` / `CP_UTF16` - codepage constants\n- `ENC_UTF8` / `ENC_UTF16LE` / `ENC_WIN1252` - encoding constants\n\n## Key Vector Types\n\n- `intvec_t` / `uintvec_t` - int/uint vectors\n- `int64vec_t` / `uint64vec_t` - 64-bit int vectors\n- `boolvec_t` - boolean vector\n- `strvec_t` - string vector\n- `eavec_t` - ea_t vector\n- Standard methods: `push_back()`, `pop_back()`, `size()`, `at()`, `clear()`, `reserve()`, `find()`, `has()`, `add_unique()`\n\n## Key Functions\n\n- `qexit(code)` - shutdown IDA and exit\n- `extend_sign(v, nbytes, sign_extend)` - sign/zero extend value to 64 bits\n- `log2ceil(d64)` / `log2floor(d64)` - log2 calculations\n- `bitcountr_zero(x)` - count trailing zero bits\n- `is_main_thread()` - check if running on main thread\n- `get_physical_core_count()` / `get_logical_core_count()` - CPU core info\n\n## Platform Macros\n\nPreprocessor defines: `__NT__` (Windows), `__LINUX__`, `__MAC__`, `__EA64__` (64-bit addresses), `__X64__` / `__X86__`, `__ARM__`, `__PPC__`\n\n## See Also\nFull docs: skill/docs/ida_pro.rst\n","skills/idapython/docs/ida_problems.md":"# ida_problems\n\nLow-priority: Manage problem lists for tracking analysis issues. IDA maintains these lists automatically; mainly used for debugging analysis failures.\n\n## Key Functions\n\n- `remember_problem(type, ea, msg)` - add address to problem list with optional message\n- `get_problem(type, lowea)` - get next problem address >= lowea\n- `forget_problem(type, ea)` - remove address from problem list\n- `is_problem_present(type, ea)` - check if address is in problem list\n- `get_problem_desc(type, ea)` - get human-readable problem description\n- `get_problem_name(type, longname)` - get problem list name\n\n## Problem List Types\n\n- `PR_DISASM` - can't disassemble\n- `PR_HEAD` - already head\n- `PR_ILLADDR` - execution flows beyond limits\n- `PR_BADSTACK` - failed to trace stack pointer\n- `PR_NOXREFS` - can't find references\n- `PR_NOBASE` - can't find offset base\n- `PR_ATTN` - attention, probably erroneous\n- `PR_FINAL` - IDA decision to convert to instruction/data\n- `PR_ROLLED` - IDA decision was wrong and rolled back\n- `PR_COLLISION` - FLAIR collision\n- `PR_DECIMP` - FLAIR match indecision\n\nView problems from View → Subviews → Problems menu.\n\n## See Also\nFull docs: skill/docs/ida_problems.rst\n","skills/idapython/docs/ida_range.md":"# ida_range\n\nMedium-priority: Manage continuous address ranges and sets of ranges. Commonly used for working with functions, segments, and custom address groups.\n\n## Key Classes\n\n### range_t\nContinuous address range [start_ea, end_ea), end excluded.\n\n- `range_t(ea1, ea2)` - constructor\n- `start_ea` / `end_ea` - range boundaries (end_ea excluded)\n- `contains(ea)` / `contains(range)` - check if address/range is inside\n- `overlaps(range)` - check if ranges have common addresses\n- `size()` - return end_ea - start_ea\n- `empty()` - check if size <= 0\n- `intersect(range)` - set to intersection with another range\n- `extend(ea)` - extend range to include address\n- `clear()` - set both start_ea and end_ea to 0\n- `compare(range)` - compare based on start_ea\n\n### rangeset_t\nSet of non-overlapping ranges, stored sorted.\n\n- `add(range)` / `add(start, end)` / `add(rangeset)` - add range(s), merging overlaps\n- `sub(range)` / `sub(ea)` / `sub(rangeset)` - subtract range(s), splitting as needed\n- `contains(ea)` / `contains(rangeset)` - check membership\n- `includes(range)` - check if every ea in range is in set\n- `has_common(range)` / `has_common(rangeset)` - check overlap\n- `intersect(rangeset)` - set to intersection\n- `find_range(ea)` - get range containing ea, or nullptr\n- `nranges()` - number of ranges in set\n- `getrange(idx)` - get range by index\n- `next_addr(ea)` / `prev_addr(ea)` - navigate within ranges\n- `next_range(ea)` / `prev_range(ea)` - navigate between ranges\n- `is_equal(rangeset)` / `is_subset_of(rangeset)` - set comparisons\n- `clear()` / `empty()` - management\n\n### rangevec_t\nVector of range_t (standard vector methods).\n\n## Range Kind Constants\n\n- `RANGE_KIND_FUNC` - function ranges\n- `RANGE_KIND_SEGMENT` - segment ranges\n- `RANGE_KIND_HIDDEN_RANGE` - hidden ranges\n- `RANGE_KIND_UNKNOWN` - unknown type\n\n## See Also\nFull docs: skill/docs/ida_range.rst\n","skills/idapython/docs/ida_regfinder.md":"# ida_regfinder\n\nHigh-priority: Track register values backwards through code execution. Critical for understanding function arguments, constants loaded into registers, and stack pointer calculations.\n\n## Key Functions\n\n- `find_reg_value(ea, reg)` - find constant value in register at address\n- `find_sp_value(ea, reg)` - find stack pointer delta at address\n- `find_reg_value_info(rvi, ea, reg, max_depth)` - find register value with detailed tracking info\n- `find_nearest_rvi(rvi, ea, regs)` - find value of either of two registers\n- `invalidate_regfinder_cache(from, to, cref)` - update cache after control flow change\n- `invalidate_regfinder_xrefs_cache(to, dref)` - update cache after data reference change\n\nReturns: 1 if value found, 0 if varying/insufficient depth, -1 if not supported.\n\n## Key Classes\n\n### reg_value_info_t\nDetailed register value tracking result.\n\n**State checks:**\n- `is_num()` / `is_spd()` - value is constant / stack-pointer-relative\n- `is_known()` - value is num or spd\n- `is_unknown()` - value could not be determined\n- `is_dead_end()` / `aborted()` - tracking stopped\n- `is_unkloop()` / `is_unkxref()` / `is_unkvals()` / `is_unkmult()` - specific failure reasons\n- `is_value_unique()` - single value vs multiple possibilities\n\n**Value extraction:**\n- `get_num()` - get constant value\n- `get_spd()` - get SP delta\n- `get_def_ea()` - where value was defined\n- `get_def_itype()` - instruction type that defined value\n\n**Arithmetic operations (all take insn parameter):**\n- `add(r, insn)` / `sub(r, insn)` - arithmetic\n- `bor(r, insn)` / `band(r, insn)` / `bxor(r, insn)` / `bandnot(r, insn)` - bitwise\n- `sll(r, insn)` / `slr(r, insn)` / `sar(r, insn)` - shifts\n- `neg(insn)` / `bnot(insn)` - unary\n- `add_num(r)` / `shift_left(r)` / `shift_right(r)` - without changing def_ea\n\n**Factory methods:**\n- `make_num(val, insn/ea, flags)` - create constant value\n- `make_initial_sp(func_ea)` - create initial stack pointer\n- `make_unkloop(ea)` / `make_unkmult(ea)` / etc - create failure states\n\n**Flags (for PC_BASED / LIKE_GOT annotations):**\n- `is_all_vals_pc_based()` / `is_any_vals_pc_based()`\n- `is_all_vals_like_got()` / `is_any_vals_like_got()`\n- `set_all_vals_pc_based()` / `set_all_vals_got_based()`\n\n### reg_value_def_t\nSingle value definition.\n\n- `val` - the value (uint64)\n- `def_ea` - instruction address where defined\n- `def_itype` - instruction code (processor-specific)\n- `flags` - SHORT_INSN, PC_BASED, LIKE_GOT\n- `is_short_insn()` / `is_pc_based()` / `is_like_got()` - flag checks\n- `dstr(how, pm)` - format as string (NOVAL/UVAL/SPVAL/ABORTED)\n\n## Configuration\n\nUses ida.cfg values: `REGTRACK_MAX_DEPTH`, `REGTRACK_FUNC_MAX_DEPTH` for search limits.\n\n## See Also\nFull docs: skill/docs/ida_regfinder.rst\n","skills/idapython/docs/ida_registry.md":"# ida_registry\n\nRegistry-based persistent configuration storage (Windows registry or ~/.idapro/ida.reg on Unix).\n\n## Key Functions\n\n### Configuration Storage\n- `reg_read_string(name, subkey=None, _def=None)` - Read string value\n- `reg_write_string(name, utf8, subkey=None)` - Write string value\n- `reg_read_int(name, defval, subkey=None)` - Read integer value\n- `reg_write_int(name, value, subkey=None)` - Write integer value\n- `reg_read_bool(name, defval, subkey=None)` - Read boolean value\n- `reg_write_bool(name, value, subkey=None)` - Write boolean value\n- `reg_read_binary(name, subkey=None)` - Read binary data\n- `reg_write_binary(name, py_bytes, subkey=None)` - Write binary data\n\n### List Operations\n- `reg_read_strlist(subkey)` - Get all string values under key\n- `reg_write_strlist(items, subkey)` - Write list of strings\n- `reg_update_strlist(subkey, add, maxrecs, rem=None, ignorecase=False)` - Add/remove items with trimming\n- `reg_update_filestrlist(subkey, add, maxrecs, rem=None)` - Update file list (OS-specific case sensitivity)\n\n### Key/Value Management\n- `reg_exists(name, subkey=None)` - Check if value exists\n- `reg_subkey_exists(name)` - Check if key exists\n- `reg_delete(name, subkey=None)` - Delete value\n- `reg_delete_subkey(name)` - Delete key\n- `reg_delete_tree(name)` - Delete subtree recursively\n- `reg_subkey_subkeys(name)` - Get all subkey names\n- `reg_subkey_values(name)` - Get all value names\n- `reg_data_type(name, subkey=None)` - Get value type (reg_unknown/reg_sz/reg_binary/reg_dword)\n\n## Constants\n\n- `ROOT_KEY_NAME` - Default key for IDA settings\n- `reg_sz` - UTF-8 string type\n- `reg_binary` - Binary data type\n- `reg_dword` - 32-bit number type\n\n## See Also\nFull docs: skill/docs/ida_registry.rst\n","skills/idapython/docs/ida_search.md":"# ida_search\n\nMiddle-level search functions for finding specific byte patterns, instructions, and code/data.\n\n## Key Functions\n\n### Search Functions\n- `find_unknown(ea, sflag)` - Find undefined bytes\n- `find_defined(ea, sflag)` - Find defined bytes (code/data)\n- `find_code(ea, sflag)` - Find code (instructions)\n- `find_data(ea, sflag)` - Find data items\n- `find_not_func(ea, sflag)` - Find bytes outside functions\n- `find_imm(ea, sflag, search_value)` - Find immediate value in instructions\n- `find_text(start_ea, y, x, ustr, sflag)` - Text search in disassembly/decompilation\n- `find_reg_access(out, start_ea, end_ea, regname, sflag)` - Find register read/write\n\n### Helper\n- `search_down(sflag)` - Check if SEARCH_DOWN bit is set\n\n## Search Flags\n\n### Direction\n- `SEARCH_UP` - Search towards lower addresses\n- `SEARCH_DOWN` - Search towards higher addresses\n- `SEARCH_NEXT` - Skip starting address\n\n### Options\n- `SEARCH_CASE` - Case-sensitive search\n- `SEARCH_REGEX` - Regular expressions (text search only)\n- `SEARCH_IDENT` - Search for identifier (bounded by non-visible chars)\n- `SEARCH_NOBRK` - Don't test for user cancellation\n- `SEARCH_NOSHOW` - Don't display progress\n- `SEARCH_BRK` - Return BADADDR if cancelled\n- `SEARCH_USESEL` - Limit search to UI selection\n\n### Register Access\n- `SEARCH_USE` - Find register reads\n- `SEARCH_DEF` - Find register writes\n\n## See Also\nFull docs: skill/docs/ida_search.rst\n","skills/idapython/docs/ida_segment.md":"# ida_segment\n\nSegment management (memory regions with addressing modes, permissions, and types).\n\n## Key Classes\n\n### segment_t\nCore segment structure (inherits from range_t).\n\n**Address Range:**\n- `start_ea` - Start address (included)\n- `end_ea` - End address (excluded)\n\n**Addressing:**\n- `bitness` - 0=16-bit, 1=32-bit, 2=64-bit\n- `is_16bit()`, `is_32bit()`, `is_64bit()` - Check addressing mode\n- `abits()`, `abytes()` - Get address bits/bytes\n- `set_segm_addressing(s, bitness)` - Change addressing (deletes instructions/data)\n\n**Attributes:**\n- `sel` - Segment selector (must be unique)\n- `type` - Segment type (SEG_CODE/SEG_DATA/SEG_BSS/SEG_XTRN/etc)\n- `perm` - Permissions (SEGPERM_READ/WRITE/EXEC)\n- `align` - Alignment (saRelByte/saRelWord/saRelPara/etc)\n- `comb` - Combination (scPriv/scPub/scStack/scCommon)\n- `color` - Segment color\n- `defsr[16]` - Default segment register values\n\n**Methods:**\n- `update()` - Commit segment changes to database\n\n## Key Functions\n\n### Segment Lookup\n- `get_segm_qty()` - Get number of segments\n- `getseg(ea)` - Get segment containing address\n- `getnseg(n)` - Get segment by index (0..qty-1)\n- `get_segm_num(ea)` - Get segment index by address\n- `get_segm_by_name(name)` - Get segment by name\n- `get_segm_by_sel(selector)` - Get segment by selector\n- `get_first_seg()`, `get_last_seg()` - Get first/last segment\n- `get_next_seg(ea)`, `get_prev_seg(ea)` - Get adjacent segments\n\n### Creating/Deleting\n- `add_segm(para, start, end, name, sclass, flags=0)` - Add segment (allocates selector)\n- `add_segm_ex(s, name, sclass, flags)` - Add segment (selector pre-allocated)\n- `del_segm(ea, flags)` - Delete segment\n\n### Modifying Bounds\n- `set_segm_start(ea, newstart, flags)` - Change start (trims previous)\n- `set_segm_end(ea, newend, flags)` - Change end (trims next)\n- `move_segm_start(ea, newstart, mode)` - Change start (may expand previous)\n- `move_segm(s, to, flags=0)` - Move entire segment (fixes relocations)\n- `rebase_program(delta, flags)` - Rebase all segments\n\n### Properties\n- `get_segm_name(s, flags=0)` - Get name\n- `set_segm_name(s, name, flags=0)` - Set name\n- `get_segm_class(s)`, `set_segm_class(s, sclass, flags=0)` - Get/set class\n- `get_segment_cmt(s, repeatable)`, `set_segment_cmt(s, cmt, repeatable)` - Get/set comment\n- `segtype(ea)` - Get segment type at address\n- `get_segm_base(s)` - Get base linear address\n- `get_segm_para(s)` - Get base paragraph\n- `set_segm_base(s, newbase)` - Set base (internal)\n\n### Selectors\n- `setup_selector(segbase)` - Allocate selector if needed\n- `allocate_selector(segbase)` - Unconditionally allocate selector\n- `find_free_selector()` - Find unused selector (>=1)\n- `set_selector(selector, paragraph)` - Map selector to paragraph\n- `del_selector(selector)` - Delete selector mapping\n- `sel2para(selector)`, `sel2ea(selector)` - Get selector mapping\n- `find_selector(base)` - Find selector by paragraph\n\n### Visibility/Locking\n- `is_visible_segm(s)`, `set_visible_segm(s, visible)` - Hide/show segment\n- `is_spec_segm(seg_type)`, `is_spec_ea(ea)` - Check special types\n- `lock_segm(segm, lock)`, `is_segm_locked(segm)` - Lock pointer (prevents deletion/move)\n\n### Debugger Integration\n- `change_segment_status(s, is_deb_segm)` - Convert debugger/regular segment\n- `take_memory_snapshot(type)` - Snapshot running process (SNAP_ALL_SEG/SNAP_LOAD_SEG/SNAP_CUR_SEG)\n- `is_miniidb()` - Check if IDB is debugger-created\n\n### Segment Groups (OMF)\n- `set_group_selector(grp, sel)` - Create segment group\n- `get_group_selector(grpsel)` - Get group's common selector\n\n### Segment Translations\n- `add_segment_translation(segstart, mappedseg)` - Add overlay mapping\n- `del_segment_translations(segstart)` - Delete translation list\n- `get_segment_translations(transmap, segstart)` - Get translation list\n- `set_segment_translations(segstart, transmap)` - Set translation list\n\n## Segment Types\n\n- `SEG_NORM` - Normal segment (no assumptions)\n- `SEG_CODE` - Code segment\n- `SEG_DATA` - Data segment\n- `SEG_BSS` - Uninitialized data\n- `SEG_XTRN` - External definitions (no instructions)\n- `SEG_GRP` - Segment group\n- `SEG_NULL` - Zero-length segment\n- `SEG_ABSSYM` - Absolute symbols\n- `SEG_COMM` - Communal definitions\n- `SEG_IMEM` - Internal processor memory/SFRs\n\n## Add Segment Flags\n\n- `ADDSEG_NOSREG` - Set default sregs to BADSEL\n- `ADDSEG_OR_DIE` - qexit() on failure\n- `ADDSEG_NOTRUNC` - Destroy/truncate old segments instead\n- `ADDSEG_QUIET` - Silent mode\n- `ADDSEG_FILLGAP` - Fill gap with previous segment\n- `ADDSEG_SPARSE` - Use sparse storage\n- `ADDSEG_NOAA` - Don't mark for auto-analysis\n- `ADDSEG_IDBENC` - Name/class in IDB encoding\n\n## Segment Modification Flags\n\n- `SEGMOD_KILL` - Disable addresses when shrinking\n- `SEGMOD_KEEP` - Keep code/data\n- `SEGMOD_SILENT` - Silent mode\n- `SEGMOD_KEEPSEL` - Don't delete unused selector\n- `SEGMOD_NOMOVE` - Don't move info when changing start\n- `SEGMOD_SPARSE` - Use sparse storage when extending\n\n## See Also\nFull docs: skill/docs/ida_segment.rst\n","skills/idapython/docs/ida_segregs.md":"# ida_segregs\n\nSegment register management for architectures with segmented memory (x86/x86-64).\n\n## Key Classes\n\n### sreg_range_t\nSegment register value range (inherits from range_t).\n- `val` - Segment register value (sel_t)\n- `tag` - Range tag (SR_inherit/SR_user/SR_auto/SR_autostart)\n\n## Key Functions\n\n### Reading Values\n- `get_sreg(ea, rg)` - Get segment register value at address (uses ranges + segment defaults)\n\n### Setting Values\n- `split_sreg_range(ea, rg, v, tag, silent=False)` - Create new range at address\n- `set_default_sreg_value(sg, rg, value)` - Set default for segment (or all segments if sg=None)\n- `set_default_dataseg(ds_sel)` - Set DS default for all segments\n- `set_sreg_at_next_code(ea1, ea2, rg, value)` - Set value at next instruction only\n\n### Range Queries\n- `get_sreg_range(out, ea, rg)` - Get range containing address\n- `get_prev_sreg_range(out, ea, rg)` - Get previous range\n- `get_sreg_ranges_qty(rg)` - Get number of ranges\n- `getn_sreg_range(out, rg, n)` - Get range by index\n- `get_sreg_range_num(ea, rg)` - Get range index by address\n\n### Range Management\n- `del_sreg_range(ea, rg)` - Delete range (extends previous, can't delete segment start)\n- `copy_sreg_ranges(dst_rg, src_rg, map_selector=False)` - Duplicate ranges\n\n## Segment Register Constants\n\n### x86/x86-64 Registers\n- `R_es` - Extra segment\n- `R_cs` - Code segment\n- `R_ss` - Stack segment\n- `R_ds` - Data segment\n- `R_fs` - FS segment\n- `R_gs` - GS segment\n\n### Range Tags\n- `SR_inherit` - Value inherited from previous range\n- `SR_user` - User-specified value\n- `SR_auto` - IDA-determined value\n- `SR_autostart` - Used as SR_auto at segment start\n\n## Usage Notes\n\nFor non-segmented architectures, define two virtual segment registers (CS/DS) and set processor_t::reg_code_sreg and processor_t::reg_data_sreg.\n\n## See Also\nFull docs: skill/docs/ida_segregs.rst\n","skills/idapython/docs/ida_srclang.md":"# ida_srclang\n\nThird-party compiler support for parsing type declarations from C/C++/Objective-C source.\n\n## Key Functions\n\n### Parser Selection\n- `select_parser_by_name(name)` - Set parser by name (None/\"\" for default)\n- `select_parser_by_srclang(lang)` - Set parser supporting language(s)\n- `get_selected_parser_name()` - Get current parser name\n\n### Type Declaration Parsing\n- `parse_decls_for_srclang(lang, til, input, is_path)` - Parse with language auto-detection\n- `parse_decls_with_parser(parser_name, til, input, is_path)` - Parse with specific parser\n- `parse_decls_with_parser_ext(parser_name, til, input, hti_flags)` - Parse with formatting flags\n\n**Parameters:**\n- `lang/parser_name` - Source language or parser name\n- `til` - Type library to store parsed types\n- `input` - File path or declaration string\n- `is_path` - True if input is path, False if in-memory snippet\n\n**Returns:**\n- -1: No parser found\n- -2: Operation not supported (set_parser_argv)\n- >=0: Number of parse errors\n\n### Parser Configuration\n- `set_parser_argv(parser_name, argv)` - Set command-line arguments\n- `get_parser_option(parser_name, option_name)` - Get parser option\n- `set_parser_option(parser_name, option_name, option_value)` - Set parser option\n\n## Source Languages\n\n- `SRCLANG_C` - C\n- `SRCLANG_CPP` - C++\n- `SRCLANG_OBJC` - Objective-C\n- `SRCLANG_SWIFT` - Swift (not supported yet)\n- `SRCLANG_GO` - Golang (not supported yet)\n\n## See Also\nFull docs: skill/docs/ida_srclang.rst\n","skills/idapython/docs/ida_strlist.md":"# ida_strlist\n\nString list management (cached view of all strings in the database).\n\n## Key Classes\n\n### string_info_t\nString list entry.\n- `ea` - String address\n- `length` - String length\n- `type` - String type\n\n### strwinsetup_t\nString list configuration.\n- `minlen` - Minimum string length\n- `display_only_existing_strings` - Only show defined strings\n- `only_7bit` - ASCII-only strings\n- `ignore_heads` - Include strings at non-head addresses\n- `strtypes` - Enabled string types\n\n## Key Functions\n\n- `build_strlist()` - Rebuild string list (expensive, call when needed)\n- `clear_strlist()` - Clear string list\n- `get_strlist_qty()` - Get number of strings (loads from DB or builds)\n- `get_strlist_item(si, n)` - Get nth string (0..qty-1)\n- `get_strlist_options()` - Get static configuration\n\n## Usage Notes\n\nThe kernel does NOT auto-update the string list (performance). Users must call build_strlist() for up-to-date results. If not cleared, the list persists in the database across sessions.\n\n## See Also\nFull docs: skill/docs/ida_strlist.rst\n","skills/idapython/docs/ida_tryblks.md":"# ida_tryblks\n\nException handling (try/catch/SEH) information for binary code analysis.\n\n## Key Classes\n\n### tryblk_t\nRepresents an exception try block with associated catch/finally handlers.\n- `get_kind()` - Check if SEH or C++ try block\n- `is_seh()` / `is_cpp()` - Identify exception handling type\n- `seh()` - Get SEH handler info (filter + landing pad)\n- `cpp()` - Get C++ catch handlers vector\n- `level` - Nesting level (auto-calculated)\n\n### catch_t / seh_t\nHandler information for C++ catch blocks and SEH (Structured Exception Handling).\n- `obj` - Exception object offset (C++)\n- `type_id` - Caught exception type ID\n- `filter` - SEH filter function range\n- `seh_code` - SEH exception code address\n\n## Key Functions\n\n### get_tryblks(tbv, range)\nRetrieve all try blocks in address range, sorted and with nesting calculated.\n\n### add_tryblk(tb)\nAdd try block information. Returns error code (TBERR_OK = success).\n\n### del_tryblks(range)\nDelete all try block information in range.\n\n### find_syseh(ea)\nFind start address of system exception handler region containing address.\n\n### is_ea_tryblks(ea, flags)\nCheck if address is part of try/catch/filter (use TBEA_TRY, TBEA_CATCH, TBEA_SEHTRY, etc flags).\n\n## Error Codes\n\n- `TBERR_OK` - Success\n- `TBERR_START/END/ORDER` - Invalid address bounds\n- `TBERR_INTERSECT` - Try block would intersect inner block\n- `TBERR_NO_CATCHES` - No catch handlers defined\n\n## See Also\nFull docs: skill/docs/ida_tryblks.rst\n","skills/idapython/docs/ida_typeinf.md":"# ida_typeinf\n\nType information manipulation in IDA - the foundation for working with structures, enums, function prototypes, and all type data.\n\n## Core Concepts\n\n**tinfo_t** objects represent types. They can be:\n- **Detached**: Created without a type library, temporary\n- **Attached**: Stored in a til_t (type info library), persistent\n\n**Key terms**:\n- **udt**: User-defined type (struct/union, not enum)\n- **udm**: UDT member (struct/union field)\n- **edm**: Enum member (enumerator)\n- **til_t**: Type info library (serialized type storage)\n\n## Essential Classes\n\n### tinfo_t\nThe fundamental type representation object.\n\n#### Creation\n- `tinfo_t()` - Empty type\n- `tinfo_t(BT_INT)` - Simple type from base type\n- `tinfo_t(\"const char **\")` - Parse C declaration\n- `get_named_type(til, \"struct_name\")` - Load from library\n- `create_func(func_type_data_t)` - Build function prototype\n- `create_ptr(target_type)` - Build pointer type\n\n#### Inspection\n- `get_size()` - Type size in bytes\n- `is_ptr()` / `is_func()` / `is_struct()` / `is_array()` - Type checks\n- `is_const()` / `is_volatile()` - Qualifier checks\n- `get_pointed_object()` - Dereference pointer\n- `get_realtype()` - Resolve typedefs\n- `print_tinfo(prefix, indent, flags)` - Format as C code\n\n#### Decomposition\n- `get_func_details(ftd)` - Extract function prototype to func_type_data_t\n- `get_udt_details(udt)` - Extract struct/union to udt_type_data_t\n- `get_enum_details(etd)` - Extract enum to enum_type_data_t\n- `get_array_details(arr)` - Extract array to array_type_data_t\n- `get_ptr_details(ptr)` - Extract pointer to ptr_type_data_t\n\n#### Modification\n- `create_typedef(til, name)` - Create typedef alias\n- `add_udm(name, type_str)` - Add field to attached struct\n- `set_numbered_type(til, ordinal, flags, name)` - Store in library\n\n### func_type_data_t\nFunction prototype representation (return type + arguments).\n- `rettype` - tinfo_t of return value\n- `[i]` / `size()` - Access funcarg_t arguments by index\n- `push_back(funcarg)` - Add parameter\n- `cc` - Calling convention (CM_CC_CDECL, CM_CC_STDCALL, etc)\n- `flags` - Function attributes (FTI_NORET, FTI_PURE, FTI_VIRTUAL, etc)\n\n### funcarg_t\nFunction parameter representation.\n- `name` - Parameter name\n- `type` - tinfo_t of parameter type\n- `argloc` - Physical location (register/stack)\n\n### udt_type_data_t\nStruct/union field collection (vector of udm_t).\n- `[i]` / `size()` - Access udm_t members by index\n- `push_back(udm)` - Add field\n- `find_member(name)` - Locate field by name\n- `get_best_fit_member(offset)` - Find field at offset\n- `total_size` - Struct size in bytes\n- `is_union` - True if union, false if struct\n- `taudt_bits` - Alignment flags\n\n### udm_t\nSingle struct/union field.\n- `name` - Field name\n- `type` - tinfo_t of field type\n- `offset` - Byte offset (0 for unions)\n- `size` - Field size in bytes\n- `cmt` / `rptcmt` - Comments\n\n### enum_type_data_t\nEnumeration representation (vector of edm_t).\n- `[i]` / `size()` - Access edm_t members by index\n- `push_back(edm)` - Add enumerator\n- `bte` - Storage size flags\n- `taenum_bits` - Display format (hex/dec/oct/bin)\n\n### edm_t\nSingle enum member.\n- `name` - Enumerator name\n- `value` - Numeric value\n\n### til_t\nType info library (persistent storage).\n- `get_named_type(name)` - Load type by name\n- `get_numbered_type(ordinal)` - Load type by ordinal number\n- `import_type(src)` - Import type from another til\n- `named_types()` / `numbered_types()` - Iterate all types\n- `cc` - Compiler info (calling conventions, sizes)\n\n## Key Functions\n\n### Type Library Management\n\n#### get_idati()\nGet the local type library (IDB's \"Local Types\").\n\n#### add_til(name, flags)\nAdd base type library (e.g., \"mssdk64_win7\" for Windows types).\n\n#### load_til(name, tildir)\nLoad til file without adding to IDB.\n\n### Type Application\n\n#### apply_tinfo(ea, tinfo, flags)\nApply type to address (function/data). Flags: TINFO_DEFINITE (override), TINFO_GUESSED (suggestion).\n\n#### apply_cdecl(til, ea, decl)\nParse C declaration and apply to address.\n\n#### guess_tinfo(ea)\nAuto-analyze and infer type at address.\n\n### Type Creation\n\n#### parse_decl(til, decl, flags)\nParse C declaration string into tinfo_t. Returns (tinfo, name) tuple.\n\n#### create_typedef(til, name)\nCreate typedef for existing type.\n\n### Type Queries\n\n#### get_tinfo(ea)\nRetrieve type applied to address.\n\n#### print_type(ea, flags)\nFormat type as C declaration string.\n\n#### get_named_type(til, name)\nLoad type from library by name.\n\n### Type Comparison\n\n#### compare_tinfo(t1, t2, flags)\nCheck type compatibility. Flags: TCMP_EQUAL (exact), TCMP_MANCAST (manual cast allowed), etc.\n\n## Base Type Constants\n\n### Integers\n- `BT_INT8` / `BT_INT16` / `BT_INT32` / `BT_INT64` / `BT_INT128`\n- Combined with: `BTMT_SIGNED`, `BTMT_UNSIGNED`, `BTMT_CHAR`\n- Shortcuts: `BTF_INT8`, `BTF_UINT8`, `BTF_CHAR`, `BTF_UCHAR`, etc.\n\n### Floating Point\n- `BT_FLOAT` - 4/8/10 byte float (use with BTMT_FLOAT/DOUBLE/LNGDBL)\n- Shortcuts: `BTF_FLOAT`, `BTF_DOUBLE`, `BTF_LDOUBLE`, `BTF_TBYTE`\n\n### Complex Types\n- `BT_PTR` - Pointer (use with BTMT_NEAR/FAR/CLOSURE)\n- `BT_ARRAY` - Array\n- `BT_FUNC` - Function\n- `BT_COMPLEX` - Struct/union/enum/typedef (use with BTMT_STRUCT/UNION/ENUM/TYPEDEF)\n- `BT_BITFIELD` - Bitfield (struct member only)\n\n### Special\n- `BT_VOID` - void type\n- `BT_BOOL` - bool type\n- `BT_UNK` - Unknown type\n\n## Type Modifiers\n\n- `BTM_CONST` - const qualifier\n- `BTM_VOLATILE` - volatile qualifier\n\n## Calling Conventions\n\n- `CM_CC_INVALID` / `CM_CC_UNKNOWN`\n- `CM_CC_CDECL` - C declaration (caller cleans stack)\n- `CM_CC_STDCALL` - Standard call (callee cleans)\n- `CM_CC_FASTCALL` - Fast call (register args)\n- `CM_CC_THISCALL` - C++ member (ecx/rcx = this)\n- `CM_CC_PASCAL` - Pascal (right-to-left)\n- `CM_CC_SWIFT` - Swift ABI\n- `CM_CC_GOLANG` - Go ABI\n\n## Flags\n\n### Type Application (apply_tinfo)\n- `TINFO_GUESSED` - Suggested type (user can override)\n- `TINFO_DEFINITE` - Force type (overwrite existing)\n- `TINFO_DELAYFUNC` - Delay function analysis\n\n### Parsing (parse_decl)\n- `PT_SIL` - Silent (no error messages)\n- `PT_TYP` - Parse type only (no name)\n- `PT_VAR` - Parse variable (type + name)\n- `PT_REPLACE` - Replace existing type\n\n### Printing (print_tinfo)\n- `PRTYPE_1LINE` - Single line output\n- `PRTYPE_MULTI` - Multiple lines\n- `PRTYPE_TYPE` - Type only (no name)\n- `PRTYPE_DEF` - Include typedef keyword\n\n## Common Patterns\n\n### Create Function Prototype\n```python\n# int func(const char *str, int count)\nftd = ida_typeinf.func_type_data_t()\nftd.rettype = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\n\narg1 = ida_typeinf.funcarg_t()\narg1.name = \"str\"\narg1.type = ida_typeinf.tinfo_t(\"const char *\")\nftd.push_back(arg1)\n\narg2 = ida_typeinf.funcarg_t()\narg2.name = \"count\"\narg2.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\nftd.push_back(arg2)\n\ntif = ida_typeinf.tinfo_t()\ntif.create_func(ftd)\nida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)\n```\n\n### Create Structure\n```python\nudt = ida_typeinf.udt_type_data_t()\nudt.is_union = False\n\n# Add field: int x\nm1 = ida_typeinf.udm_t()\nm1.name = \"x\"\nm1.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\nm1.offset = 0\nm1.size = 4\nudt.push_back(m1)\n\ntif = ida_typeinf.tinfo_t()\ntif.create_udt(udt, ida_typeinf.BTF_STRUCT)\ntif.set_numbered_type(ida_typeinf.get_idati(), 0,\n    ida_typeinf.NTF_REPLACE, \"MyStruct\")\n```\n\n### Inspect Function Type\n```python\ntif = ida_typeinf.tinfo_t()\nif ida_typeinf.get_tinfo(tif, ea):\n    if tif.is_func():\n        ftd = ida_typeinf.func_type_data_t()\n        tif.get_func_details(ftd)\n        print(f\"Return: {ftd.rettype}\")\n        for i in range(ftd.size()):\n            arg = ftd[i]\n            print(f\"Arg {i}: {arg.name} : {arg.type}\")\n```\n\n## See Also\nFull docs: skill/docs/ida_typeinf.rst\nIDA Domain API: https://ida-domain.docs.hex-rays.com/ (simplified type operations)\n","skills/idapython/docs/ida_ua.md":"# ida_ua\n\nInstruction disassembly, operand decoding, and instruction analysis.\n\n## Key Classes\n\n### insn_t\nDecoded instruction with full operand details.\n- Access via: `idaapi.insn_t()` or `idautils.DecodeInstruction(ea)`\n- Contains array of up to 8 `op_t` operands\n\n### op_t\nSingle instruction operand representation.\n- `type` - Operand type (o_reg, o_mem, o_imm, o_displ, etc)\n- `dtype` - Data type (dt_byte, dt_word, dt_dword, dt_qword, etc)\n- `reg` - Register number (for o_reg)\n- `addr` - Memory address (for o_mem, o_displ, o_near, o_far)\n- `value` - Immediate value (for o_imm) or displacement\n- `phrase` - Register phrase number (for o_phrase, o_displ)\n- `shown()` - Check if operand should be displayed\n- `is_reg(r)` / `is_imm(v)` - Type checks\n\n## Operand Types\n\n- `o_void` - No operand\n- `o_reg` - Register (al, rax, xmm0, etc)\n- `o_mem` - Direct memory `[0x401000]`\n- `o_phrase` - Register indirect `[rax]`, `[rsi+rdi*4]`\n- `o_displ` - Register + displacement `[rbp+var_10]`\n- `o_imm` - Immediate constant `42`, `0x1000`\n- `o_near` / `o_far` - Code reference (branch/call target)\n- `o_idpspec0-5` - Processor-specific types\n\n## Data Types (dtype)\n\n- `dt_byte` (8), `dt_word` (16), `dt_dword` (32), `dt_qword` (64)\n- `dt_byte16` (128), `dt_byte32` (256), `dt_byte64` (512)\n- `dt_float`, `dt_double`, `dt_ldbl`, `dt_tbyte`\n\n## Key Functions\n\n### create_insn(ea)\nAnalyze and create instruction at address (updates IDB).\n\n### decode_insn(insn, ea)\nDecode instruction into insn_t object (read-only, no IDB changes).\n\n### decode_prev_insn(insn, ea)\nDecode instruction before given address.\n\n### print_insn_mnem(ea)\nGet instruction mnemonic string.\n\n### print_operand(ea, n)\nGet operand text representation (operand index n).\n\n### get_dtype_size(dtype)\nGet size in bytes for data type.\n\n### get_dtype_by_size(size)\nGet appropriate dtype for byte size.\n\n## Usage Pattern\n\n```python\ninsn = idaapi.insn_t()\nif idaapi.decode_insn(insn, ea) > 0:\n    for op in insn.ops:\n        if op.type == idaapi.o_void:\n            break  # No more operands\n        if op.type == idaapi.o_reg:\n            print(f\"Register: {op.reg}\")\n        elif op.type == idaapi.o_imm:\n            print(f\"Immediate: {op.value:#x}\")\n```\n\n## See Also\nFull docs: skill/docs/ida_ua.rst\n","skills/idapython/docs/ida_undo.md":"# ida_undo\n\nDatabase undo/redo operations for IDA changes.\n\n## Key Functions\n\n### create_undo_point(bytes, size)\nCreate restore point. User can undo to this point later. Returns False if undo disabled.\n\n### perform_undo()\nUndo last action. Returns True on success.\n\n### perform_redo()\nRedo previously undone action. Returns True on success.\n\n### get_undo_action_label()\nGet description of action that will be undone (for UI display).\n\n### get_redo_action_label()\nGet description of action that will be redone (for UI display).\n\n## Usage\n\nRarely needed in plugins - IDA automatically creates undo points for most operations. Use `create_undo_point()` only for custom atomic operations requiring explicit undo boundaries.\n\n## See Also\nFull docs: skill/docs/ida_undo.rst\n","skills/idapython/docs/ida_xref.md":"# ida_xref\n\nCross-reference (xref) tracking between code and data locations.\n\n## Key Classes\n\n### xrefblk_t\nIterator for traversing cross-references efficiently.\n- `first_from(ea, flags)` / `next_from()` - Iterate xrefs FROM address\n- `first_to(ea, flags)` / `next_to()` - Iterate xrefs TO address\n- `frm` / `to` - Source and target addresses\n- `type` - Reference type (cref_t or dref_t)\n- `iscode` - True if code reference, false if data\n- `user` - User-defined (won't be deleted by IDA)\n\nIterator helpers:\n- `crefs_from(ea)` / `crefs_to(ea)` - Code references including flow\n- `fcrefs_from(ea)` / `fcrefs_to(ea)` - Code references (no flow)\n- `drefs_from(ea)` / `drefs_to(ea)` - Data references\n\n## Key Functions\n\n### add_cref(frm, to, type) / add_dref(frm, to, type)\nCreate code or data cross-reference.\n\n### del_cref(frm, to, expand) / del_dref(frm, to)\nDelete cross-reference (expand=1 deletes target if no more refs).\n\n### get_first_cref_from(frm) / get_next_cref_from(frm, current)\nLegacy API for iterating code xrefs FROM address.\n\n### get_first_dref_to(to) / get_next_dref_to(to, current)\nLegacy API for iterating data xrefs TO address.\n\n### has_external_refs(pfn, ea)\nCheck if address has references from outside function.\n\n### create_switch_xrefs(ea, si)\nGenerate xrefs for switch jump table.\n\n## Reference Types\n\n### Code (cref_t)\n- `fl_CF` / `fl_CN` - Call Far/Near (creates function)\n- `fl_JF` / `fl_JN` - Jump Far/Near\n- `fl_F` - Ordinary flow to next instruction\n\n### Data (dref_t)\n- `dr_R` / `dr_W` - Read/Write access\n- `dr_O` - Offset reference\n- `dr_T` - Text reference (forced operand)\n\n## Flags\n\n- `XREF_USER` - User-defined (persistent)\n- `XREF_TAIL` - Reference to tail byte\n- `XREF_PASTEND` - Preserve alignment directives\n- `XREF_CODE` / `XREF_DATA` - Filter by type\n- `XREF_FLOW` / `XREF_NOFLOW` - Include/skip ordinary flow\n\n## See Also\nFull docs: skill/docs/ida_xref.rst\n","skills/idapython/docs/idaapi.md":"# idaapi\n\nLow-level module exposing global C variables via `cvar` attribute.\n\n## Key Attributes\n\n### cvar\nGlobal variable container - provides access to IDA's C-level global variables (e.g., `idaapi.cvar.inf` for binary info, `idaapi.cvar.database_flags` for IDB state).\n\n## See Also\nFull docs: skill/docs/idaapi.rst\n","skills/idapython/docs/idadex.md":"# idadex\n\nDEX (Dalvik Executable) file parsing utilities for Android reverse engineering.\n\n## Key Classes\n\n### Dex\nPrimary DEX file parser exposing methods/fields/strings/types from Android binaries.\n\n**String Operations**:\n- `get_string(from_ea, string_idx)` - retrieve string by index\n- `as_string(s)` - convert DEX string to Python string\n\n**Method Operations**:\n- `get_method(from_ea, method_idx)` - retrieve method by index\n- `get_method_name(from_ea, method_idx)` - get method name\n- `get_short_method_name(method)` - short form (e.g., `onCreate`)\n- `get_full_method_name(method)` - fully qualified (e.g., `android.app.Activity.onCreate`)\n- `get_call_method_name(method)` - name for call sites\n\n**Type Operations**:\n- `get_type_string(from_ea, type_idx)` - get type descriptor\n- `decorate_java_typename(desc)` - convert type descriptor to Java notation\n- `is_wide_type(typechar)` - check if type is 64-bit\n\n**Field Operations**:\n- `get_field(from_ea, field_idx)` - retrieve field by index\n- `get_field_name(from_ea, field_idx)` - get field name\n- `get_full_field_name(field_idx, field, field_name)` - fully qualified field name\n\n**Utility**:\n- `access_string(flags)` - convert access flags to string (public/private/etc)\n- `idx_to_ea(from_ea, idx, tag)` - convert DEX index to IDA address\n\n### dex_method\n`ctypes.LittleEndianStructure` representing DEX method metadata.\n- `IS_LOCAL = 1` - flag for local method\n- `HAS_CODE = 2` - flag indicating method has code\n- `is_local()` - check if method is local\n\n### dex_field\n`ctypes.LittleEndianStructure` representing DEX field metadata.\n\n## Key Functions\n\n- `to_uint32(v)` - convert to unsigned 32-bit int\n- `unpack_db(buf, off)` - unpack byte from buffer\n- `unpack_dw(buf, off)` - unpack word from buffer\n- `unpack_dd(buf, off)` - unpack dword from buffer\n- `unpack_dq(buf, off)` - unpack qword from buffer\n- `unpack_ea(buf, off)` - unpack effective address from buffer\n\n## Global Object\n\n### dex\nGlobal `Dex` instance - use this to access DEX parsing functions.\n\n## See Also\nFull docs: skill/docs/idadex.rst\n","skills/idapython/docs/idautils.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Fidautils.md -->","skills/idapython/docs/idc.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Fidc.md -->","skills/idapython/docs/init.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Finit.md -->"},"files":{".claude-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.claude-plugin%2Fplugin.json -->",".codex-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.codex-plugin%2Fplugin.json -->",".kimi-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.kimi-plugin%2Fplugin.json -->","CLAUDE.md":"# CLAUDE.md\n\nGuidance for working in this repository.\n\n## What this project is\n\nIDA Pro MCP Server: exposes IDA Pro / idalib functionality to MCP clients.\n\nMain pieces:\n- `src/ida_pro_mcp/server.py`: MCP server entrypoint\n- `src/ida_pro_mcp/idalib_server.py`: headless idalib server\n- `src/ida_pro_mcp/ida_mcp/`: IDA/plugin-side APIs\n\nImportant API modules:\n- `api_core.py`: IDB metadata, functions, strings, imports\n- `api_analysis.py`: decompilation, disassembly, xrefs, paths, pattern search\n- `api_memory.py`: bytes/ints/strings, patching\n- `api_types.py`: structs, type inference, type application\n- `api_modify.py`: comments, renaming, asm patching\n- `api_stack.py`: stack frame operations\n- `api_sigmaker.py`: signature creation, scanning, xref signatures (uses sigmaker.py)\n- `api_debug.py`: debugger control, unsafe / low priority for tests\n- `api_python.py`: execute Python in IDA context\n- `api_resources.py`: `ida://` MCP resources\n\n## Core implementation rules\n\n### IDA thread safety\nAll IDA SDK calls must run on the main thread.\nUse:\n```python\nfrom .rpc import tool\nfrom .sync import idasync\n\n@tool\n@idasync\ndef my_tool(...):\n    ...\n```\n\n### API conventions\n- Prefer batch-first APIs.\n- Many functions accept either a comma-separated string or a list.\n- Use full type hints and `Annotated[...]` descriptions.\n- The function docstring becomes the MCP tool description.\n\nExample:\n```python\ndef my_api(addrs: Annotated[str, \"Addresses (0x401000, main) or list\"]) -> list[dict]:\n    ...\n```\n\n### Common helpers\n- Parse addresses with `parse_address()`\n- Normalize batch input with `normalize_list_input()` / `normalize_dict_list()`\n- Use shared pagination / filtering helpers from `utils.py`\n\n### Unsafe operations\nDebugger or destructive operations should be marked unsafe:\n```python\nfrom .rpc import tool, unsafe\n\n@unsafe\n@tool\n@idasync\ndef dangerous_op(...):\n    ...\n```\n\n## Development commands\n\n### Run\n```bash\nuv run ida-pro-mcp\nuv run ida-pro-mcp --transport http://127.0.0.1:8744/sse\nuv run idalib-mcp --stdio path/to/binary\nuv run idalib-mcp --host 127.0.0.1 --port 8745 path/to/binary\nuv run ida-pro-mcp --unsafe\n```\n\n### MCP inspector\n```bash\nuv run mcp dev src/ida_pro_mcp/server.py\n```\n\n### Install / uninstall\n```bash\nuv run ida-pro-mcp --install\nuv run ida-pro-mcp --uninstall\n```\n\n## Testing and coverage\n\n### Run tests\nUse the headless test runner:\n```bash\nuv run ida-mcp-test tests/crackme03.elf -q\nuv run ida-mcp-test tests/typed_fixture.elf -q\nuv run ida-mcp-test tests/crackme03.elf -c api_analysis\nuv run ida-mcp-test tests/typed_fixture.elf -p \"*stack*\"\n```\n\nNotes:\n- Use `uv run ...`\n- Non-interactive output should show failures only plus a summary\n- Binary-specific tests should use `@test(binary=\"...\")` with the executable basename\n\n### Coverage\nMeasure coverage across both maintained fixtures:\n```bash\nuv run coverage erase\nuv run coverage run -m ida_pro_mcp.test tests/crackme03.elf -q\nuv run coverage run --append -m ida_pro_mcp.test tests/typed_fixture.elf -q\nuv run coverage report --show-missing\n```\n\nCurrent fixture intent:\n- `tests/crackme03.elf`: compact general regression fixture\n- `tests/typed_fixture.elf`: typed globals / structs / locals / stack coverage fixture\n\n### Test expectations\n- Prefer semantic assertions, not weak \"field exists\" checks\n- Prefer round-trip tests for mutating APIs\n- If tests expose clearly wrong API behavior, fix the API instead of weakening the test\n- Focus on IDA-facing modules, not server/config plumbing\n- Expect some IDA / Hex-Rays variance; guarded assertions or runtime skips are acceptable when justified\n\n### Generic-test sanity check\nWhen adding generic tests, also try a non-fixture binary to avoid ELF-specific assumptions:\n```bash\nuv run ida-mcp-test \"C:\\CodeBlocks\\x64dbg\\bin\\x64\\x64dbg.dll\" -q\n```\n\n## Scope priorities\n\nHigh priority:\n- `api_analysis.py`\n- `api_types.py`\n- `api_modify.py`\n- `api_stack.py`\n- `api_memory.py`\n- `api_core.py`\n- `api_resources.py`\n- `utils.py`\n- `framework.py`\n\nLower priority:\n- `api_debug.py`\n- MCP transport / hosting details\n- install / config mutation logic\n\n## Practical notes\n\n- Server/plugin Python: 3.11+\n- IDA Pro 8.3+; 9.0 recommended\n- IDA Free is not supported\n- If IDA uses the wrong Python, use `idapyswitch`\n","ida-plugin.json":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=ida-plugin.json -->","skills/idapython/SKILL.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2FSKILL.md -->","skills/idapython/docs/ida_auto.md":"# ida_auto\n\nAutoanalysis queue management and IDA status indicators.\n\n## Key Functions\n\n### Auto State Management\n- `get_auto_state()` - Get current autoanalyzer state (AU_NONE when idle)\n- `set_auto_state(new_state)` - Set autoanalyzer state\n- `auto_is_ok()` - Check if all queues empty (analysis finished)\n- `is_auto_enabled()` / `enable_auto(enable)` - Get/set autoanalyzer enabled state\n\n### Queue Operations\n- `auto_mark(ea, type)` - Add single address to queue (sorted)\n- `auto_mark_range(start, end, type)` - Add address range to queue\n- `auto_unmark(start, end, type)` - Remove range from queue\n- `auto_cancel(ea1, ea2)` - Remove range from AU_CODE/AU_PROC/AU_USED queues\n\n### Analysis Planning\n- `plan_ea(ea)` / `plan_range(sEA, eEA)` - Plan reanalysis\n- `auto_make_code(ea)` - Plan to make code\n- `auto_make_proc(ea)` - Plan to make code+function\n- `reanalyze_callers(ea, noret)` - Reanalyze all callers of address\n- `revert_ida_decisions(ea1, ea2)` - Delete IDA-generated analysis for range\n\n### Synchronous Analysis\n- `auto_wait()` - Process all queues and wait (returns false if cancelled)\n- `auto_wait_range(ea1, ea2)` - Process range and wait (returns step count or -1)\n- `plan_and_wait(ea1, ea2, final_pass=True)` - Analyze range synchronously\n- `auto_make_step(ea1, ea2)` - Analyze one address in range\n\n### Queue Types (atype_t)\n- `AU_CODE` (1) - Convert to instruction\n- `AU_PROC` (3) - Convert to procedure start\n- `AU_USED` (6) - Reanalyze\n- `AU_TYPE` (8) - Apply type information\n- `AU_FINAL` (13) - Final pass\n\n### IDA State (idastate_t)\n- `st_Ready` - IDA idle\n- `st_Think` - Autoanalysis on\n- `st_Waiting` - Waiting for input\n- `st_Work` - IDA busy\n\n## See Also\nFull docs: skill/docs/ida_auto.rst\n","skills/idapython/docs/ida_bitrange.md":"# ida_bitrange\n\nBitfield and bit-level range operations (low-priority, specialized use).\n\n## Key Class\n\n### bitrange_t\nRepresents a range of bits within a larger value.\n\n- `init(bit_ofs, size_in_bits)` - Initialize offset and size\n- `reset()` - Make empty\n- `empty()` - Check if empty\n- `bitoff()` / `bitsize()` / `bytesize()` - Get offset/size\n- `mask64()` - Convert to 64-bit mask\n- `has_common(r)` - Check overlap with another bitrange\n- `intersect(r)` - Intersect two ranges\n- `create_union(r)` - Union including hole between ranges\n- `shift_down(cnt)` / `shift_up(cnt)` - Shift range left/right\n\n## See Also\nFull docs: skill/docs/ida_bitrange.rst\n","skills/idapython/docs/ida_bytes.md":"# ida_bytes\n\nByte-level operations: reading, writing, patching, flags, and data type creation.\n\n## Navigation\n\n### Head/Item Navigation\n- `next_head(ea, maxea)` / `prev_head(ea, minea)` - Next/prev item head\n- `get_item_head(ea)` - Get start of item containing ea\n- `get_item_end(ea)` - Get address after item\n- `get_item_size(ea)` - Get item size in bytes\n- `next_chunk(ea, maxea)` / `prev_chunk(ea, minea)` - Next/prev contiguous chunk\n- `next_unknown(ea, maxea)` / `prev_unknown(ea, minea)` - Next/prev undefined byte\n\n## Reading Bytes\n\n### Single Values\n- `get_byte(ea)` / `get_word(ea)` / `get_dword(ea)` / `get_qword(ea)` - Read values\n- `get_original_byte(ea)` - Read original file byte (before patches)\n- `get_wide_byte(ea)` / `get_wide_word(ea)` - Read with byte size from inf.cc.size_i/size_s\n- `get_data_value(ea, size)` - Read data item value (up to 64 bits)\n\n### Bulk Operations\n- `get_bytes(ea, size, gmb_flags=GMB_READALL)` - Read byte array\n- `get_bytes_and_mask(ea, size, gmb_flags)` - Read bytes + mask (for wildcards)\n- `get_strlit_contents(ea, length, strtype)` - Extract string literal\n\n## Writing/Patching Bytes\n\n### Patching (modifies IDB + file)\n- `patch_byte(ea, value)` / `patch_word(ea)` / `patch_dword(ea)` / `patch_qword(ea)` - Patch values\n- `patch_bytes(ea, buf)` - Patch byte array\n- `revert_byte(ea)` - Revert to original file byte\n\n### IDB Only (no file modification)\n- `put_byte(ea, value)` / `put_word(ea)` / `put_dword(ea)` / `put_qword(ea)` - Update IDB only\n- `put_bytes(ea, buf)` - Update byte array in IDB\n\n## Flags & Type Checking\n\n### Item Type\n- `is_code(flags)` / `is_data(flags)` / `is_unknown(flags)` - Check item type\n- `is_byte(ea)` / `is_word(ea)` / `is_dword(ea)` / `is_qword(ea)` - Check data size\n- `is_strlit(ea)` - Check if string literal\n- `is_struct(ea)` - Check if structure\n- `is_tail(ea)` - Check if tail byte (not item head)\n\n### Flag Operations\n- `get_flags(ea)` - Get flags for address\n- `get_full_flags(ea)` - Get full flags (includes hidden/extra data)\n\n## Creating Data Items\n\n### Basic Types\n- `create_byte(ea, length, force=False)` - Create byte array\n- `create_word(ea, length, force)` - Create word array\n- `create_dword(ea, length, force)` - Create dword array\n- `create_qword(ea, length, force)` - Create qword array\n- `create_float(ea)` / `create_double(ea)` / `create_packed_real(ea)` - Create floats\n\n### String & Struct\n- `create_strlit(ea, length, strtype)` - Create string literal\n- `create_struct(ea, size, tid)` - Apply structure at address\n- `del_items(ea, flags=0, nbytes=1)` - Undefine items in range\n\n## Searching\n\n### Pattern Search\n- `find_bytes(bs, range_start, range_size, mask, flags)` - Find byte pattern\n- `bin_search(start, end, pattern, flags)` - Binary pattern search\n- `parse_binpat_str(pattern, radix, strlits)` - Parse pattern string to compiled form\n\n### Simple Search\n- `find_byte(sEA, size, value, flags)` - Find single byte value\n- `find_byter(sEA, size, value, flags)` - Find byte (reverse direction)\n\n## Operand Representation\n\n### Number Display\n- `op_hex(ea, n)` / `op_dec(ea, n)` / `op_oct(ea, n)` / `op_bin(ea, n)` - Set operand radix\n- `op_chr(ea, n)` - Display as character\n- `op_num(ea, n)` - Display as number (default radix)\n- `toggle_sign(ea, n)` - Toggle sign display\n\n### Complex Types\n- `op_offset(ea, n, reftype, target, base, tdelta)` - Create offset reference\n- `op_enum(ea, n, enum_id, serial)` - Apply enum\n- `op_stroff(ea, n, path, path_len, delta)` - Create structure offset\n- `op_stkvar(ea, n)` - Reference stack variable\n\n## Comments\n- `get_cmt(ea, rptble)` / `set_cmt(ea, comm, rptble)` - Get/set comment\n- `append_cmt(ea, str, rptble)` - Append to comment\n\n## Constants\n\n### Item Type Flags\n- `FF_CODE` / `FF_DATA` / `FF_TAIL` / `FF_UNK` - Main type flags\n- `FF_BYTE` / `FF_WORD` / `FF_DWORD` / `FF_QWORD` - Data size flags\n\n### Search Flags\n- `BIN_SEARCH_FORWARD` / `BIN_SEARCH_BACKWARD` - Search direction\n- `BIN_SEARCH_CASE` / `BIN_SEARCH_NOCASE` - Case sensitivity\n- `BIN_SEARCH_NOSHOW` - Suppress progress dialog\n\n## See Also\nFull docs: skill/docs/ida_bytes.rst\n","skills/idapython/docs/ida_dbg.md":"# ida_dbg\n\nDebugger control and tracing (unsafe operations require --unsafe flag).\n\n## Process Control\n\n### Start/Stop\n- `start_process(path, args, sdir)` / `request_start_process(...)` - Start debugging\n- `attach_process(pid, event_id)` / `request_attach_process(...)` - Attach to process\n- `detach_process()` / `request_detach_process()` - Detach from process\n- `exit_process()` / `request_exit_process()` - Terminate debugged process\n- `get_process_state()` / `set_process_state(state)` - Get/set state (DSTATE_SUSP/RUN/NOTASK)\n\n### Execution\n- `suspend_process()` / `continue_process()` - Pause/resume execution\n- `step_into()` / `step_over()` - Single step (into/over calls)\n- `step_until_ret()` - Run until return\n- `run_to(ea)` - Run until address\n- `run_to_backwards(ea)` / `continue_backwards()` - Reverse execution (if debugger supports)\n\n### State\n- `is_debugger_busy()` - Check if debugger processing request\n- `get_running_request()` / `is_request_running()` - Query pending requests\n- `invalidate_dbg_state(what)` - Invalidate cached state (DBGINV_MEMORY/REGS/ALL)\n\n## Threads\n\n- `get_thread_qty()` - Get thread count\n- `getn_thread(idx)` - Get thread ID by index\n- `get_current_thread()` - Get current thread ID\n- `select_thread(tid)` - Switch to thread\n- `suspend_thread(tid)` / `resume_thread(tid)` - Pause/resume thread\n\n## Breakpoints\n\n### Management\n- `add_bpt(ea, size, bpt_type)` - Add breakpoint (BPT_BRK/BPT_TRACE)\n- `del_bpt(ea)` - Delete breakpoint\n- `enable_bpt(ea, enable)` - Enable/disable breakpoint\n- `update_bpt(bpt)` - Update breakpoint properties\n- `get_bpt_qty()` / `getn_bpt(idx)` / `get_bpt(ea)` - Query breakpoints\n\n### Breakpoint Types\n- `BPT_BRK` - Stop execution\n- `BPT_TRACE` - Log and continue\n- `BPT_ENABLED` - Breakpoint active\n- `BPT_LOWCND` - Has condition\n\n### Location Types\n- `BPLT_ABS` - Absolute address\n- `BPLT_REL` - Relative to module\n- `BPLT_SYM` - Symbol name\n- `BPLT_SRC` - Source file:line\n\n## Registers\n\n- `get_dbg_reg_info(reg_name)` - Get register info\n- `get_sp_val()` / `get_ip_val()` - Get stack/instruction pointer\n- `is_reg_integer(reg_name)` / `is_reg_float(reg_name)` - Check register type\n\n## Tracing\n\n### Step Trace\n- `enable_step_trace(enable)` / `is_step_trace_enabled()` - Enable/check step tracing\n- `set_step_trace_options(opts)` / `get_step_trace_options()` - Configure tracing\n- `ST_OVER_DEBUG_SEG` / `ST_OVER_LIB_FUNC` / `ST_SKIP_LOOPS` - Step options\n\n### Instruction/Function/Block Trace\n- `enable_insn_trace(enable)` / `enable_func_trace(enable)` / `enable_bblk_trace(enable)` - Enable tracing\n- `set_insn_trace_options(opts)` / `set_func_trace_options(opts)` - Configure\n- `IT_LOG_SAME_IP` / `FT_LOG_RET` / `BT_LOG_INSTS` - Trace options\n\n### Trace Events\n- `get_tev_qty()` - Get trace event count\n- `get_tev_info(tev)` - Get trace event details\n- `get_insn_tev_reg_val(tev, reg)` - Get register value at instruction event\n- `clear_trace()` - Clear trace buffer\n- `set_trace_size(size)` - Set trace buffer size\n\n## Event Types\n\n### Debug Events\n- `dbg_process_start` / `dbg_process_exit` - Process lifetime\n- `dbg_thread_start` / `dbg_thread_exit` - Thread lifetime\n- `dbg_library_load` / `dbg_library_unload` - Module events\n- `dbg_bpt` / `dbg_exception` - Exception events\n- `dbg_step_into` / `dbg_step_over` / `dbg_run_to` - Step events\n\n### Trace Event Types\n- `tev_insn` - Instruction execution\n- `tev_call` - Function call\n- `tev_ret` - Function return\n- `tev_bpt` - Breakpoint hit\n- `tev_mem` - Memory access\n\n## Debugger Options (DOPT_*)\n- `DOPT_START_BPT` - Break on process start\n- `DOPT_ENTRY_BPT` - Break on entry point\n- `DOPT_THREAD_BPT` - Break on new thread\n- `DOPT_LIB_BPT` - Break on library load\n- `DOPT_SUSPEND_ON_EXCEPTION` - Stop on exception\n\n## DBG_Hooks\nOverride methods to receive debugger events (use `ida_dbg.DBG_Hooks` base class).\n\n## See Also\nFull docs: skill/docs/ida_dbg.rst\n","skills/idapython/docs/ida_dirtree.md":"# ida_dirtree\n\nDirectory tree organization for IDA items (types, functions, names, etc).\n\n## Overview\nProvides virtual directory structure over collections accessed by inode (ID). Used for organizing local types, structures, enums, functions, names, bookmarks, etc.\n\n## Standard Trees\n- `DIRTREE_LOCAL_TYPES` - Local type library\n- `DIRTREE_FUNCS` - Function list\n- `DIRTREE_NAMES` - Named locations\n- `DIRTREE_IMPORTS` - Imported functions\n- `DIRTREE_BPTS` - Breakpoints\n- `get_std_dirtree(id)` - Access standard tree\n\n## Key Classes\n\n### dirtree_t\nMain directory tree interface.\n\n- `chdir(path)` / `getcwd()` - Navigate directories\n- `mkdir(path)` / `rmdir(path)` - Create/delete directories\n- `link(path/inode)` / `unlink(path/inode)` - Add/remove items\n- `rename(from, to)` - Rename entry\n- `resolve_path(path)` - Convert path to direntry_t\n- `get_abspath(cursor/relpath)` - Get absolute path\n- `isdir(path/de)` / `isfile(path/de)` - Check entry type\n- `findfirst(ff, pattern)` / `findnext(ff)` - Iterate entries\n- `traverse(visitor)` - Depth-first traversal with callback\n\n### direntry_t\nRepresents a directory entry (inode or directory).\n\n- `idx` - inode_t or diridx_t\n- `isdir` - True if directory, false if file\n- `valid()` - Check if entry exists\n\n### dirtree_cursor_t\nCursor for navigating tree.\n\n- `parent` - Parent directory index\n- `rank` - Index within parent\n- `is_root_cursor()` / `set_root_cursor()` - Root operations\n\n### dirspec_t\nSpecialization interface (defines how inodes map to items).\n\n- `get_name(inode, name_flags)` - Get item name\n- `get_inode(dirpath, name)` - Lookup inode by name\n- `rename_inode(inode, newname)` - Rename item\n- `unlink_inode(inode)` - Notification when unlinked\n\n## Error Codes\n- `DTE_OK` - Success\n- `DTE_ALREADY_EXISTS` - Item exists\n- `DTE_NOT_FOUND` - Item not found\n- `DTE_NOT_DIRECTORY` - Not a directory\n- `DTE_NOT_EMPTY` - Directory not empty\n- `DTE_BAD_PATH` - Invalid path\n\n## See Also\nFull docs: skill/docs/ida_dirtree.rst\n","skills/idapython/docs/ida_diskio.md":"# ida_diskio\n\nFile I/O and IDA directory/resource management.\n\n## IDA Directories\n\n### Path Queries\n- `idadir(subdir)` - Get IDA install directory or subdirectory\n- `get_user_idadir()` - Get user data directory ($IDAUSR or default)\n- `get_ida_subdirs(subdir, flags)` - List all search paths for resource\n- `getsysfile(filename, subdir)` - Search for file in IDA paths\n\n### Subdirectory Constants\n- `CFG_SUBDIR` - Configuration files\n- `IDC_SUBDIR` - IDC scripts\n- `IDS_SUBDIR` - IDS files (function signatures)\n- `IDP_SUBDIR` - Processor modules\n- `LDR_SUBDIR` - Loader modules\n- `SIG_SUBDIR` - FLIRT signatures\n- `TIL_SUBDIR` - Type libraries\n- `PLG_SUBDIR` - Plugins\n- `THM_SUBDIR` - Themes\n\n### Search Flags\n- `IDA_SUBDIR_IDP` - Append processor name\n- `IDA_SUBDIR_IDADIR_FIRST` - Search $IDADIR before $IDAUSR\n- `IDA_SUBDIR_ONLY_EXISTING` - Only return existing directories\n\n## File Operations\n\n### Standard I/O Wrappers (use instead of C stdio)\n- `fopenRT(file)` / `fopenWT(file)` - Open text read/write\n- `fopenRB(file)` / `fopenWB(file)` - Open binary read/write\n- `fopenM(file)` - Open for modification\n- `fopenA(file)` - Open for append\n\n## Linput (IDA Binary Input)\n\n### Creation\n- `open_linput(file, remote)` - Open file as linput\n- `create_memory_linput(start, size)` - Create from IDB memory range\n- `create_bytearray_linput(s)` - Create from Python bytes\n- `create_generic_linput(gl)` - Create from custom reader\n\n### Operations\n- `qlgetz(li, fpos)` - Read null-terminated string at position\n- `get_linput_type(li)` - Get linput type (LINPUT_LOCAL/RFILE/PROCMEM/GENERIC)\n- `close_linput(li)` - Close linput\n\n### Linput Types\n- `LINPUT_LOCAL` - Local file\n- `LINPUT_RFILE` - Remote file\n- `LINPUT_PROCMEM` - Process memory\n- `LINPUT_GENERIC` - Custom reader\n\n### generic_linput_t\nBase class for custom binary readers.\n\n- `filesize` - Total size\n- `blocksize` - Read block size\n- `read(off, buffer, nbytes)` - Read bytes at offset\n\n## File Enumeration\n- `enumerate_files(path, fname, callback)` - Enumerate files matching pattern\n\n## Platform Folders\n- `get_special_folder(csidl)` - Get OS-specific folders\n  - `CSIDL_APPDATA` - Application data\n  - `CSIDL_LOCAL_APPDATA` - Local app data\n  - `CSIDL_PROGRAM_FILES` - Program files directory\n\n## See Also\nFull docs: skill/docs/ida_diskio.rst\n","skills/idapython/docs/ida_entry.md":"# ida_entry\n\nEntry point and exported function management - addresses, names, and ordinal numbers.\n\n## Key Functions\n\n- `get_entry_qty() -> int` - Get number of entry points\n- `add_entry(ord, ea, name, makecode, flags=0) -> bool` - Add entry point with ordinal number\n- `get_entry(ord) -> ea_t` - Get address by ordinal number\n- `get_entry_ordinal(idx) -> int` - Get ordinal by index (0..get_entry_qty()-1)\n- `get_entry_name(ord) -> str` - Get entry point name by ordinal\n- `rename_entry(ord, name, flags=0) -> bool` - Rename entry point\n- `set_entry_forwarder(ord, name, flags=0) -> bool` - Set forwarder name (for DLL exports)\n- `get_entry_forwarder(ord) -> str` - Get forwarder name\n\n## Flags (AEF_*)\n\n- `AEF_UTF8` - Name is UTF-8 encoded (default)\n- `AEF_IDBENC` - Name is IDB encoded (implies AEF_NODUMMY)\n- `AEF_NODUMMY` - Prepend '_' if name begins with dummy suffix\n- `AEF_WEAK` - Make name weak\n- `AEF_NOFORCE` - Append to comment if name exists (unless old name is weak)\n\n## See Also\nFull docs: skill/docs/ida_entry.rst\n","skills/idapython/docs/ida_expr.md":"# ida_expr\n\nIDC language interpreter - compile/execute IDC scripts, evaluate expressions, manipulate IDC values and objects.\n\n## Key Functions\n\n### Expression Evaluation\n- `eval_expr(rv, where, line) -> str` - Compile and evaluate expression at address context\n- `eval_idc_expr(rv, where, line) -> str` - Same as eval_expr but forces IDC interpreter\n\n### Script Execution\n- `compile_idc_file(line) -> str` - Compile IDC file\n- `compile_idc_text(line) -> str` - Compile IDC text\n- `compile_idc_snippet(func, text, resolver=None, only_safe_funcs=False) -> str` - Compile text into named function\n- `exec_idc_script(result, path, func, args, argsnum) -> str` - Compile and execute function from file\n- `exec_system_script(file, complain_if_no_file=True) -> bool` - Compile and execute \"main\" from system file\n\n### IDC Value Manipulation\n- `idcv_long(v) -> error_t` - Convert to 32/64-bit number\n- `idcv_int64(v) -> error_t` - Convert to 64-bit number\n- `idcv_num(v) -> error_t` - Convert to long (\"true\"→1, \"false\"→0)\n- `idcv_string(v) -> error_t` - Convert to string\n- `idcv_float(v) -> error_t` - Convert to float\n- `idcv_object(v, icls=None) -> error_t` - Create IDC object\n- `move_idcv(dst, src) -> error_t` - Move value (efficient, no copy)\n- `copy_idcv(dst, src) -> error_t` - Shallow copy (objects copied by reference)\n- `deep_copy_idcv(dst, src) -> error_t` - Deep copy objects\n- `free_idcv(v)` - Free VT_STR/VT_OBJ storage\n- `swap_idcvs(v1, v2)` - Swap two variables\n\n### Object/Attribute Access\n- `get_idcv_attr(res, obj, attr, may_use_getattr=False) -> error_t` - Get object attribute\n- `set_idcv_attr(obj, attr, value, may_use_setattr=False) -> error_t` - Set object attribute\n- `del_idcv_attr(obj, attr) -> error_t` - Delete attribute\n- `first_idcv_attr(obj) -> str`, `last_idcv_attr(obj) -> str` - Iterate attributes\n- `get_idcv_slice(res, v, i1, i2, flags=0) -> error_t` - Get slice of string/object\n- `set_idcv_slice(v, i1, i2, _in, flags=0) -> error_t` - Set slice\n\n### Class/Variable Management\n- `add_idc_class(name, super=None) -> idc_class_t*` - Create IDC class\n- `find_idc_class(name) -> idc_class_t*` - Find existing class\n- `add_idc_gvar(name) -> idc_value_t*` - Add global variable\n- `find_idc_gvar(name) -> idc_value_t*` - Find global variable\n- `find_idc_func(prefix, n=0) -> str` - Find IDC function by prefix\n\n## idc_value_t Class\n\nCore IDC value container with variant type support.\n\n### Attributes\n- `vtype: char` - Type (VT_LONG, VT_FLOAT, VT_STR, VT_OBJ, VT_FUNC, VT_PVOID, VT_INT64, VT_REF)\n- `num: int` - Integer value (VT_LONG)\n- `i64: int64` - 64-bit integer (VT_INT64)\n- `e: fpvalue_t` - Float value (VT_FLOAT)\n- `obj: idc_object_t*` - Object reference (VT_OBJ)\n\n### Methods\n- `clear()` - Free storage\n- `qstr() -> str`, `c_str() -> str` - Get string value\n- `set_string(...)`, `set_long(v)`, `set_int64(v)`, `set_float(f)` - Set typed values\n- `is_zero() -> bool`, `is_integral() -> bool`, `is_convertible() -> bool` - Type checks\n\n## Value Types (VT_*)\n- `VT_LONG` - Integer\n- `VT_INT64` - 64-bit integer\n- `VT_FLOAT` - Floating point\n- `VT_STR` - String\n- `VT_OBJ` - Object\n- `VT_FUNC` - Function\n- `VT_PVOID` - void pointer\n- `VT_REF` - Reference\n\n## Compilation Flags (CPL_*)\n- `CPL_DEL_MACROS` - Delete macros after compilation\n- `CPL_USE_LABELS` - Allow program labels\n- `CPL_ONLY_SAFE` - Only thread-safe functions\n\n## Function Flags (EXTFUN_*)\n- `EXTFUN_BASE` - Requires open database\n- `EXTFUN_NORET` - Does not return\n- `EXTFUN_SAFE` - Thread-safe, callable from any thread\n\n## See Also\nFull docs: skill/docs/ida_expr.rst\n","skills/idapython/docs/ida_fixup.md":"# ida_fixup\n\nRelocation/fixup information for loaders - manage target addresses, offsets, and displacement values.\n\n## Key Functions\n\n- `get_fixup(fd, source) -> bool` - Get fixup information at address\n- `exists_fixup(source) -> bool` - Check if fixup exists\n- `set_fixup(source, fd)` - Set fixup information (loaders use this)\n- `del_fixup(source)` - Delete fixup\n- `get_first_fixup_ea() -> ea_t` - Get first fixup address\n- `get_next_fixup_ea(ea) -> ea_t` - Next fixup after ea\n- `get_prev_fixup_ea(ea) -> ea_t` - Previous fixup before ea\n- `get_fixup_value(ea, type) -> int` - Read bytes and convert to operand value (get relocation addend)\n- `patch_fixup_value(ea, fd) -> bool` - Update bytes from fixup data\n- `get_fixup_desc(source, fd) -> str` - Get description comment\n- `calc_fixup_size(type) -> int` - Calculate fixup size in bytes (-1 on error)\n- `contains_fixups(ea, size) -> bool` - Check if range contains fixups\n- `gen_fix_fixups(from, to, size)` - Relocate bytes when moving segments/rebasing\n\n## fixup_data_t Class\n\nFixup metadata container.\n\n### Attributes\n- `sel: sel_t` - Target segment selector (BADSEL for absolute)\n- `off: ea_t` - Target offset\n- `displacement: adiff_t` - Displacement from target\n\n### Methods\n- `get_type() -> fixup_type_t`, `set_type(type)` - Fixup type access\n- `set_type_and_flags(type, flags=0)` - Set both type and flags\n- `is_custom() -> bool` - Is processor-specific fixup\n- `get_flags() -> int` - Get flags\n- `is_extdef() -> bool`, `set_extdef()`, `clr_extdef()` - Target is symbol vs segment offset\n- `is_unused() -> bool`, `set_unused()`, `clr_unused()` - IDA ignores this fixup\n- `has_base() -> bool` - Is relative fixup (vs segment-relative)\n- `was_created() -> bool` - Was created by IDA (not in original file)\n- `get_base() -> ea_t`, `set_base(new_base)` - Base address for relative fixups\n- `set(source)` - set_fixup wrapper\n- `get(source) -> bool` - get_fixup wrapper\n- `calc_size() -> int` - Fixup size\n\n## Fixup Types (FIXUP_*)\n\n- `FIXUP_OFF8`, `FIXUP_OFF16`, `FIXUP_OFF32`, `FIXUP_OFF64` - Unsigned offsets (8/16/32/64-bit)\n- `FIXUP_OFF8S`, `FIXUP_OFF16S`, `FIXUP_OFF32S` - Signed offsets\n- `FIXUP_SEG16` - 16-bit segment selector\n- `FIXUP_PTR16` - 32-bit pointer (16:16 base:offset)\n- `FIXUP_PTR32` - 48-bit pointer (16:32 base:offset)\n- `FIXUP_HI8`, `FIXUP_HI16` - High 8/16 bits of offset\n- `FIXUP_LOW8`, `FIXUP_LOW16` - Low 8/16 bits of offset\n- `FIXUP_CUSTOM` - Start of custom (processor-specific) types\n\n## Fixup Flags (FIXUPF_*)\n\n- `FIXUPF_REL` - Relative to linear address `base` (else segment-relative)\n- `FIXUPF_EXTDEF` - Target is symbol (else segment offset)\n- `FIXUPF_UNUSED` - Ignored by IDA, disables operand conversion\n- `FIXUPF_CREATED` - Not present in input file\n- `FIXUPF_LOADER_MASK` - Loader-specific flags (not stored in DB)\n\n## See Also\nFull docs: skill/docs/ida_fixup.rst\n","skills/idapython/docs/ida_fpro.md":"# ida_fpro\n\nSystem-independent FILE* operations - cross-module file I/O (use these instead of C stdlib functions).\n\n## qfile_t Class\n\nIDA's FILE* wrapper for cross-module compatibility.\n\n### Constructor Methods\n- `open(filename, mode) -> bool` - Open file (fopen-style mode string)\n- `from_fp(fp) -> qfile_t*` - Wrap existing FILE*\n- `from_capsule(pycapsule) -> qfile_t*` - Wrap Python capsule\n- `tmpfile() -> qfile_t*` - Create temporary file\n\n### File Operations\n- `close()` - Close file\n- `opened() -> bool` - Check if open\n- `flush()` - Flush buffers\n- `size() -> int64` - Get file size\n- `filename() -> str` - Get filename\n\n### Reading\n- `read(size) -> str` - Read bytes (None on error)\n- `readbytes(size, big_endian) -> str` - Read with endianness conversion\n- `gets(len) -> str` - Read line (None on EOF)\n- `get_byte() -> int` - Read single byte (None on EOF)\n\n### Writing\n- `write(buf) -> int` - Write bytes (0 on error, else bytes written)\n- `writebytes(size, big_endian) -> int` - Write with endianness conversion\n- `puts(str) -> int` - Write string\n- `put_byte(chr)` - Write single byte\n\n### Positioning\n- `seek(offset, whence=SEEK_SET) -> int` - Seek (returns new position, not 0 like fseek)\n- `tell() -> int` - Get current position\n\n## Functions\n\n- `qfclose(fp)` - Close FILE*\n\n## Move Flags (QMOVE_*)\n- `QMOVE_CROSS_FS` - Allow cross-filesystem moves\n- `QMOVE_OVERWRITE` - Overwrite existing files\n- `QMOVE_OVR_RO` - Overwrite read-only files\n\n## Important\n\n**Never mix C stdlib FILE* functions with IDA kernel functions.** Each module has its own FILE* state when statically linked. Use qfile_t for all file I/O in plugins.\n\n## See Also\nFull docs: skill/docs/ida_fpro.rst\n","skills/idapython/docs/ida_frame.md":"# ida_frame\n\nFunction stack frame manipulation - local variables, register variables, stack pointer tracking.\n\n## Frame Structure\n\n```\n+------------------------------------------------+\n| function arguments                             |\n+------------------------------------------------+\n| return address                                 |\n+------------------------------------------------+\n| saved registers (SI, DI, etc)                  |\n+------------------------------------------------+ <- typical BP\n|                                                |\n| local variables                                |\n|                                                |\n+------------------------------------------------+ <- SP\n```\n\nAccess via: `tinfo_t::get_func_frame(pfn)` or `get_func_frame(out, pfn)` + `tinfo_t::get_udt_details()`\n\n## Key Functions\n\n### Frame Management\n- `add_frame(pfn, frsize, frregs, argsize) -> bool` - Create frame (frsize=locals, frregs=saved regs, argsize=purged bytes)\n- `del_frame(pfn) -> bool` - Delete frame\n- `set_frame_size(pfn, frsize, frregs, argsize) -> bool` - Resize frame\n- `get_frame_size(pfn) -> asize_t` - Full size (locals + saved regs + retaddr + purged bytes)\n- `get_frame_retsize(pfn) -> int` - Return address size\n- `get_func_frame(out, pfn) -> bool` - Get frame type info\n\n### Frame Parts\n- `frame_off_args(pfn) -> ea_t` - Arguments section start\n- `frame_off_retaddr(pfn) -> ea_t` - Return address section start\n- `frame_off_savregs(pfn) -> ea_t` - Saved registers section start\n- `frame_off_lvars(pfn) -> ea_t` - Local variables section start\n- `get_frame_part(range, pfn, part)` - Get part offsets (FPC_ARGS/FPC_RETADDR/FPC_SAVREGS/FPC_LVARS)\n\n### Stack Variables\n- `define_stkvar(pfn, name, off, tif, repr=None) -> bool` - Define stack var (negative off=locals, positive=args)\n- `add_frame_member(pfn, name, offset, tif, repr=None, etf_flags=0) -> bool` - Add member to frame type\n- `set_frame_member_type(pfn, offset, tif, repr=None, etf_flags=0) -> bool` - Change member type\n- `delete_frame_members(pfn, start_offset, end_offset) -> bool` - Delete members in range\n- `build_stkvar_name(pfn, v) -> str` - Auto-generate stack var name\n- `calc_stkvar_struc_offset(pfn, insn, n) -> ea_t` - Calculate stack var offset in frame\n- `calc_frame_offset(pfn, off, insn=None, op=None) -> int` - Calculate offset in frame from SP/BP offset\n- `build_stkvar_xrefs(out, pfn, start_offset, end_offset)` - Get xrefs to stack frame range\n\n### Utilities\n- `is_funcarg_off(pfn, frameoff) -> bool` - Is offset in arguments range\n- `lvar_off(pfn, frameoff) -> int` - Convert to local var offset\n- `is_anonymous_member_name(name) -> bool` - Prefixed with \"anonymous\"\n- `is_dummy_member_name(name) -> bool` - Auto-generated name\n- `is_special_frame_member(tid) -> bool` - Is retaddr or saved regs slot\n- `soff_to_fpoff(pfn, soff) -> int` - Convert struct offset to FP-relative\n- `update_fpd(pfn, fpd) -> bool` - Update frame pointer delta\n- `set_purged(ea, nbytes, override_old_value) -> bool` - Set purged bytes (__stdcall/__pascal)\n\n### Register Variables\n- `add_regvar(pfn, ea1, ea2, canon, user, cmt) -> int` - Define register variable in range\n- `find_regvar(pfn, ea, canon) -> regvar_t*` - Find register variable definition\n- `has_regvar(pfn, ea) -> bool` - Check if regvar exists\n- `rename_regvar(pfn, v, user) -> int` - Rename register variable\n- `set_regvar_cmt(pfn, v, cmt) -> int` - Set comment\n- `del_regvar(pfn, ea1, ea2, canon) -> int` - Delete register variable\n- `free_regvar(v)` - Free regvar_t\n\n### Stack Pointer Tracking\n- `get_spd(pfn, ea) -> int` - Get SP delta before instruction (initial SP - current SP)\n- `get_effective_spd(pfn, ea) -> int` - Get SP delta used by instruction (differs for \"pop [esp+N]\")\n- `get_sp_delta(pfn, ea) -> int` - Get SP modification at location (0 if no change point)\n- `add_auto_stkpnt(pfn, ea, delta) -> bool` - Add automatic SP change point\n- `add_user_stkpnt(ea, delta) -> bool` - Add user-defined SP change point\n- `del_stkpnt(pfn, ea) -> bool` - Delete SP change point\n- `set_auto_spd(pfn, ea, new_spd) -> bool` - Set cumulative SP delta at address\n- `recalc_spd(cur_ea) -> bool` - Recalculate SP for non-fallthrough instructions\n- `recalc_spd_for_basic_block(pfn, cur_ea) -> bool` - Recalculate SP for basic block\n\n## regvar_t Class\n\nRegister variable definition (extends range_t).\n\n### Attributes\n- `canon: str` - Canonical register name (case-insensitive)\n- `user: str` - User-defined name\n- `cmt: str` - Comment near definition\n\n## Error Codes\n\n- `REGVAR_ERROR_OK` - Success\n- `REGVAR_ERROR_ARG` - Bad function arguments\n- `REGVAR_ERROR_RANGE` - Bad definition range\n- `REGVAR_ERROR_NAME` - Name can't be accepted\n\n## Flags\n\n- `STKVAR_VALID_SIZE` - dtyp contains correct variable type (off for \"lea\")\n- `STKVAR_KEEP_EXISTING` - Don't create new var if one exists\n\n## See Also\nFull docs: skill/docs/ida_frame.rst\n","skills/idapython/docs/ida_funcs.md":"# ida_funcs\n\nFunction management - define, modify, analyze functions and function chunks. Includes FLIRT signature support.\n\n## Architecture\n\nFunctions consist of:\n- **Entry chunk** - function start (required)\n- **Tail chunks** - optional additional code ranges shared between functions\n- Each tail has an **owner** function\n\n## func_t Class\n\nCore function descriptor (extends range_t).\n\n### Key Attributes\n- `flags: uint64` - Function flags (FUNC_*)\n- `frame: int` - Frame structure netnode ID\n- `frsize: asize_t` - Local variables size\n- `frregs: ushort` - Saved registers size\n- `argsize: asize_t` - Purged bytes on return (__stdcall/__pascal)\n- `fpd: asize_t` - Frame pointer delta (usually 0)\n- `color: bgcolor_t` - User-defined color\n- `points: stkpnt_t*`, `pntqty: int` - SP change points\n- `regvars: regvar_t*`, `regvarqty: int` - Register variables\n- `regargs: regarg_t*`, `regargqty: int` - Register arguments (temporary, cleared when type determined)\n- `tails: range_t*`, `tailqty: int` - Function tails\n- `owner: ea_t` - Tail owner address\n- `referers: ea_t*`, `refqty: int` - Parent functions using this tail\n\n### Methods\n- `is_far() -> bool` - Far function\n- `does_return() -> bool` - Returns to caller\n- `analyzed_sp() -> bool` - SP-analysis performed\n- `need_prolog_analysis() -> bool` - Needs prolog analysis\n- `get_name() -> str` - Function name\n- `get_prototype() -> tinfo_t` - Function prototype\n- `get_frame_object() -> tinfo_t` - Frame structure\n- `addresses()`, `code_items()`, `data_items()`, `head_items()`, `not_tails()` - Iterators\n\n## Key Functions\n\n### Querying Functions\n- `get_func(ea) -> func_t*` - Get function by address (returns entry chunk)\n- `getn_func(n) -> func_t*` - Get function by index (0..get_func_qty()-1)\n- `get_func_qty() -> size_t` - Total function count\n- `get_func_num(ea) -> int` - Get function index (-1 if not found)\n- `get_prev_func(ea) -> func_t*`, `get_next_func(ea) -> func_t*` - Navigate functions\n- `func_contains(pfn, ea) -> bool` - Does function contain address\n- `is_same_func(ea1, ea2) -> bool` - Do addresses belong to same function\n- `get_func_chunknum(pfn, ea) -> int` - Get chunk number (-1=not contained, 0=entry, >0=tail)\n\n### Creating/Modifying Functions\n- `add_func(ea1, ea2=BADADDR) -> bool` - Create function (auto-determines bounds if ea2=BADADDR)\n- `add_func_ex(pfn) -> bool` - Create from func_t struct\n- `del_func(ea) -> bool` - Delete function\n- `update_func(pfn) -> bool` - Update function info (don't use for start/end changes)\n- `set_func_start(ea, newstart) -> int` - Move start address (returns MOVE_FUNC_*)\n- `set_func_end(ea, newend) -> bool` - Move end address\n- `find_func_bounds(nfn, flags) -> int` - Auto-determine boundaries (returns FIND_FUNC_*)\n- `reanalyze_function(pfn, ea1=None, ea2=None, analyze_parents=False)` - Reanalyze function\n\n### Function Information\n- `get_func_name(ea) -> str` - Get name\n- `get_func_cmt(pfn, repeatable) -> str`, `set_func_cmt(pfn, cmt, repeatable) -> bool` - Comments\n- `get_func_ranges(ranges, pfn) -> ea_t` - Get all ranges\n- `calc_func_size(pfn) -> asize_t` - Total size including tails\n- `get_func_bitness(ea) -> int` - Bitness (0=16, 1=32, 2=64, -1=error)\n- `get_func_bits(ea) -> int` - Bits (16/32/64)\n- `get_func_bytes(ea) -> bytes` - Function bytes\n- `is_visible_func(pfn) -> bool`, `set_visible_func(pfn, visible)` - Visibility control\n- `is_finally_visible_func(pfn) -> bool` - Final visibility after all checks\n\n### Function Analysis\n- `func_does_return(ea) -> bool` - Does function return\n- `reanalyze_noret_flag(ea)` - Reanalyze non-return flag\n- `set_noret_insn(ea, noret)` - Mark instruction as non-returning\n- `calc_thunk_func_target(pfn) -> ea_t` - Get thunk target\n- `set_func_name_if_jumpfunc(pfn, name)` - Auto-name jump functions\n\n### Function Chunks (Tails)\n- `get_fchunk(ea) -> func_t*` - Get chunk by address (entry or tail)\n- `getn_fchunk(n) -> func_t*` - Get chunk by index\n- `get_fchunk_qty() -> size_t` - Total chunk count\n- `get_fchunk_num(ea) -> int` - Get chunk index\n- `get_prev_fchunk(ea) -> func_t*`, `get_next_fchunk(ea) -> func_t*` - Navigate chunks\n- `append_func_tail(pfn, tail_ea1, tail_ea2) -> bool` - Add tail to function\n- `remove_func_tail(pfn, tail_ea) -> bool` - Remove tail\n- `set_tail_owner(tail, owner_ea) -> bool` - Change tail owner\n- `get_fchunk_referer(ea, idx) -> ea_t` - Get parent function using tail\n- `func_tail_iterator_set(pfn, fti)` - Initialize tail iterator\n- `func_parent_iterator_set(pfn, fpi)` - Initialize parent iterator\n\n### Locking\n- `lock_func_range(pfn, lock)` - Lock function pointer (prevents deletion/move)\n- `is_func_locked(pfn) -> bool` - Check if locked\n- `lock_func(pfn)`, `lock_func_with_tails_t(pfn)` - RAII lock helpers\n\n### FLIRT Signatures\n- `plan_to_apply_idasgn(name) -> int` - Plan signature application (returns IDASGN_*)\n- `apply_idasgn_to(name, ea, may_show_wait_box) -> int` - Apply signature at address\n- `get_idasgn_qty() -> int` - Number of loaded signatures\n- `get_current_idasgn() -> str` - Current signature name\n- `calc_idasgn_state(n) -> int` - Signature state (IDASGN_*)\n- `del_idasgn(n)` - Delete signature\n- `get_idasgn_title(n) -> str` - Get signature title\n- `get_idasgn_desc(n) -> str` - Get description\n- `get_idasgn_desc_with_matches(n) -> str` - Get description with match count\n- `apply_startup_sig(ea1, ea2)` - Apply startup signature\n- `try_to_add_libfunc(pfn, ea) -> int` - Try to add library function (returns LIBFUNC_*)\n\n### Register Arguments\n- `read_regargs(pfn) -> dyn_regarg_array` - Read register arguments\n- `add_regarg(pfn, reg, type, name) -> bool` - Add register argument\n\n## Function Flags (FUNC_*)\n\n- `FUNC_NORET` - Doesn't return\n- `FUNC_FAR` - Far function\n- `FUNC_LIB` - Library function\n- `FUNC_STATICDEF` - Static\n- `FUNC_FRAME` - Uses frame pointer (BP)\n- `FUNC_USERFAR` - User-specified far\n- `FUNC_HIDDEN` - Hidden chunk\n- `FUNC_THUNK` - Jump/thunk function\n- `FUNC_BOTTOMBP` - BP points to stack frame bottom\n- `FUNC_NORET_PENDING` - Non-return analysis pending\n- `FUNC_SP_READY` - SP-analysis complete\n- `FUNC_FUZZY_SP` - SP changes untraceably (e.g., \"and esp, 0FFFFFFF0h\")\n- `FUNC_PROLOG_OK` - Prolog analyzed\n- `FUNC_PURGED_OK` - argsize validated\n- `FUNC_TAIL` - Function tail chunk\n- `FUNC_LUMINA` - Info from Lumina\n- `FUNC_OUTLINE` - Outlined code, not real function\n- `FUNC_REANALYZE` - Frame changed, needs reanalysis\n- `FUNC_UNWIND` - Exception unwind handler\n- `FUNC_CATCH` - Exception catch handler\n\n## Return Codes\n\n### MOVE_FUNC_*\n- `MOVE_FUNC_OK` - Success\n- `MOVE_FUNC_NOCODE` - No instruction at newstart\n- `MOVE_FUNC_BADSTART` - Bad new start\n- `MOVE_FUNC_NOFUNC` - No function at ea\n- `MOVE_FUNC_REFUSED` - Plugin refused\n\n### FIND_FUNC_* (flags)\n- `FIND_FUNC_NORMAL` - Stop on undefined byte\n- `FIND_FUNC_DEFINE` - Create instruction on undefined byte\n- `FIND_FUNC_IGNOREFN` - Ignore existing function boundaries\n- `FIND_FUNC_KEEPBD` - Don't modify boundaries, just create instructions\n\n### FIND_FUNC_* (results)\n- `FIND_FUNC_OK` - Ready for add_func()\n- `FIND_FUNC_EXIST` - Already exists\n- `FIND_FUNC_UNDEF` - Has unexplored bytes\n\n### IDASGN_*\n- `IDASGN_OK` - Success\n- `IDASGN_BADARG` - Bad argument\n- `IDASGN_APPLIED` - Already applied\n- `IDASGN_CURRENT` - Current signature\n- `IDASGN_PLANNED` - Planned for application\n\n### LIBFUNC_*\n- `LIBFUNC_FOUND` - Found and added\n- `LIBFUNC_NONE` - Not found\n- `LIBFUNC_DELAY` - Delayed (needs more analysis)\n\n## Iterators\n\n- `func_tail_iterator_t` - Iterate function tails\n- `func_item_iterator_t` - Iterate function items (addresses/code/data/heads)\n- `func_parent_iterator_t` - Iterate parent functions using tail\n\n## See Also\nFull docs: skill/docs/ida_funcs.rst\n","skills/idapython/docs/ida_gdl.md":"# ida_gdl\n\nLow level graph drawing operations - flow charts and call graphs.\n\n## Key Classes\n\n### FlowChart\nPythonic flowchart class for determining basic blocks.\n- `FlowChart(f, bounds, flags)` - Create flow chart for function\n- `size` - Number of blocks in flow chart\n- `refresh()` - Refresh flow chart\n- Iterate blocks directly: `for bb in fc: ...`\n\n### BasicBlock\nBasic block within a flowchart.\n- `id` - Block number\n- `start_ea`, `end_ea` - Address range\n- `type` - Block type (fcb_normal, fcb_ret, fcb_noret, etc.)\n- `preds()` - Iterator over predecessor blocks\n- `succs()` - Iterator over successor blocks\n\n### qflow_chart_t\nLow-level flow chart builder (use FlowChart instead for Python).\n- `create(title, pfn, ea1, ea2, flags)` - Build flow chart\n- `nsucc(node)`, `npred(node)` - Successor/predecessor counts\n- `succ(node, i)`, `pred(node, i)` - Get nth successor/predecessor\n\n## Key Functions\n\n- `gen_flow_graph(filename, title, pfn, ea1, ea2, gflags)` - Generate flow graph to .dot/.gdl\n- `gen_simple_call_chart(filename, wait, title, gflags)` - Simple call graph\n- `is_ret_block(btype)` - Check if block returns\n- `is_noret_block(btype)` - Check if block never returns\n\n## Constants\n\n**Block types**: fcb_normal, fcb_indjump, fcb_ret, fcb_cndret, fcb_noret, fcb_enoret, fcb_extern, fcb_error\n\n**Flow chart flags**: FC_NOEXT (no external blocks), FC_CALL_ENDS (calls end blocks), FC_NOPREDS (skip predecessors)\n\n**Chart generation**: CHART_GEN_DOT, CHART_GEN_GDL, CHART_WINGRAPH, CHART_NOLIBFUNCS\n\n## See Also\nFull docs: skill/docs/ida_gdl.rst\n","skills/idapython/docs/ida_graph.md":"# ida_graph\n\nGraph view management - custom graph visualization and interaction (medium priority for typical reverse engineering).\n\n## Key Classes\n\n### GraphViewer\nPythonic class for creating custom graph views.\n- Override `OnRefresh()` - Populate graph nodes/edges\n- Override `OnGetText(node)` - Get node display text\n- Override `OnDblClick(node)` - Handle double-click\n- Override `OnClick(node)` - Handle single-click\n- `Show()` - Display graph viewer\n- `Close()` - Close graph viewer\n\n### interactive_graph_t\nLow-level interactive graph implementation (use GraphViewer instead for Python).\n\n### mutable_graph_t\nAbstract graph structure for manipulation.\n- `create_mutable_graph()` - Create new graph\n- `delete_mutable_graph(g)` - Delete graph\n\n## Key Functions\n\n### Graph Creation\n- `create_graph_viewer(title, gid, callback)` - Create graph viewer widget\n- `create_interactive_graph(title)` - Create interactive graph\n- `create_disasm_graph(ea)` - Create disassembly graph at address\n\n### Graph Manipulation\n- `get_node_info(graph, node)` - Get node display info (color, text, etc.)\n- `set_node_info(graph, node, info, flags)` - Set node properties\n- `del_node_info(graph, node)` - Delete node info\n- `viewer_set_node_info(viewer, node, info, flags)` - Set node info in viewer\n\n### Graph Navigation\n- `viewer_get_curnode(viewer)` - Get currently selected node\n- `viewer_center_on(viewer, node)` - Center view on node\n- `viewer_fit_window(viewer)` - Zoom to fit\n- `viewer_get_selection(viewer)` - Get selected items\n\n### Graph Groups\n- `viewer_create_groups(viewer, groups)` - Create node groups\n- `viewer_delete_groups(viewer, groups)` - Delete groups\n- `viewer_set_groups_visibility(viewer, groups, visible)` - Show/hide groups\n\n## Constants\n\n**Node info flags**: NIF_BG_COLOR, NIF_FRAME_COLOR, NIF_EA, NIF_TEXT, NIF_FLAGS, NIF_ALL\n\n**Layout types**: layout_digraph, layout_tree, layout_circle, layout_polar_tree, layout_orthogonal, layout_radial_tree\n\n**Graph item types**: git_none, git_edge, git_node, git_tool, git_text\n\n## See Also\nFull docs: skill/docs/ida_graph.rst\n","skills/idapython/docs/ida_hexrays.md":"# ida_hexrays\n\nHex-Rays decompiler - microcode and ctree (AST) representations. **Critical for decompilation work.**\n\n## Core Architecture\n\n**Two representations**:\n- **Microcode**: Low-level optimized IR (mba_t, mblock_t, minsn_t, mop_t)\n- **Ctree**: High-level AST-like C code (cfunc_t, cinsn_t, cexpr_t)\n\n## Key Functions\n\n### Decompilation\n- `decompile(ea, hf=None, flags=0)` - Decompile function at address, returns cfuncptr_t\n- `decompile_func(pfn, hf=None, flags=0)` - Decompile func_t object\n- `gen_microcode(mbr, hf=None, retlist=None, flags=0, reqmat=MMAT_GLBOPT3)` - Generate microcode only\n\n### Callbacks\n- `install_hexrays_callback(callback)` - Register event hook (hxe_maturity, hxe_print_func, etc.)\n\n## Ctree Classes (High-Level)\n\n### cfunc_t\nDecompiled function - the main result.\n- `body` - Root cinsn_t (function body)\n- `lvars` - List of local variables (lvar_t)\n- `mba` - Underlying microcode (mba_t)\n- `get_pseudocode()` - Get text as list of lines\n- `build_c_tree()` - Rebuild ctree from microcode\n- `verify(allow_cot_empty)` - Validate ctree integrity\n\n### cinsn_t\nC statement (if, for, while, return, expression, block, etc.).\n- `op` - Statement type (cit_block, cit_if, cit_for, cit_while, cit_return, etc.)\n- `ea` - Associated address\n- `cif`, `cfor`, `cwhile`, `creturn`, `cexpr` - Type-specific data unions\n- Access via: `insn.cif.expr` (if condition), `insn.cblock` (compound statement)\n\n### cexpr_t\nC expression (operators, variables, constants, calls, etc.).\n- `op` - Expression type (cot_var, cot_num, cot_call, cot_add, cot_cast, etc.)\n- `type` - Expression type info (tinfo_t)\n- `x`, `y`, `z` - Operands (for binary/ternary ops)\n- `n` - Number value (cnumber_t)\n- `v` - Variable reference (var_ref_t)\n- `obj_ea` - Global variable/function address\n- `print1()` - Format as text\n\n### citem_t\nBase class for cinsn_t and cexpr_t.\n- `ea` - Address\n- `op` - Opcode (ctype_t enum)\n- `contains_label()` - Has goto label\n\n## Microcode Classes (Low-Level)\n\n### mba_t\nMicrocode array - function as basic blocks.\n- `qty` - Number of blocks\n- `get_mblock(n)` - Get block by index\n- `natural` - Natural (entry) block array\n- `vars` - Local variables (lvars_t)\n- `maturity` - Optimization level (MMAT_ZERO to MMAT_LVARS)\n- `build_graph()` - Construct CFG\n- `optimize_local(blk)` - Optimize single block\n- `optimize_global()` - Global optimization pass\n\n### mblock_t\nBasic block in microcode.\n- `head`, `tail` - First/last instruction (minsn_t)\n- `start`, `end` - Address range\n- `type` - Block type (BLT_STOP, BLT_1WAY, BLT_2WAY, BLT_NWAY)\n- `nsucc()`, `npred()` - Successor/predecessor counts\n- `succ(n)`, `pred(n)` - Get nth successor/predecessor\n- `for_all_insns(visitor)` - Iterate instructions\n- `insert_into_block(ins, where)` - Add instruction\n\n### minsn_t\nMicrocode instruction.\n- `opcode` - Operation (m_mov, m_add, m_call, m_ldx, m_stx, etc.)\n- `l`, `r`, `d` - Left, right, destination operands (mop_t)\n- `ea` - Instruction address\n- `next`, `prev` - Linked list pointers\n- `is_assert()` - Check if assertion\n- `equal_mops(other)` - Compare operands\n- `for_all_ops(visitor)` - Iterate operands\n\n### mop_t\nMicrocode operand.\n- `t` - Operand type (mop_z=none, mop_r=register, mop_n=immediate, mop_S=stack, mop_v=global, mop_b=block, mop_f=case, mop_l=local var, mop_a=address, mop_h=helper, mop_str=string, mop_c=call, mop_fn=function, mop_p=pair, mop_sc=scattered)\n- `r` - Register number (if mop_r)\n- `nnn` - Immediate value (mnumber_t, if mop_n)\n- `g` - Global address (if mop_v)\n- `s` - Stack offset (stkvar_ref_t, if mop_S)\n- `l` - Local var reference (lvar_t, if mop_l)\n- `size` - Operand size in bytes\n- `is_reg(reg, size)` - Check if specific register\n- `is_const()` - Check if constant\n\n### lvar_t\nLocal variable (stack/register).\n- `name` - Variable name\n- `type` - Variable type (tinfo_t)\n- `location` - vdloc_t (register or stack location)\n- `defea` - Definition address\n- `width` - Size in bytes\n- `is_stk_var()`, `is_reg_var()` - Location checks\n- `set_lvar_type(tif)` - Change type\n\n## Key Event Types\n\n**Maturity levels** (microcode optimization stages):\n- MMAT_ZERO - Unoptimized\n- MMAT_GENERATED - After instruction generation\n- MMAT_PREOPTIMIZED - After pre-optimization\n- MMAT_LOCOPT - After local optimization\n- MMAT_CALLS - After call analysis\n- MMAT_GLBOPT1/2/3 - Global optimization passes\n- MMAT_LVARS - After local variable allocation\n\n**Callback events**:\n- hxe_maturity - Microcode maturity changed\n- hxe_print_func - About to print function\n- hxe_func_printed - Function printed\n- hxe_open_pseudocode - Pseudocode window opened\n- hxe_create_hint - Create hover hint\n\n## Common Patterns\n\n### Decompile and get text\n```python\ncfunc = ida_hexrays.decompile(ea)\nfor line in cfunc.get_pseudocode():\n    print(line.line)\n```\n\n### Modify variable name/type\n```python\ncfunc = ida_hexrays.decompile(ea)\nlvar = cfunc.lvars[0]\nlvar.name = \"new_name\"\nlvar.set_lvar_type(new_tinfo)\ncfunc.save_user_labels()\n```\n\n### Walk ctree\n```python\nclass visitor(ida_hexrays.ctree_visitor_t):\n    def visit_expr(self, e):\n        if e.op == ida_hexrays.cot_call:\n            print(f\"Call at {e.ea:#x}\")\n        return 0\n\ncfunc = ida_hexrays.decompile(ea)\nvisitor().apply_to(cfunc.body, None)\n```\n\n### Walk microcode\n```python\nmba = ida_hexrays.gen_microcode(...)\nfor blk in mba.natural:\n    ins = blk.head\n    while ins:\n        print(f\"{ins.ea:#x}: {ins.opcode}\")\n        ins = ins.next\n```\n\n## See Also\nFull docs: skill/docs/ida_hexrays.rst\n\n**External resources**:\n- https://hex-rays.com/blog/hex-rays-decompiler-primer\n- https://hex-rays.com/blog/microcode-in-pictures\n","skills/idapython/docs/ida_ida.md":"# ida_ida\n\nDatabase-wide configuration via the `inf` structure - processor info, file type, address ranges, and analysis flags.\n\n## Key Functions\n\n### Database Properties\n- `inf_get_min_ea()`, `inf_set_min_ea(ea)` - Database address range start\n- `inf_get_max_ea()`, `inf_set_max_ea(ea)` - Database address range end\n- `inf_get_start_ea()`, `inf_set_start_ea(ea)` - Entry point address\n- `inf_get_baseaddr()`, `inf_set_baseaddr(ea)` - Image base address\n- `inf_get_main()`, `inf_set_main(ea)` - Main function address\n\n### Architecture Info\n- `inf_is_16bit()`, `inf_is_32bit_exactly()`, `inf_is_64bit()` - Architecture bit width\n- `inf_set_32bit(v)`, `inf_set_64bit(v)` - Set architecture\n- `inf_is_be()`, `inf_set_be(v)` - Big-endian check/set\n- `inf_is_dll()`, `inf_set_dll(v)` - DLL vs executable\n\n### File Information\n- `inf_get_procname()`, `inf_set_procname(name)` - Processor name (x86, ARM, etc.)\n- `inf_get_filetype()`, `inf_set_filetype(ft)` - File type (f_PE, f_ELF, f_MACHO, etc.)\n- `inf_get_md5()`, `inf_get_sha256()` - File hashes\n- `inf_get_input_file_path()` - Original input file path\n- `inf_get_imagebase()` - PE/ELF image base\n\n### Analysis Flags\n- `inf_get_af()`, `inf_set_af(flags)` - Get/set all analysis flags\n- `inf_get_af2()`, `inf_set_af2(flags)` - Secondary analysis flags\n- Analysis flag constants: AF_CODE, AF_JUMPTBL, AF_PROC, AF_LVAR, AF_TRACE, AF_FLIRT, etc.\n\n### Display Options\n- `inf_is_graph_view()`, `inf_set_graph_view(v)` - Default to graph vs text view\n- `inf_get_indent()`, `inf_set_indent(n)` - Disassembly indentation\n- `inf_get_margin()`, `inf_set_margin(n)` - Right margin\n\n### Database State\n- `inf_is_auto_enabled()`, `inf_set_auto_enabled(v)` - Auto-analysis state\n- `inf_readonly_idb()`, `inf_set_readonly_idb(v)` - Read-only mode\n- `inf_get_database_change_count()` - Change counter (for caching)\n\n### Compiler Info\n- `inf_get_cc_id()`, `inf_set_cc_id(id)` - Calling convention ID\n- `inf_get_cc_size_i()`, `inf_get_cc_size_l()` - sizeof(int), sizeof(long)\n- `inf_get_abibits()`, `inf_set_abibits(bits)` - ABI flags\n\n## Key Constants\n\n**File types**: f_PE, f_ELF, f_MACHO, f_BIN, f_COFF, f_OMF, f_AOUT, f_HEX\n\n**Analysis flags**: AF_CODE (create instructions), AF_JUMPTBL (analyze jump tables), AF_PROC (create functions), AF_LVAR (local variables), AF_FLIRT (apply FLIRT signatures)\n\n**Loader flags**: LFLG_64BIT, LFLG_IS_DLL, LFLG_PC_FLAT (flat memory model)\n\n**Name display**: NM_REL_OFF (show offsets), NM_EA (show addresses), NM_SHORT (short names)\n\n**Demangling**: DEMNAM_GCC3 (GCC v3 ABI), DEMNAM_CMNT (show in comments), DEMNAM_NAME (show as name)\n\n## See Also\nFull docs: skill/docs/ida_ida.rst\n","skills/idapython/docs/ida_idaapi.md":"# ida_idaapi\n\nCore IDAPython infrastructure - plugin system, type definitions, and Python integration utilities.\n\n## Key Constants\n\n### Address Types\n- `ea_t` - Effective address type (int)\n- `BADADDR` - Invalid address sentinel\n- `BADADDR32` - 32-bit invalid address (0xFFFFFFFF)\n- `BADADDR64` - 64-bit invalid address (0xFFFFFFFFFFFFFFFF)\n\n### Plugin Return Codes\n- `PLUGIN_SKIP` - Plugin init failed, unload\n- `PLUGIN_OK` - Plugin loaded successfully\n- `PLUGIN_KEEP` - Keep plugin loaded\n\n## Key Functions\n\n- `require(modulename, package=None)` - Load or reload module (forces reload for development)\n- `notify_when(when, callback)` - Register event callbacks (NW_OPENIDB, NW_CLOSEIDB, etc.)\n- `as_cstr(s)` - Convert to C string\n- `as_uint32(v)`, `as_int32(v)`, `as_signed(v)` - Type conversions\n- `IDAPython_ExecScript(path)` - Execute Python script\n- `set_script_timeout(seconds)`, `disable_script_timeout()` - Script execution limits\n\n## Key Classes\n\n### plugin_t\nBase class for IDA plugins.\n- Override `init()`, `run()`, `term()` methods\n- Set `flags`, `comment`, `help`, `wanted_name`, `wanted_hotkey`\n\n### plugmod_t\nModern plugin module interface (IDA 7.2+).\n- Override `run(arg)` method\n- Supports multiple plugin instances\n\n## See Also\nFull docs: skill/docs/ida_idaapi.rst\n","skills/idapython/docs/ida_idc.md":"# ida_idc\n\nMarked positions (bookmarks) in IDA database - low priority module with limited scope.\n\n## Key Functions\n\n- `mark_position(ea, lnnum, x, y, slot, comment)` - Create bookmark at address in slot (0-1023)\n- `get_marked_pos(slot)` - Get address of bookmark in slot\n- `get_mark_comment(slot)` - Get comment for bookmark in slot\n\n## See Also\nFull docs: skill/docs/ida_idc.rst\n","skills/idapython/docs/ida_idd.md":"# ida_idd\n\nInterface to debugger modules - defines structures for target processor debugging and API.\n\n## Key Classes/Functions\n\n### debug_event_t\nDebug event information container\n- `eid()` - get event type (PROCESS_STARTED, BREAKPOINT, EXCEPTION, etc.)\n- `modinfo()` - module info for PROCESS_STARTED/LIB_LOADED\n- `exc()` - exception details for EXCEPTION events\n- `bpt()` - breakpoint addresses\n\n### debugger_t\nDebugger module interface\n- `get_debug_event(event, timeout_ms)` - wait for debug event\n- `resume(event)` - continue execution\n- `read_registers(tid, clsmask, values)` - read thread registers\n- `write_register(tid, regidx, value)` - write thread register\n- `read_memory(nbytes, ea, buffer, size)` - read process memory\n- `write_memory(nbytes, ea, buffer, size)` - write process memory\n- `update_bpts(nbpts, bpts, nadd, ndel)` - add/delete breakpoints\n\n### regval_t\nRegister value container\n- `set_int(x)` - set integer value\n- `set_float(v)` - set floating point\n- `pyval(dtype)` - get Python value\n\n### Python Helpers\n- `dbg_read_memory(ea, sz)` - read debuggee memory, returns bytes or None\n- `dbg_write_memory(ea, buffer)` - write bytes to debuggee\n- `dbg_get_registers()` - get register definitions\n- `dbg_get_memory_info()` - get memory layout\n\n## Event Types\n- PROCESS_STARTED, PROCESS_EXITED, PROCESS_ATTACHED, PROCESS_DETACHED\n- THREAD_STARTED, THREAD_EXITED\n- BREAKPOINT, STEP, EXCEPTION\n- LIB_LOADED, LIB_UNLOADED\n\n## See Also\nFull docs: skill/docs/ida_idd.rst\n","skills/idapython/docs/ida_idp.md":"# ida_idp\n\nInterface to processor modules - defines target assembler and processor features.\n\n## Key Classes/Functions\n\n### Instruction Analysis\n- `is_call_insn(insn)` - is instruction a call?\n- `is_ret_insn(insn, flags)` - is instruction a return?\n- `is_indirect_jump_insn(insn)` - is instruction an indirect jump?\n- `is_basic_block_end(insn, call_stops_block)` - does instruction end a basic block?\n- `has_cf_chg(feature, opnum)` - does instruction modify operand?\n- `has_cf_use(feature, opnum)` - does instruction use operand value?\n\n### Processor Info\n- `get_ph()` - get processor_t structure\n- `get_ash()` - get assembler asm_t structure\n- `set_processor_type(processor_name, level)` - change processor module\n- `get_idp_name()` - get current processor name\n- `str2reg(regname)` - convert register name to index\n- `get_reg_name(regidx, width)` - get register name\n\n### processor_t\nGlobal processor structure (accessed via `ph`)\n- `ph.id` - processor ID (PLFM_386, PLFM_ARM, PLFM_MIPS, etc.)\n- `ph.flag` - processor flags (PR_SEGS, PR_USE32, PR_USE64, etc.)\n- `ph.cnbits` / `ph.dnbits` - code/data address bits\n- `ph_get_instruc()` - get instruction names\n\n### Instruction Features (CF_*)\n- CF_STOP - doesn't continue execution\n- CF_CALL - call instruction\n- CF_CHG1..CF_CHG8 - modifies operand 1-8\n- CF_USE1..CF_USE8 - uses operand 1-8\n- CF_JUMP - indirect jump/call\n\n## See Also\nFull docs: skill/docs/ida_idp.rst\n","skills/idapython/docs/ida_ieee.md":"# ida_ieee\n\nIEEE floating point conversion utilities.\n\n## Key Classes/Functions\n\n### fpvalue_t\nIEEE floating point value representation (internal format)\n- `from_str(p)` - parse from string\n- `to_str(buf, bufsize, mode)` - convert to string\n- `from_sval(x)` / `to_sval(round)` - convert to/from signed integer\n- `from_int64(x)` / `to_int64(round)` - convert to/from 64-bit int\n- `from_uint64(x)` / `to_uint64(round)` - convert to/from unsigned 64-bit\n- `from_10bytes(fpval)` / `to_10bytes(fpval)` - 10-byte float conversions\n- `from_12bytes(fpval)` / `to_12bytes(fpval)` - 12-byte float conversions\n- `fadd(y)`, `fsub(y)`, `fmul(y)`, `fdiv(y)` - arithmetic operations\n- `eabs()`, `negate()` - absolute value and negation\n- `is_negative()` - check sign\n- `get_kind()` - get value kind (FPV_NORM, FPV_NAN, FPV_PINF, FPV_NINF)\n\n## Error Codes\n- REAL_ERROR_OK, REAL_ERROR_FORMAT, REAL_ERROR_RANGE\n- REAL_ERROR_BADDATA, REAL_ERROR_FPOVER, REAL_ERROR_BADSTR\n- REAL_ERROR_ZERODIV, REAL_ERROR_INTOVER\n\n## See Also\nFull docs: skill/docs/ida_ieee.rst\n","skills/idapython/docs/ida_kernwin.md":"# ida_kernwin\n\nInterface between kernel and UI - dialogs, menus, choosers, custom viewers, and UI utilities.\n\n## Key Functions\n\n### User Interaction\n- `msg(fmt, ...)` - print to output window\n- `warning(fmt, ...)` / `error(fmt, ...)` - show warning/error dialog\n- `ask_yn(defval, fmt, ...)` - yes/no question\n- `ask_str(defval, hist, fmt, ...)` - string input\n- `ask_long(defval, fmt, ...)` - integer input\n- `ask_addr(defval, fmt, ...)` - address input\n- `ask_file(forsave, defval, fmt, ...)` - file chooser\n\n### Navigation\n- `jumpto(ea, opnum=-1, uijmp_flags=0)` - jump to address\n- `get_screen_ea()` - current cursor address\n- `read_selection()` - get selected address range\n- `choose_func(title)` - let user choose a function\n- `choose_name(ea, title)` - let user choose a name\n\n### UI Elements\n- `find_widget(title)` - find widget by title\n- `activate_widget(widget, take_focus)` - activate widget\n- `close_widget(widget, flags)` - close widget\n- `open_*_window(ea)` - open disasm/hex/exports/imports/etc window\n\n### Actions\n- `register_action(desc)` - register menu action\n- `unregister_action(name)` - unregister action\n- `attach_action_to_menu(path, name, flags)` - add action to menu\n- `attach_action_to_toolbar(toolbar, name)` - add to toolbar\n- `update_action_*()` - update action state/label/icon/etc\n\n### Choosers (Lists)\n- `Choose` class - create custom list windows\n- `choose_refresh()` - refresh chooser\n- `get_chooser_obj(title)` - get chooser Python object\n\n### Custom Viewers\n- `create_empty_widget(title)` - empty widget\n- `create_code_viewer(widget, custviewer, flags)` - code viewer\n- `simplecustviewer_t` - simple text viewer\n\n### Misc\n- `execute_sync(func, reqf)` - execute in UI thread\n- `refresh_idaview()` / `refresh_idaview_anyway()` - refresh disassembly\n- `beep(type)` - system beep\n- `get_highlight(viewer)` - get highlighted identifier\n- `set_highlight(viewer, text, flags)` - set highlight\n\n## Widget Types (BWN_*)\nDISASM, HEXVIEW, OUTPUT, FUNCS, NAMES, STRINGS, SEGS, IMPORTS, EXPORTS, PSEUDOCODE, etc.\n\n## See Also\nFull docs: skill/docs/ida_kernwin.rst\n","skills/idapython/docs/ida_libfuncs.md":"# ida_libfuncs\n\nFLIRT signature library metadata and access.\n\n## Key Functions\n\n- `get_idasgn_header_by_short_name(out_header, name)` - get signature header by short name\n- `get_idasgn_path_by_short_name(name)` - get full path to signature file\n\n## idasgn_header_t\n\nSignature file header structure\n- `processor_id` - target processor\n- `file_formats` - supported file formats\n- `ostype` - OS type (OSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_UNIX, etc.)\n- `apptype` - application type (APPT_CONSOLE, APPT_GRAPHIC, APPT_LIBRARY, APPT_DRIVER, etc.)\n- `libname_length` - library name length\n- `number_of_modules` - module count\n- `ctype_name` - compiler type name\n\n## Constants\n\n### OS Types\nOSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_OS2, OSTYPE_NETW, OSTYPE_UNIX, OSTYPE_OTHER\n\n### Application Types\n- APPT_CONSOLE, APPT_GRAPHIC, APPT_PROGRAM, APPT_LIBRARY, APPT_DRIVER\n- APPT_1THREAD, APPT_MTHREAD\n- APPT_16BIT, APPT_32BIT, APPT_64BIT\n\n## See Also\nFull docs: skill/docs/ida_libfuncs.rst\n","skills/idapython/docs/ida_lines.md":"# ida_lines\n\nLine rendering and text generation for disassembly output.\n\n## Key Functions\n\n### Line Generation\n- `generate_disasm_line(ea, flags)` - generate disassembly line at ea\n- `generate_many_lines(ea, flags)` - generate multiple lines (includes function header, etc.)\n- `tag_remove(tagged_line)` - remove color tags from line\n- `tag_skipcode(p)` - skip color tag at position\n- `tag_advance(p, cnt)` - advance by cnt printable characters\n\n### Color Tags\n- `SCOLOR_*` constants - color tag markers (instructions, registers, comments, etc.)\n- Lines contain embedded color codes (e.g., `\\x01` for instruction color)\n\n### Line Prefix/Suffix\n- `gl_comm` / `set_gl_comm(start, end)` - comment delimiters\n- `inf_get_indent()` - get indentation amount\n\n## Common Use Cases\n\nGenerate colored disassembly:\n```python\nline = ida_lines.generate_disasm_line(ea, 0)\nplain = ida_lines.tag_remove(line)\n```\n\n## Low Priority\n\nThis module is mostly for display formatting. Core analysis uses ida_ua (instruction decoding) and ida_bytes (data access) instead.\n\n## See Also\nFull docs: skill/docs/ida_lines.rst\n","skills/idapython/docs/ida_loader.md":"# ida_loader\n\nLoader and file operations - loading binaries, database management, file I/O, and plugin loading.\n\n## Key Functions\n\n### Database Operations\n- `save_database(outfile=None, flags=-1, root=None, attr=None)` - Save database with optional new filename\n- `flush_buffers()` - Flush buffers to disk\n- `is_trusted_idb()` - Check if database is trusted\n- `get_path(pt)` / `set_path(pt, path)` - Get/set file paths (PATH_TYPE_CMD, PATH_TYPE_IDB, PATH_TYPE_ID0)\n\n### File Loading\n- `load_binary_file(filename, li, neflags, fileoff, basepara, binoff, nbytes)` - Load binary into database\n- `file2base(li, pos, ea1, ea2, patchable)` - Load file portion into address range\n- `mem2base(mem, ea, fpos)` - Load from memory buffer\n- `reload_file(file, is_remote)` - Reload input file bytes without losing analysis\n- `base2file(fp, pos, ea1, ea2)` - Unload database to binary file\n\n### File Type Detection\n- `get_basic_file_type(li)` - Recognize file type (libraries, zip, etc.)\n- `get_file_type_name()` - Get current file type name (from idainfo.filetype)\n\n### Output Generation\n- `gen_file(otype, fp, ea1, ea2, flags)` - Generate output files (MAP, EXE, IDC, LST, ASM, DIF)\n- `gen_exe_file(fp)` - Generate executable file from database\n\n### File/Memory Mapping\n- `get_fileregion_offset(ea)` - Get file offset for linear address (returns -1 if unmapped)\n- `get_fileregion_ea(offset)` - Get linear address for file offset (returns BADADDR if not found)\n\n### Plugin Management\n- `load_plugin(name)` - Load plugin by name or path\n- `run_plugin(plg, arg)` - Run loaded plugin with argument\n- `load_and_run_plugin(name, arg)` - Load and run plugin in one call\n- `find_plugin(name, load_if_needed=False)` - Find plugin, optionally loading it\n- `get_plugin_options(plugin)` - Get -Oplugin:options from command line\n\n### Import/IDS\n- `set_import_ordinal(modnode, ea, ord)` - Set ordinal import entry info\n- `set_import_name(modnode, ea, name)` - Set named import entry info\n- `load_ids_module(fname)` - Load and apply IDS file\n\n### Archives\n- `process_archive(temp_file, li, module_name, neflags, defmember, loader)` - Process archive file\n- `extract_module_from_archive(fname, is_remote=False)` - Extract module from archive interactively\n\n### Snapshots\n- `build_snapshot_tree(root)` - Build snapshot tree structure\n\n## Key Classes\n\n### snapshot_t\nDatabase snapshot representation.\n- `id` - Snapshot ID (qtime64_t timestamp)\n- `flags` - Snapshot flags (SSF_AUTOMATIC, etc.)\n- `desc` - Description string (max 128 chars)\n- `filename` - Snapshot filename\n- `children` - Child snapshots\n\n### plugin_info_t\nPlugin metadata.\n- `path` - Full plugin path\n- `name` - Short name (appears in menu)\n- `hotkey` - Current hotkey\n- `flags` - Plugin flags\n- `comment` - Plugin comment\n\n### loader_t\nLoader module interface (low-priority: advanced loader development only).\n\n### idp_desc_t / idp_name_t\nProcessor module metadata (low-priority: processor module development).\n\n## Key Flags\n\n### Load Flags (NEF_*)\n- `NEF_FIRST` - First file loaded into database\n- `NEF_SEGS` - Create segments\n- `NEF_CODE` - Load as code segment\n- `NEF_RELOAD` - Reload at same place (don't recreate segments/fixups)\n- `NEF_FLAT` - Autocreate FLAT group (PE)\n\n### Database Flags (DBFL_*)\n- `DBFL_KILL` - Delete unpacked database\n- `DBFL_COMP` - Collect garbage\n- `DBFL_BAK` - Create backup file\n- `DBFL_TEMP` - Temporary database\n\n### Output File Types (OFILE_*)\n- `OFILE_MAP` - MAP file\n- `OFILE_EXE` - Executable\n- `OFILE_IDC` - IDC script\n- `OFILE_LST` - Disassembly listing\n- `OFILE_ASM` - Assembly\n- `OFILE_DIF` - Difference\n\n## See Also\nFull docs: skill/docs/ida_loader.rst\n","skills/idapython/docs/ida_merge.md":"# ida_merge\n\nIDA Teams merge functionality - 3-way merging of IDB files (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for IDA Teams only. Handles merging of base_idb, local_idb, and remote_idb databases with conflict resolution.\n\n## Key Concepts\n\n- **base_idb**: Common ancestor database (middle pane in UI)\n- **local_idb**: Local database receiving merge result (left pane)\n- **remote_idb**: Remote database merging into local (right pane)\n\n## Merge Phases\nMerges occur in phases: global settings, segmentation, bytes, names, functions, types, debugger settings, etc.\n\n## Key Functions\n\n- `is_diff_merge_mode()` - Check if in merge/diff mode\n- `create_nodeval_merge_handler()` / `create_nodeval_merge_handlers()` - Create merge handlers for custom data\n- `destroy_moddata_merge_handlers()` - Destroy module data merge handlers\n- `get_ea_diffpos_name()` - Get name of EA difference position\n\n## Key Classes\n\n### merge_data_t\nMerge operation data container.\n\n### merge_handler_params_t\nParameters for creating merge handlers.\n\n### merge_node_helper_t / merge_node_info_t\nHelpers for merging netnode data.\n\n## Merge Kinds (MERGE_KIND_*)\nExtensive list including: NETNODE, INF, SEGMENTS, FUNC, FRAME, EXPORTS, IMPORTS, ENUMS, STRUCTS, TILS, TINFO, BYTEVAL, FLAGS, CREFS, DREFS, BPTS, DEBUGGER, etc.\n\n## See Also\nFull docs: skill/docs/ida_merge.rst\n","skills/idapython/docs/ida_mergemod.md":"# ida_mergemod\n\nHelper functions for plugin/processor module merging in IDA Teams (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for plugin/processor developers needing to merge custom module data. Used in response to `ev_create_merge_handlers` event.\n\n## Key Function\n\n- `create_std_modmerge_handlers(mhp, helper, merge_node_info=None)` - Create standard merge handlers for module data\n\n## Merge Sources Supported\n1. Data fields inside moddata (plugmod_t/procmod_t)\n2. Values in module netnode\n3. Values in arbitrary netnodes\n4. Data fields in auxiliary structures\n5. Indexed arrays in netnodes\n\n## See Also\nFull docs: skill/docs/ida_mergemod.rst\nExamples: plugins/mex1, plugins/mex2, plugins/mex3, plugins/ex_merge_ldrdata\n","skills/idapython/docs/ida_moves.md":"# ida_moves\n\nNavigation history, bookmarks, and location tracking in IDA views.\n\n## Key Classes\n\n### lochist_entry_t\nLocation history entry combining place and renderer info.\n- `rinfo` - Renderer information (renderer_info_t)\n- `plce` - Place pointer (place_t*)\n- `place()` / `set_place(p)` - Get/set place\n- `is_valid()` - Check if entry is valid\n- `renderer_info()` - Get renderer info reference\n\n### navstack_entry_t\nNavigation stack entry extending lochist_entry_t.\n- `widget_id` - Widget identifier\n- `ud_str` - User-defined string\n- Inherits all lochist_entry_t members\n\n### navstack_t\nNavigation history stack (back/forward navigation).\n- `init(defpos, stream_name, flags)` - Initialize stack\n- `set_current(e, in_charge)` / `get_current(out, widget_id)` - Set/get current position\n- `stack_jump(try_to_unhide, e)` - Jump to entry\n- `stack_back(out, cnt, try_to_unhide)` / `stack_forward(out, cnt, try_to_unhide)` - Navigate backward/forward\n- `stack_nav(out, forward, cnt, try_to_unhide)` - Generic navigation\n- `stack_index()` / `stack_size()` - Get current index/size\n- `stack_clear(new_tip)` - Clear stack with new tip\n- `get_stack_entry(out, index)` / `set_stack_entry(index, e)` - Get/set entry at index\n- `is_history_enabled()` - Check if history is enabled\n\n### bookmarks_t\nBookmark management (static methods).\n- `mark(e, index, title, desc, ud)` - Create/update bookmark\n- `get(out, index, ud)` - Get bookmark entry\n- `get_desc(e, index, ud)` - Get bookmark description\n- `find_index(e, ud)` - Find bookmark index\n- `size(e, ud)` - Get bookmark count\n- `erase(e, index, ud)` - Delete bookmark\n- `get_dirtree_id(e, ud)` - Get dirtree ID for bookmark\n\n### renderer_info_t\nView renderer state (graph position, zoom, cursor).\n- `rtype` - Renderer type (tcc_renderer_type_t)\n- `gli` - Graph location info (graph_location_info_t)\n- `pos` - Position info (renderer_info_pos_t)\n\n### graph_location_info_t\nGraph view location and zoom state.\n- `zoom` - Zoom level\n- `orgx` / `orgy` - Origin coordinates\n\n### segm_move_info_t / segm_move_infos_t\nSegment relocation tracking (for when segments move).\n- `to` - Target address\n- `size` - Size moved\n- `find(ea)` - Find move info for address\n\n## Constants\n\n### Location State Flags (LSEF_*)\n- `LSEF_PLACE` - Place component\n- `LSEF_RINFO` - Renderer info component\n- `LSEF_PTYPE` - Place type component\n- `LSEF_ALL` - All components\n\n### Unhide Flags (UNHID_*)\n- `UNHID_SEGM` - Unhid segment at target\n- `UNHID_FUNC` - Unhid function at target\n- `UNHID_RANGE` - Unhid range at target\n\n### Other Constants\n- `MAX_MARK_SLOT` - Maximum bookmark slot number\n- `LHF_HISTORY_DISABLED` - History disabled flag\n- `DEFAULT_CURSOR_Y` / `DEFAULT_LNNUM` - Default cursor position\n\n## See Also\nFull docs: skill/docs/ida_moves.rst\n","skills/idapython/docs/ida_nalt.md":"# ida_nalt\n\nNetnode-based storage for various analysis information - switch tables, references, types, strings, imports, metadata.\n\n## Key Functions\n\n### Netnode Access\n- `ea2node(ea)` / `node2ea(node)` - Convert between addresses and netnodes\n- `end_ea2node(ea, size)` - Get netnode for address range end\n- `getnode(ea)` - Get netnode for address\n\n### Address Flags (AFL_*)\nExtensive flag system for tracking analysis state at addresses.\n\n#### Query Flags\n- `get_aflags(ea)` / `set_aflags(ea, flags)` / `del_aflags(ea)` - Get/set/delete flags\n- `upd_abits(ea, set, clr)` / `set_abits(ea, bits)` / `clr_abits(ea, bits)` - Update address bits\n- `is_hidden_item(ea)` / `hide_item(ea)` / `unhide_item(ea)` - Item visibility\n- `is_hidden_border(ea)` / `hide_border(ea)` / `unhide_border(ea)` - Border visibility\n- `is_colored_item(ea)` / `set_colored_item(ea)` / `clr_colored_item(ea)` - Colored items\n- `is_usersp(ea)` / `set_usersp(ea)` / `clr_usersp(ea)` - User stack pointer\n- `uses_modsp(ea)` / `set_usemodsp(ea)` / `clr_usemodsp(ea)` - Modified stack pointer\n- `is_libitem(ea)` / `set_libitem(ea)` / `clr_libitem(ea)` - Library item\n- `is_noret(ea)` / `set_noret(ea)` / `clr_noret(ea)` - No-return function\n- `is_notcode(ea)` / `set_notcode(ea)` / `clr_notcode(ea)` - Not code\n- `is_notproc(ea)` / `set_notproc(ea)` / `clr_notproc(ea)` - Not procedure\n- `is_type_guessed_by_ida(ea)` / `set_type_guessed_by_ida(ea)` - IDA type guess\n- `is_func_guessed_by_hexrays(ea)` / `set_func_guessed_by_hexrays(ea)` - Hex-Rays function guess\n- `is_data_guessed_by_hexrays(ea)` / `set_data_guessed_by_hexrays(ea)` - Hex-Rays data guess\n- `is_type_determined_by_hexrays(ea)` / `set_type_determined_by_hexrays(ea)` - Hex-Rays type determination\n\n### Type Information\n- `get_tinfo(tif, ea)` / `set_tinfo(ea, tif)` / `del_tinfo(ea)` - Address type info\n- `get_op_tinfo(tif, ea, opnum)` / `set_op_tinfo(ea, opnum, tif)` / `del_op_tinfo(ea, opnum)` - Operand type info\n- `has_ti(ea)` / `has_ti0(ea)` / `has_ti1(ea)` - Check if type info exists\n\n### String Types\n- `get_str_type(ea)` / `set_str_type(ea, strtype)` / `del_str_type(ea)` - String type at address\n- `get_str_type_code(strtype)` - Get string type code\n- `get_str_term1(strtype)` / `get_str_term2(strtype)` - String terminators\n- `get_str_encoding_idx(ea)` / `set_str_encoding_idx(ea, idx)` - String encoding\n- `make_str_type(base, lyt)` - Construct string type code\n- `is_pascal(strtype)` - Check if Pascal string\n- `get_str_type_prefix_length(strtype)` - Get prefix length\n\n### References and Offsets\n- `get_refinfo(ri, ea, opnum)` / `set_refinfo(ea, opnum, type, target, base, tdelta)` / `del_refinfo(ea, opnum)` - Reference info\n- `set_refinfo_ex(ea, opnum, ri)` - Set reference info with refinfo_t\n- `get_custom_refinfo(out, cfmt)` / `find_custom_refinfo(cfmt)` - Custom reference formats\n- `get_reftype_by_size(size)` - Get reference type by size\n- `is_reftype_target_optional(rt)` - Check if target is optional\n\n### Switch Tables\n- `get_switch_info(si, ea)` / `set_switch_info(ea, si)` / `del_switch_info(ea)` - Switch info\n- `get_switch_parent(ea)` / `set_switch_parent(ea, parent)` / `del_switch_parent(ea)` - Switch parent\n\n### Arrays\n- `get_array_parameters(out, ea)` / `set_array_parameters(ea, params)` / `del_array_parameters(ea)` - Array display parameters\n\n### Custom Data Types\n- `get_custom_data_type_ids(out, ea)` / `set_custom_data_type_ids(ea, ids)` / `del_custom_data_type_ids(ea)` - Custom data types\n\n### Colors and Alignment\n- `get_item_color(ea)` / `set_item_color(ea, color)` / `del_item_color(ea)` - Item color\n- `get_alignment(ea)` / `set_alignment(ea, align)` / `del_alignment(ea)` - Alignment\n\n### Source Line Numbers\n- `get_source_linnum(ea)` / `set_source_linnum(ea, lnnum)` / `del_source_linnum(ea)` - Source line mapping\n\n### Absolute Base\n- `get_absbase(ea)` / `set_absbase(ea, base)` / `del_absbase(ea)` - Absolute segment base\n\n### File Metadata\n- `get_root_filename()` / `set_root_filename(path)` - Input file root name\n- `get_input_file_path()` - Input file full path\n- `dbg_get_input_path()` - Debugger input path\n- `retrieve_input_file_size()` - File size\n- `retrieve_input_file_crc32()` / `retrieve_input_file_md5()` / `retrieve_input_file_sha256()` - File hashes\n- `get_archive_path()` / `set_archive_path(path)` - Archive path\n- `get_loader_format_name()` / `set_loader_format_name(name)` - Loader format\n\n### IDB Version and Timing\n- `get_initial_ida_version()` / `get_initial_idb_version()` - IDA/IDB versions\n- `get_idb_ctime()` - IDB creation time\n- `get_elapsed_secs()` - Analysis elapsed time\n- `get_idb_nopens()` - IDB open count\n\n### Image Base\n- `get_imagebase()` / `set_imagebase(base)` - Image base address\n\n### String Encodings\n- `get_encoding_qty()` - Number of encodings\n- `get_encoding_name(idx)` - Encoding name\n- `add_encoding(name, bpu)` / `del_encoding(idx)` / `rename_encoding(idx, name)` - Manage encodings\n- `get_encoding_bpu(idx)` / `get_encoding_bpu_by_name(name)` - Bytes per unit\n- `get_strtype_bpu(strtype)` - String type bytes per unit\n- `get_default_encoding_idx()` / `set_default_encoding_idx(idx)` - Default encoding\n- `get_outfile_encoding_idx()` / `set_outfile_encoding_idx(idx)` - Output file encoding\n- `encoding_from_strtype(strtype)` - Get encoding from string type\n\n### Imports\n- `get_import_module_qty()` - Number of import modules\n- `get_import_module_name(idx)` - Import module name\n- `enum_import_names(idx, callback)` - Enumerate imports\n- `delete_imports()` - Delete all imports\n\n### GOT/PLT\n- `get_gotea()` / `set_gotea(ea)` - Global Offset Table address\n\n### Notepad\n- `get_ida_notepad_text()` / `set_ida_notepad_text(text)` - IDA notepad text\n\n### Source Debug Paths\n- `get_srcdbg_paths()` / `set_srcdbg_paths(paths)` - Source debug paths\n- `get_srcdbg_undesired_paths()` / `set_srcdbg_undesired_paths(paths)` - Undesired debug paths\n\n### Assembly Include\n- `get_asm_inc_file()` / `set_asm_inc_file(file)` - Assembly include file\n\n### IDS Modules\n- `get_ids_modnode()` / `set_ids_modnode(node)` - IDS module netnode\n\n### ABI\n- `get_abi_name()` - ABI name\n\n## Key Classes\n\n### switch_info_t\nSwitch statement information.\n- `flags` - Switch flags (SWI_*)\n- `ncases` - Number of cases (excluding default)\n- `jumps` - Jump table start address\n- `values` - Values table address (if SWI_SPARSE)\n- `lowcase` - Lowest case value\n- `defjump` - Default jump address (BADADDR if none)\n- `startea` - Start of switch idiom\n- `jcases` - Jump table entries (if SWI_INDIRECT)\n- `elbase` - Element base\n- `regnum` / `regdtype` - Switch expression register\n- `get_jtable_size()` / `set_jtable_size(size)` - Jump table size\n- `get_jtable_element_size()` / `set_jtable_element_size(size)` - Element size\n- `has_default()` / `is_sparse()` / `is_custom()` / `is_indirect()` / `is_subtract()` - Query flags\n\n### refinfo_t\nReference/offset information.\n- `target` - Reference target (BADADDR if none)\n- `base` - Base of reference (may be BADADDR)\n- `tdelta` - Offset from target\n- `flags` - Reference flags (REFINFO_*)\n- `type()` / `set_type(rt)` - Reference type (REF_OFF16, REF_OFF32, REF_OFF64, etc.)\n- `is_target_optional()` / `no_base_xref()` / `is_pastend()` / `is_rvaoff()` / `is_custom()` / `is_subtract()` / `is_signed()` - Query flags\n- `init()` - Initialize\n\n### array_parameters_t\nArray display parameters.\n- `flags` - Array flags (AP_*)\n- `lineitems` - Items per line\n- `alignment` - Item alignment (-1=don't align, 0=auto, else width)\n- `is_default()` - Check if default\n\n### opinfo_t\nOperand type information union (structure/enum/strpath/custom).\n\n### strpath_t\nStructure path for nested structure member offsets.\n\n### enum_const_t\nEnumeration constant reference.\n\n## Key Constants\n\n### String Types (STRTYPE_*)\n- `STRTYPE_TERMCHR` / `STRTYPE_C` / `STRTYPE_C_16` / `STRTYPE_C_32` - C strings\n- `STRTYPE_PASCAL` / `STRTYPE_PASCAL_16` / `STRTYPE_PASCAL_32` - Pascal strings\n- `STRTYPE_LEN2` / `STRTYPE_LEN2_16` / `STRTYPE_LEN2_32` - 2-byte length prefix\n- `STRTYPE_LEN4` / `STRTYPE_LEN4_16` / `STRTYPE_LEN4_32` - 4-byte length prefix\n\n### String Layout (STRLYT_*)\n- `STRLYT_TERMCHR` / `STRLYT_PASCAL1` / `STRLYT_PASCAL2` / `STRLYT_PASCAL4` - Layout types\n\n### String Width (STRWIDTH_*)\n- `STRWIDTH_1B` / `STRWIDTH_2B` / `STRWIDTH_4B` - Character width\n\n### Reference Types (REF_*)\n- `REF_OFF16` / `REF_OFF32` / `REF_OFF64` - Full offsets\n- `REF_LOW8` / `REF_LOW16` / `REF_HIGH8` / `REF_HIGH16` - Partial offsets\n\n### Reference Info Flags (REFINFO_*)\n- `REFINFO_RVAOFF` - RVA offset\n- `REFINFO_PASTEND` - Past end of segment\n- `REFINFO_CUSTOM` - Custom format\n- `REFINFO_NOBASE` - No base\n- `REFINFO_SUBTRACT` - Subtract instead of add\n- `REFINFO_SIGNEDOP` - Signed operand\n\n### Switch Info Flags (SWI_*)\n- `SWI_SPARSE` - Sparse switch (has values table)\n- `SWI_V32` / `SWI_J32` - 32-bit values/jumps\n- `SWI_USER` - User-defined\n- `SWI_CUSTOM` - Custom switch\n- `SWI_INDIRECT` - Indirect jump table\n\n### Address Flags (AFL_*)\nExtensive flag set including: AFL_LINNUM, AFL_USERSP, AFL_PUBNAM, AFL_WEAKNAM, AFL_HIDDEN, AFL_MANUAL, AFL_NOBRD, AFL_ZSTROFF, AFL_LIB, AFL_TI, AFL_COLORED, AFL_NORET, AFL_FIXEDSPD, AFL_ALIGNFLOW, AFL_USERTI, AFL_RETFP, AFL_USEMODSP, AFL_NOTCODE, AFL_NOTPROC, and type guessing flags.\n\n### Root Info Indices (RIDX_*)\nDatabase-level metadata keys: RIDX_FILE_FORMAT_NAME, RIDX_MD5, RIDX_SHA256, RIDX_IDA_VERSION, RIDX_STR_ENCODINGS, RIDX_SRCDBG_PATHS, RIDX_DBG_BINPATHS, RIDX_ABINAME, RIDX_ARCHIVE_PATH, RIDX_PROBLEMS, etc.\n\n## See Also\nFull docs: skill/docs/ida_nalt.rst\n","skills/idapython/docs/ida_name.md":"# ida_name\n\nName management - getting, setting, validating, and demangling names at addresses.\n\n## Key Functions\n\n### Getting Names\n- `get_name(ea)` - Get name at address (simple form)\n- `get_colored_name(ea)` - Get name with color tags\n- `get_ea_name(ea, gtn_flags=0)` - Get name with flags (alias for get_name with flags)\n- `get_visible_name(ea, gtn_flags=0)` - Get visible name (respects hidden status)\n- `get_short_name(ea, gtn_flags=0)` - Get short form name\n- `get_long_name(ea, gtn_flags=0)` - Get long form name\n- `get_colored_short_name(ea, gtn_flags=0)` - Colored short name\n- `get_colored_long_name(ea, gtn_flags=0)` - Colored long name\n\n### Setting Names\n- `set_name(ea, name, flags=0)` - Set or delete name at address\n- `force_name(ea, name, flags=0)` - Force name (add suffix if needed)\n- `del_global_name(ea)` - Delete global name\n- `del_local_name(ea)` - Delete local name\n- `set_dummy_name(from_ea, ea)` - Generate autogenerated dummy name (loc_, sub_, etc.)\n- `make_name_auto(ea)` - Mark name as autogenerated\n- `make_name_user(ea)` - Mark name as user-defined\n- `make_name_public(ea)` - Make name public\n- `make_name_non_public(ea)` - Make name non-public\n- `make_name_weak(ea)` - Make name weak\n- `make_name_non_weak(ea)` - Make name non-weak\n\n### Name Lookup\n- `get_name_ea(from_ea, name)` - Get address for name (search from address)\n- `get_name_base_ea(from_ea, to_ea)` - Get base address for name\n- `get_name_value(from_ea, name)` - Get name value\n\n### Name Visibility\n- `hide_name(ea)` - Hide name from display\n- `show_name(ea)` - Show previously hidden name\n\n### Name Validation\n- `is_valid_cp(cp, kind, data=None)` - Check if codepoint is valid for name type\n- `is_ident_cp(cp)` - Check if codepoint is valid identifier character\n- `is_strlit_cp(cp, ranges=None)` - Check if valid in string literal\n- `is_visible_cp(cp)` - Check if codepoint is visible\n- `is_ident(name)` - Check if valid identifier\n- `is_uname(name)` - Check if valid user name\n- `is_valid_typename(name)` - Check if valid type name\n- `validate_name(name, type, flags=1)` - Validate name for type with flags\n- `cleanup_name(ea, name, flags=0)` - Clean up name (remove invalid chars)\n- `extract_name(line, x)` - Extract name from line at position\n\n### Name List\n- `get_nlist_size()` - Get name list size\n- `get_nlist_idx(ea)` - Get index in name list\n- `is_in_nlist(ea)` - Check if address is in name list\n- `get_nlist_ea(idx)` - Get address at name list index\n- `get_nlist_name(idx)` - Get name at name list index\n- `rebuild_nlist()` - Rebuild name list\n- `reorder_dummy_names()` - Reorder dummy names\n\n### Debug Names\n- `set_debug_name(ea, name)` - Set debug name (from debug info)\n- `get_debug_name(ea_ptr, how)` - Get debug name with transform\n- `del_debug_names(ea1, ea2)` - Delete debug names in range\n- `get_debug_name_ea(name)` - Get address for debug name\n- `get_debug_names(...)` - Get all debug names\n- `is_name_defined_locally(...)` - Check if name is locally defined\n\n### Name Demangling\n- `demangle_name(name, disable_mask, demreq=DQT_FULL)` - Demangle C++ name\n- `get_demangled_name(ea, inhibitor, demform, gtn_flags=0)` - Get demangled name at address\n- `get_mangled_name_type(name)` - Get mangled name type (CODE, DATA, UNKNOWN)\n\n### Utility\n- `calc_gtn_flags(fromaddr, ea)` - Calculate get name flags\n- `set_cp_validity(...)` / `get_cp_validity(...)` - Set/get codepoint validity\n\n## Key Flags\n\n### Set Name Flags (SN_*)\n- `SN_CHECK` - Fail if name contains invalid characters\n- `SN_NOCHECK` - Replace invalid characters silently with '_'\n- `SN_PUBLIC` / `SN_NON_PUBLIC` - Make public/non-public\n- `SN_WEAK` / `SN_NON_WEAK` - Make weak/non-weak\n- `SN_AUTO` / `SN_NON_AUTO` - Make autogenerated/non-autogenerated\n- `SN_NOLIST` - Exclude from name list\n- `SN_NOWARN` - Don't display warning if failed\n- `SN_LOCAL` - Create local name (requires function context)\n- `SN_IDBENC` - Name is in IDB encoding\n- `SN_FORCE` - Add numerical suffix if name exists (_123)\n- `SN_NODUMMY` - Prepend '_' if name begins with dummy suffix\n- `SN_DELTAIL` - Delete hindering item if tail byte conflicts\n- `SN_MULTI` - Add as alternative name comment if name exists\n- `SN_MULTI_FORCE` - Replace name, move old to comment\n\n### Get Name Flags (GN_*)\n- `GN_VISIBLE` - Get visible name\n- `GN_COLORED` - Include color tags\n- `GN_DEMANGLED` - Get demangled name\n- `GN_STRICT` - Strict name lookup\n- `GN_SHORT` - Short form\n- `GN_LONG` - Long form\n- `GN_LOCAL` - Include local names\n- `GN_ISRET` / `GN_NOT_ISRET` - Is/isn't return value\n- `GN_NOT_DUMMY` - Exclude dummy names\n\n### Get Name Ex Flags (GETN_*)\n- `GETN_APPZERO` - Append zero to result\n- `GETN_NOFIXUP` - Don't apply fixups\n- `GETN_NODUMMY` - Don't return dummy names\n\n### Get Near Comment Flags (GNCN_*)\n- `GNCN_NOSEG` - Don't include segment name\n- `GNCN_NOCOLOR` - No color tags\n- `GNCN_NOLABEL` - Don't include label\n- `GNCN_NOFUNC` - Don't include function name\n- `GNCN_SEG_FUNC` - Include segment and function\n- `GNCN_SEGNUM` - Include segment number\n- `GNCN_REQFUNC` - Require function\n- `GNCN_REQNAME` - Require name\n- `GNCN_NODBGNM` - No debug names\n- `GNCN_PREFDBG` - Prefer debug names\n\n### Debug Name Flags (DEBNAME_*)\n- `DEBNAME_EXACT` - Exact match\n- `DEBNAME_LOWER` - Convert to lowercase\n- `DEBNAME_UPPER` - Convert to uppercase\n- `DEBNAME_NICE` - Nice formatting\n\n### Demangling Flags (DQT_*)\n- `DQT_FULL` - Full demangling\n- `DQT_NAME_TYPE` - Name and type only\n- `DQT_COMPILER` - Compiler-specific\n- `DQT_NPURGED_2` / `DQT_NPURGED_4` / `DQT_NPURGED_8` - Number of purged bytes\n\n### Name Types (NT_*)\n- `NT_NONE` - No name\n- `NT_BYTE` - Byte name\n- `NT_LOCAL` - Local name\n- `NT_STKVAR` - Stack variable\n- `NT_ENUM` - Enum member\n- `NT_ABS` - Absolute symbol\n- `NT_SEG` - Segment\n- `NT_STROFF` - Structure offset\n- `NT_BMASK` - Bitmask\n- `NT_REGVAR` - Register variable\n\n### Validate Name Types (VNT_*)\n- `VNT_IDENT` - Identifier\n- `VNT_TYPE` - Type name\n- `VNT_UDTMEM` - User-defined type member\n- `VNT_STRLIT` - String literal\n- `VNT_VISIBLE` - Visible name\n\n### Cleanup Name Flags (CN_*)\n- `CN_KEEP_TRAILING_DIGITS` - Keep trailing digits\n- `CN_KEEP_UNDERSCORES` - Keep underscores\n\n### Mangling Flags (MNG_*)\nExtensive demangling control: MNG_NOTYPE, MNG_NORETTYPE, MNG_NOBASEDT, MNG_NOCALLC, MNG_NOTHROW, MNG_SHORT_FORM, MNG_LONG_FORM, etc.\n\n### Calling Conventions (MT_*)\n- `MT_CDECL` / `MT_PASCAL` / `MT_STDCALL` / `MT_FASTCALL` / `MT_THISCALL` / `MT_VECTORCALL` / `MT_REGCALL` - Calling conventions\n- `MT_SYSCALL` / `MT_INTERRUPT` - Special conventions\n\n### Compilers (MT_*)\n- `MT_MSCOMP` - Microsoft compiler\n- `MT_BORLAN` - Borland compiler\n- `MT_WATCOM` - Watcom compiler\n- `MT_GNU` / `MT_GCC3` - GNU/GCC compilers\n- `MT_OTHER` - Other compiler\n\n## Classes\n\n### ea_name_t\nAddress-name pair.\n\n### ea_name_vec_t\nVector of ea_name_t.\n\n### NearestName\nNearest name helper class.\n\n## Constants\n\n- `MAXNAMELEN` - Maximum name length (including terminator)\n- `FUNC_IMPORT_PREFIX` - Import function prefix\n- `MANGLED_CODE` / `MANGLED_DATA` / `MANGLED_UNKNOWN` - Mangled name types\n- Various ignore flags: `ignore_none`, `ignore_regvar`, `ignore_llabel`, `ignore_stkvar`, `ignore_glabel`\n\n## See Also\nFull docs: skill/docs/ida_name.rst\n","skills/idapython/docs/ida_netnode.md":"# ida_netnode\n\nLow-priority: Low-level database storage using B-tree structures. Most reverse engineering tasks use higher-level abstractions instead.\n\n## Key Classes/Functions\n\n### netnode\nPersistent storage object in IDA database. Each netnode has unique ID and may have name, value, and multiple sparse arrays.\n\n- `exist(name)` - check if named netnode exists\n- `create()` - create new netnode\n- `kill()` - delete netnode\n- `get_name()` - retrieve netnode name\n- `rename(newname)` - change netnode name\n- `altval(idx, tag)` - read 32-bit value from altvals array\n- `altset(idx, val, tag)` - write 32-bit value to altvals array\n- `supval(idx, tag)` - read arbitrary-sized object from supvals array\n- `supset(idx, value, tag)` - write arbitrary-sized object to supvals array\n- `hashval(key, tag)` - read value from hash by string key\n- `hashset(key, value, tag)` - write value to hash by string key\n- `getblob(start, tag)` - read large object spanning multiple indexes\n- `setblob(buf, start, tag)` - write large object\n\nArrays use tags to organize data: 'A' for altvals, 'S' for supvals, 'H' for hashvals.\n\n## See Also\nFull docs: skill/docs/ida_netnode.rst\n","skills/idapython/docs/ida_offset.md":"# ida_offset\n\nMedium-priority: Convert operands to offset references and calculate target addresses. Useful when analyzing code that references data structures or global variables.\n\n## Key Functions\n\n- `op_offset_ex(ea, n, ri)` - convert operand to reference using refinfo_t\n- `op_offset(ea, n, ri)` - alias for op_offset_ex\n- `op_plain_offset(ea, n, base)` - convert operand to reference with default type\n- `get_offbase(ea, n)` - get offset base value for operand\n- `get_offset_expression(ea, n, from, offset, flags)` - format offset as \"name+displ\" string\n- `calc_offset_base(ea, n)` - calculate offset base from fixup/segment info\n- `calc_target(from, ea, n, opval)` - calculate target address from offset reference\n- `calc_basevalue(target, base)` - calculate reference base value\n- `can_be_off32(ea)` - check if address contains valid OFF32, return target or BADADDR\n\nOperand numbers may be ORed with OPND_OUTER for Motorola outer offsets.\n\n## See Also\nFull docs: skill/docs/ida_offset.rst\n","skills/idapython/docs/ida_pro.md":"# ida_pro\n\nMedium-priority: Core types, constants, and utility functions. Foundation module for platform detection and common operations.\n\n## Key Constants\n\n- `IDA_SDK_VERSION` - SDK version (9.2)\n- `MAXSTR` - maximum string size\n- `BADDIFF` - invalid diff value\n- `FMT_EA` / `FMT_64` / `FMT_Z` - format string macros\n- `CP_UTF8` / `CP_UTF16` - codepage constants\n- `ENC_UTF8` / `ENC_UTF16LE` / `ENC_WIN1252` - encoding constants\n\n## Key Vector Types\n\n- `intvec_t` / `uintvec_t` - int/uint vectors\n- `int64vec_t` / `uint64vec_t` - 64-bit int vectors\n- `boolvec_t` - boolean vector\n- `strvec_t` - string vector\n- `eavec_t` - ea_t vector\n- Standard methods: `push_back()`, `pop_back()`, `size()`, `at()`, `clear()`, `reserve()`, `find()`, `has()`, `add_unique()`\n\n## Key Functions\n\n- `qexit(code)` - shutdown IDA and exit\n- `extend_sign(v, nbytes, sign_extend)` - sign/zero extend value to 64 bits\n- `log2ceil(d64)` / `log2floor(d64)` - log2 calculations\n- `bitcountr_zero(x)` - count trailing zero bits\n- `is_main_thread()` - check if running on main thread\n- `get_physical_core_count()` / `get_logical_core_count()` - CPU core info\n\n## Platform Macros\n\nPreprocessor defines: `__NT__` (Windows), `__LINUX__`, `__MAC__`, `__EA64__` (64-bit addresses), `__X64__` / `__X86__`, `__ARM__`, `__PPC__`\n\n## See Also\nFull docs: skill/docs/ida_pro.rst\n","skills/idapython/docs/ida_problems.md":"# ida_problems\n\nLow-priority: Manage problem lists for tracking analysis issues. IDA maintains these lists automatically; mainly used for debugging analysis failures.\n\n## Key Functions\n\n- `remember_problem(type, ea, msg)` - add address to problem list with optional message\n- `get_problem(type, lowea)` - get next problem address >= lowea\n- `forget_problem(type, ea)` - remove address from problem list\n- `is_problem_present(type, ea)` - check if address is in problem list\n- `get_problem_desc(type, ea)` - get human-readable problem description\n- `get_problem_name(type, longname)` - get problem list name\n\n## Problem List Types\n\n- `PR_DISASM` - can't disassemble\n- `PR_HEAD` - already head\n- `PR_ILLADDR` - execution flows beyond limits\n- `PR_BADSTACK` - failed to trace stack pointer\n- `PR_NOXREFS` - can't find references\n- `PR_NOBASE` - can't find offset base\n- `PR_ATTN` - attention, probably erroneous\n- `PR_FINAL` - IDA decision to convert to instruction/data\n- `PR_ROLLED` - IDA decision was wrong and rolled back\n- `PR_COLLISION` - FLAIR collision\n- `PR_DECIMP` - FLAIR match indecision\n\nView problems from View → Subviews → Problems menu.\n\n## See Also\nFull docs: skill/docs/ida_problems.rst\n","skills/idapython/docs/ida_range.md":"# ida_range\n\nMedium-priority: Manage continuous address ranges and sets of ranges. Commonly used for working with functions, segments, and custom address groups.\n\n## Key Classes\n\n### range_t\nContinuous address range [start_ea, end_ea), end excluded.\n\n- `range_t(ea1, ea2)` - constructor\n- `start_ea` / `end_ea` - range boundaries (end_ea excluded)\n- `contains(ea)` / `contains(range)` - check if address/range is inside\n- `overlaps(range)` - check if ranges have common addresses\n- `size()` - return end_ea - start_ea\n- `empty()` - check if size <= 0\n- `intersect(range)` - set to intersection with another range\n- `extend(ea)` - extend range to include address\n- `clear()` - set both start_ea and end_ea to 0\n- `compare(range)` - compare based on start_ea\n\n### rangeset_t\nSet of non-overlapping ranges, stored sorted.\n\n- `add(range)` / `add(start, end)` / `add(rangeset)` - add range(s), merging overlaps\n- `sub(range)` / `sub(ea)` / `sub(rangeset)` - subtract range(s), splitting as needed\n- `contains(ea)` / `contains(rangeset)` - check membership\n- `includes(range)` - check if every ea in range is in set\n- `has_common(range)` / `has_common(rangeset)` - check overlap\n- `intersect(rangeset)` - set to intersection\n- `find_range(ea)` - get range containing ea, or nullptr\n- `nranges()` - number of ranges in set\n- `getrange(idx)` - get range by index\n- `next_addr(ea)` / `prev_addr(ea)` - navigate within ranges\n- `next_range(ea)` / `prev_range(ea)` - navigate between ranges\n- `is_equal(rangeset)` / `is_subset_of(rangeset)` - set comparisons\n- `clear()` / `empty()` - management\n\n### rangevec_t\nVector of range_t (standard vector methods).\n\n## Range Kind Constants\n\n- `RANGE_KIND_FUNC` - function ranges\n- `RANGE_KIND_SEGMENT` - segment ranges\n- `RANGE_KIND_HIDDEN_RANGE` - hidden ranges\n- `RANGE_KIND_UNKNOWN` - unknown type\n\n## See Also\nFull docs: skill/docs/ida_range.rst\n","skills/idapython/docs/ida_regfinder.md":"# ida_regfinder\n\nHigh-priority: Track register values backwards through code execution. Critical for understanding function arguments, constants loaded into registers, and stack pointer calculations.\n\n## Key Functions\n\n- `find_reg_value(ea, reg)` - find constant value in register at address\n- `find_sp_value(ea, reg)` - find stack pointer delta at address\n- `find_reg_value_info(rvi, ea, reg, max_depth)` - find register value with detailed tracking info\n- `find_nearest_rvi(rvi, ea, regs)` - find value of either of two registers\n- `invalidate_regfinder_cache(from, to, cref)` - update cache after control flow change\n- `invalidate_regfinder_xrefs_cache(to, dref)` - update cache after data reference change\n\nReturns: 1 if value found, 0 if varying/insufficient depth, -1 if not supported.\n\n## Key Classes\n\n### reg_value_info_t\nDetailed register value tracking result.\n\n**State checks:**\n- `is_num()` / `is_spd()` - value is constant / stack-pointer-relative\n- `is_known()` - value is num or spd\n- `is_unknown()` - value could not be determined\n- `is_dead_end()` / `aborted()` - tracking stopped\n- `is_unkloop()` / `is_unkxref()` / `is_unkvals()` / `is_unkmult()` - specific failure reasons\n- `is_value_unique()` - single value vs multiple possibilities\n\n**Value extraction:**\n- `get_num()` - get constant value\n- `get_spd()` - get SP delta\n- `get_def_ea()` - where value was defined\n- `get_def_itype()` - instruction type that defined value\n\n**Arithmetic operations (all take insn parameter):**\n- `add(r, insn)` / `sub(r, insn)` - arithmetic\n- `bor(r, insn)` / `band(r, insn)` / `bxor(r, insn)` / `bandnot(r, insn)` - bitwise\n- `sll(r, insn)` / `slr(r, insn)` / `sar(r, insn)` - shifts\n- `neg(insn)` / `bnot(insn)` - unary\n- `add_num(r)` / `shift_left(r)` / `shift_right(r)` - without changing def_ea\n\n**Factory methods:**\n- `make_num(val, insn/ea, flags)` - create constant value\n- `make_initial_sp(func_ea)` - create initial stack pointer\n- `make_unkloop(ea)` / `make_unkmult(ea)` / etc - create failure states\n\n**Flags (for PC_BASED / LIKE_GOT annotations):**\n- `is_all_vals_pc_based()` / `is_any_vals_pc_based()`\n- `is_all_vals_like_got()` / `is_any_vals_like_got()`\n- `set_all_vals_pc_based()` / `set_all_vals_got_based()`\n\n### reg_value_def_t\nSingle value definition.\n\n- `val` - the value (uint64)\n- `def_ea` - instruction address where defined\n- `def_itype` - instruction code (processor-specific)\n- `flags` - SHORT_INSN, PC_BASED, LIKE_GOT\n- `is_short_insn()` / `is_pc_based()` / `is_like_got()` - flag checks\n- `dstr(how, pm)` - format as string (NOVAL/UVAL/SPVAL/ABORTED)\n\n## Configuration\n\nUses ida.cfg values: `REGTRACK_MAX_DEPTH`, `REGTRACK_FUNC_MAX_DEPTH` for search limits.\n\n## See Also\nFull docs: skill/docs/ida_regfinder.rst\n","skills/idapython/docs/ida_registry.md":"# ida_registry\n\nRegistry-based persistent configuration storage (Windows registry or ~/.idapro/ida.reg on Unix).\n\n## Key Functions\n\n### Configuration Storage\n- `reg_read_string(name, subkey=None, _def=None)` - Read string value\n- `reg_write_string(name, utf8, subkey=None)` - Write string value\n- `reg_read_int(name, defval, subkey=None)` - Read integer value\n- `reg_write_int(name, value, subkey=None)` - Write integer value\n- `reg_read_bool(name, defval, subkey=None)` - Read boolean value\n- `reg_write_bool(name, value, subkey=None)` - Write boolean value\n- `reg_read_binary(name, subkey=None)` - Read binary data\n- `reg_write_binary(name, py_bytes, subkey=None)` - Write binary data\n\n### List Operations\n- `reg_read_strlist(subkey)` - Get all string values under key\n- `reg_write_strlist(items, subkey)` - Write list of strings\n- `reg_update_strlist(subkey, add, maxrecs, rem=None, ignorecase=False)` - Add/remove items with trimming\n- `reg_update_filestrlist(subkey, add, maxrecs, rem=None)` - Update file list (OS-specific case sensitivity)\n\n### Key/Value Management\n- `reg_exists(name, subkey=None)` - Check if value exists\n- `reg_subkey_exists(name)` - Check if key exists\n- `reg_delete(name, subkey=None)` - Delete value\n- `reg_delete_subkey(name)` - Delete key\n- `reg_delete_tree(name)` - Delete subtree recursively\n- `reg_subkey_subkeys(name)` - Get all subkey names\n- `reg_subkey_values(name)` - Get all value names\n- `reg_data_type(name, subkey=None)` - Get value type (reg_unknown/reg_sz/reg_binary/reg_dword)\n\n## Constants\n\n- `ROOT_KEY_NAME` - Default key for IDA settings\n- `reg_sz` - UTF-8 string type\n- `reg_binary` - Binary data type\n- `reg_dword` - 32-bit number type\n\n## See Also\nFull docs: skill/docs/ida_registry.rst\n","skills/idapython/docs/ida_search.md":"# ida_search\n\nMiddle-level search functions for finding specific byte patterns, instructions, and code/data.\n\n## Key Functions\n\n### Search Functions\n- `find_unknown(ea, sflag)` - Find undefined bytes\n- `find_defined(ea, sflag)` - Find defined bytes (code/data)\n- `find_code(ea, sflag)` - Find code (instructions)\n- `find_data(ea, sflag)` - Find data items\n- `find_not_func(ea, sflag)` - Find bytes outside functions\n- `find_imm(ea, sflag, search_value)` - Find immediate value in instructions\n- `find_text(start_ea, y, x, ustr, sflag)` - Text search in disassembly/decompilation\n- `find_reg_access(out, start_ea, end_ea, regname, sflag)` - Find register read/write\n\n### Helper\n- `search_down(sflag)` - Check if SEARCH_DOWN bit is set\n\n## Search Flags\n\n### Direction\n- `SEARCH_UP` - Search towards lower addresses\n- `SEARCH_DOWN` - Search towards higher addresses\n- `SEARCH_NEXT` - Skip starting address\n\n### Options\n- `SEARCH_CASE` - Case-sensitive search\n- `SEARCH_REGEX` - Regular expressions (text search only)\n- `SEARCH_IDENT` - Search for identifier (bounded by non-visible chars)\n- `SEARCH_NOBRK` - Don't test for user cancellation\n- `SEARCH_NOSHOW` - Don't display progress\n- `SEARCH_BRK` - Return BADADDR if cancelled\n- `SEARCH_USESEL` - Limit search to UI selection\n\n### Register Access\n- `SEARCH_USE` - Find register reads\n- `SEARCH_DEF` - Find register writes\n\n## See Also\nFull docs: skill/docs/ida_search.rst\n","skills/idapython/docs/ida_segment.md":"# ida_segment\n\nSegment management (memory regions with addressing modes, permissions, and types).\n\n## Key Classes\n\n### segment_t\nCore segment structure (inherits from range_t).\n\n**Address Range:**\n- `start_ea` - Start address (included)\n- `end_ea` - End address (excluded)\n\n**Addressing:**\n- `bitness` - 0=16-bit, 1=32-bit, 2=64-bit\n- `is_16bit()`, `is_32bit()`, `is_64bit()` - Check addressing mode\n- `abits()`, `abytes()` - Get address bits/bytes\n- `set_segm_addressing(s, bitness)` - Change addressing (deletes instructions/data)\n\n**Attributes:**\n- `sel` - Segment selector (must be unique)\n- `type` - Segment type (SEG_CODE/SEG_DATA/SEG_BSS/SEG_XTRN/etc)\n- `perm` - Permissions (SEGPERM_READ/WRITE/EXEC)\n- `align` - Alignment (saRelByte/saRelWord/saRelPara/etc)\n- `comb` - Combination (scPriv/scPub/scStack/scCommon)\n- `color` - Segment color\n- `defsr[16]` - Default segment register values\n\n**Methods:**\n- `update()` - Commit segment changes to database\n\n## Key Functions\n\n### Segment Lookup\n- `get_segm_qty()` - Get number of segments\n- `getseg(ea)` - Get segment containing address\n- `getnseg(n)` - Get segment by index (0..qty-1)\n- `get_segm_num(ea)` - Get segment index by address\n- `get_segm_by_name(name)` - Get segment by name\n- `get_segm_by_sel(selector)` - Get segment by selector\n- `get_first_seg()`, `get_last_seg()` - Get first/last segment\n- `get_next_seg(ea)`, `get_prev_seg(ea)` - Get adjacent segments\n\n### Creating/Deleting\n- `add_segm(para, start, end, name, sclass, flags=0)` - Add segment (allocates selector)\n- `add_segm_ex(s, name, sclass, flags)` - Add segment (selector pre-allocated)\n- `del_segm(ea, flags)` - Delete segment\n\n### Modifying Bounds\n- `set_segm_start(ea, newstart, flags)` - Change start (trims previous)\n- `set_segm_end(ea, newend, flags)` - Change end (trims next)\n- `move_segm_start(ea, newstart, mode)` - Change start (may expand previous)\n- `move_segm(s, to, flags=0)` - Move entire segment (fixes relocations)\n- `rebase_program(delta, flags)` - Rebase all segments\n\n### Properties\n- `get_segm_name(s, flags=0)` - Get name\n- `set_segm_name(s, name, flags=0)` - Set name\n- `get_segm_class(s)`, `set_segm_class(s, sclass, flags=0)` - Get/set class\n- `get_segment_cmt(s, repeatable)`, `set_segment_cmt(s, cmt, repeatable)` - Get/set comment\n- `segtype(ea)` - Get segment type at address\n- `get_segm_base(s)` - Get base linear address\n- `get_segm_para(s)` - Get base paragraph\n- `set_segm_base(s, newbase)` - Set base (internal)\n\n### Selectors\n- `setup_selector(segbase)` - Allocate selector if needed\n- `allocate_selector(segbase)` - Unconditionally allocate selector\n- `find_free_selector()` - Find unused selector (>=1)\n- `set_selector(selector, paragraph)` - Map selector to paragraph\n- `del_selector(selector)` - Delete selector mapping\n- `sel2para(selector)`, `sel2ea(selector)` - Get selector mapping\n- `find_selector(base)` - Find selector by paragraph\n\n### Visibility/Locking\n- `is_visible_segm(s)`, `set_visible_segm(s, visible)` - Hide/show segment\n- `is_spec_segm(seg_type)`, `is_spec_ea(ea)` - Check special types\n- `lock_segm(segm, lock)`, `is_segm_locked(segm)` - Lock pointer (prevents deletion/move)\n\n### Debugger Integration\n- `change_segment_status(s, is_deb_segm)` - Convert debugger/regular segment\n- `take_memory_snapshot(type)` - Snapshot running process (SNAP_ALL_SEG/SNAP_LOAD_SEG/SNAP_CUR_SEG)\n- `is_miniidb()` - Check if IDB is debugger-created\n\n### Segment Groups (OMF)\n- `set_group_selector(grp, sel)` - Create segment group\n- `get_group_selector(grpsel)` - Get group's common selector\n\n### Segment Translations\n- `add_segment_translation(segstart, mappedseg)` - Add overlay mapping\n- `del_segment_translations(segstart)` - Delete translation list\n- `get_segment_translations(transmap, segstart)` - Get translation list\n- `set_segment_translations(segstart, transmap)` - Set translation list\n\n## Segment Types\n\n- `SEG_NORM` - Normal segment (no assumptions)\n- `SEG_CODE` - Code segment\n- `SEG_DATA` - Data segment\n- `SEG_BSS` - Uninitialized data\n- `SEG_XTRN` - External definitions (no instructions)\n- `SEG_GRP` - Segment group\n- `SEG_NULL` - Zero-length segment\n- `SEG_ABSSYM` - Absolute symbols\n- `SEG_COMM` - Communal definitions\n- `SEG_IMEM` - Internal processor memory/SFRs\n\n## Add Segment Flags\n\n- `ADDSEG_NOSREG` - Set default sregs to BADSEL\n- `ADDSEG_OR_DIE` - qexit() on failure\n- `ADDSEG_NOTRUNC` - Destroy/truncate old segments instead\n- `ADDSEG_QUIET` - Silent mode\n- `ADDSEG_FILLGAP` - Fill gap with previous segment\n- `ADDSEG_SPARSE` - Use sparse storage\n- `ADDSEG_NOAA` - Don't mark for auto-analysis\n- `ADDSEG_IDBENC` - Name/class in IDB encoding\n\n## Segment Modification Flags\n\n- `SEGMOD_KILL` - Disable addresses when shrinking\n- `SEGMOD_KEEP` - Keep code/data\n- `SEGMOD_SILENT` - Silent mode\n- `SEGMOD_KEEPSEL` - Don't delete unused selector\n- `SEGMOD_NOMOVE` - Don't move info when changing start\n- `SEGMOD_SPARSE` - Use sparse storage when extending\n\n## See Also\nFull docs: skill/docs/ida_segment.rst\n","skills/idapython/docs/ida_segregs.md":"# ida_segregs\n\nSegment register management for architectures with segmented memory (x86/x86-64).\n\n## Key Classes\n\n### sreg_range_t\nSegment register value range (inherits from range_t).\n- `val` - Segment register value (sel_t)\n- `tag` - Range tag (SR_inherit/SR_user/SR_auto/SR_autostart)\n\n## Key Functions\n\n### Reading Values\n- `get_sreg(ea, rg)` - Get segment register value at address (uses ranges + segment defaults)\n\n### Setting Values\n- `split_sreg_range(ea, rg, v, tag, silent=False)` - Create new range at address\n- `set_default_sreg_value(sg, rg, value)` - Set default for segment (or all segments if sg=None)\n- `set_default_dataseg(ds_sel)` - Set DS default for all segments\n- `set_sreg_at_next_code(ea1, ea2, rg, value)` - Set value at next instruction only\n\n### Range Queries\n- `get_sreg_range(out, ea, rg)` - Get range containing address\n- `get_prev_sreg_range(out, ea, rg)` - Get previous range\n- `get_sreg_ranges_qty(rg)` - Get number of ranges\n- `getn_sreg_range(out, rg, n)` - Get range by index\n- `get_sreg_range_num(ea, rg)` - Get range index by address\n\n### Range Management\n- `del_sreg_range(ea, rg)` - Delete range (extends previous, can't delete segment start)\n- `copy_sreg_ranges(dst_rg, src_rg, map_selector=False)` - Duplicate ranges\n\n## Segment Register Constants\n\n### x86/x86-64 Registers\n- `R_es` - Extra segment\n- `R_cs` - Code segment\n- `R_ss` - Stack segment\n- `R_ds` - Data segment\n- `R_fs` - FS segment\n- `R_gs` - GS segment\n\n### Range Tags\n- `SR_inherit` - Value inherited from previous range\n- `SR_user` - User-specified value\n- `SR_auto` - IDA-determined value\n- `SR_autostart` - Used as SR_auto at segment start\n\n## Usage Notes\n\nFor non-segmented architectures, define two virtual segment registers (CS/DS) and set processor_t::reg_code_sreg and processor_t::reg_data_sreg.\n\n## See Also\nFull docs: skill/docs/ida_segregs.rst\n","skills/idapython/docs/ida_srclang.md":"# ida_srclang\n\nThird-party compiler support for parsing type declarations from C/C++/Objective-C source.\n\n## Key Functions\n\n### Parser Selection\n- `select_parser_by_name(name)` - Set parser by name (None/\"\" for default)\n- `select_parser_by_srclang(lang)` - Set parser supporting language(s)\n- `get_selected_parser_name()` - Get current parser name\n\n### Type Declaration Parsing\n- `parse_decls_for_srclang(lang, til, input, is_path)` - Parse with language auto-detection\n- `parse_decls_with_parser(parser_name, til, input, is_path)` - Parse with specific parser\n- `parse_decls_with_parser_ext(parser_name, til, input, hti_flags)` - Parse with formatting flags\n\n**Parameters:**\n- `lang/parser_name` - Source language or parser name\n- `til` - Type library to store parsed types\n- `input` - File path or declaration string\n- `is_path` - True if input is path, False if in-memory snippet\n\n**Returns:**\n- -1: No parser found\n- -2: Operation not supported (set_parser_argv)\n- >=0: Number of parse errors\n\n### Parser Configuration\n- `set_parser_argv(parser_name, argv)` - Set command-line arguments\n- `get_parser_option(parser_name, option_name)` - Get parser option\n- `set_parser_option(parser_name, option_name, option_value)` - Set parser option\n\n## Source Languages\n\n- `SRCLANG_C` - C\n- `SRCLANG_CPP` - C++\n- `SRCLANG_OBJC` - Objective-C\n- `SRCLANG_SWIFT` - Swift (not supported yet)\n- `SRCLANG_GO` - Golang (not supported yet)\n\n## See Also\nFull docs: skill/docs/ida_srclang.rst\n","skills/idapython/docs/ida_strlist.md":"# ida_strlist\n\nString list management (cached view of all strings in the database).\n\n## Key Classes\n\n### string_info_t\nString list entry.\n- `ea` - String address\n- `length` - String length\n- `type` - String type\n\n### strwinsetup_t\nString list configuration.\n- `minlen` - Minimum string length\n- `display_only_existing_strings` - Only show defined strings\n- `only_7bit` - ASCII-only strings\n- `ignore_heads` - Include strings at non-head addresses\n- `strtypes` - Enabled string types\n\n## Key Functions\n\n- `build_strlist()` - Rebuild string list (expensive, call when needed)\n- `clear_strlist()` - Clear string list\n- `get_strlist_qty()` - Get number of strings (loads from DB or builds)\n- `get_strlist_item(si, n)` - Get nth string (0..qty-1)\n- `get_strlist_options()` - Get static configuration\n\n## Usage Notes\n\nThe kernel does NOT auto-update the string list (performance). Users must call build_strlist() for up-to-date results. If not cleared, the list persists in the database across sessions.\n\n## See Also\nFull docs: skill/docs/ida_strlist.rst\n","skills/idapython/docs/ida_tryblks.md":"# ida_tryblks\n\nException handling (try/catch/SEH) information for binary code analysis.\n\n## Key Classes\n\n### tryblk_t\nRepresents an exception try block with associated catch/finally handlers.\n- `get_kind()` - Check if SEH or C++ try block\n- `is_seh()` / `is_cpp()` - Identify exception handling type\n- `seh()` - Get SEH handler info (filter + landing pad)\n- `cpp()` - Get C++ catch handlers vector\n- `level` - Nesting level (auto-calculated)\n\n### catch_t / seh_t\nHandler information for C++ catch blocks and SEH (Structured Exception Handling).\n- `obj` - Exception object offset (C++)\n- `type_id` - Caught exception type ID\n- `filter` - SEH filter function range\n- `seh_code` - SEH exception code address\n\n## Key Functions\n\n### get_tryblks(tbv, range)\nRetrieve all try blocks in address range, sorted and with nesting calculated.\n\n### add_tryblk(tb)\nAdd try block information. Returns error code (TBERR_OK = success).\n\n### del_tryblks(range)\nDelete all try block information in range.\n\n### find_syseh(ea)\nFind start address of system exception handler region containing address.\n\n### is_ea_tryblks(ea, flags)\nCheck if address is part of try/catch/filter (use TBEA_TRY, TBEA_CATCH, TBEA_SEHTRY, etc flags).\n\n## Error Codes\n\n- `TBERR_OK` - Success\n- `TBERR_START/END/ORDER` - Invalid address bounds\n- `TBERR_INTERSECT` - Try block would intersect inner block\n- `TBERR_NO_CATCHES` - No catch handlers defined\n\n## See Also\nFull docs: skill/docs/ida_tryblks.rst\n","skills/idapython/docs/ida_typeinf.md":"# ida_typeinf\n\nType information manipulation in IDA - the foundation for working with structures, enums, function prototypes, and all type data.\n\n## Core Concepts\n\n**tinfo_t** objects represent types. They can be:\n- **Detached**: Created without a type library, temporary\n- **Attached**: Stored in a til_t (type info library), persistent\n\n**Key terms**:\n- **udt**: User-defined type (struct/union, not enum)\n- **udm**: UDT member (struct/union field)\n- **edm**: Enum member (enumerator)\n- **til_t**: Type info library (serialized type storage)\n\n## Essential Classes\n\n### tinfo_t\nThe fundamental type representation object.\n\n#### Creation\n- `tinfo_t()` - Empty type\n- `tinfo_t(BT_INT)` - Simple type from base type\n- `tinfo_t(\"const char **\")` - Parse C declaration\n- `get_named_type(til, \"struct_name\")` - Load from library\n- `create_func(func_type_data_t)` - Build function prototype\n- `create_ptr(target_type)` - Build pointer type\n\n#### Inspection\n- `get_size()` - Type size in bytes\n- `is_ptr()` / `is_func()` / `is_struct()` / `is_array()` - Type checks\n- `is_const()` / `is_volatile()` - Qualifier checks\n- `get_pointed_object()` - Dereference pointer\n- `get_realtype()` - Resolve typedefs\n- `print_tinfo(prefix, indent, flags)` - Format as C code\n\n#### Decomposition\n- `get_func_details(ftd)` - Extract function prototype to func_type_data_t\n- `get_udt_details(udt)` - Extract struct/union to udt_type_data_t\n- `get_enum_details(etd)` - Extract enum to enum_type_data_t\n- `get_array_details(arr)` - Extract array to array_type_data_t\n- `get_ptr_details(ptr)` - Extract pointer to ptr_type_data_t\n\n#### Modification\n- `create_typedef(til, name)` - Create typedef alias\n- `add_udm(name, type_str)` - Add field to attached struct\n- `set_numbered_type(til, ordinal, flags, name)` - Store in library\n\n### func_type_data_t\nFunction prototype representation (return type + arguments).\n- `rettype` - tinfo_t of return value\n- `[i]` / `size()` - Access funcarg_t arguments by index\n- `push_back(funcarg)` - Add parameter\n- `cc` - Calling convention (CM_CC_CDECL, CM_CC_STDCALL, etc)\n- `flags` - Function attributes (FTI_NORET, FTI_PURE, FTI_VIRTUAL, etc)\n\n### funcarg_t\nFunction parameter representation.\n- `name` - Parameter name\n- `type` - tinfo_t of parameter type\n- `argloc` - Physical location (register/stack)\n\n### udt_type_data_t\nStruct/union field collection (vector of udm_t).\n- `[i]` / `size()` - Access udm_t members by index\n- `push_back(udm)` - Add field\n- `find_member(name)` - Locate field by name\n- `get_best_fit_member(offset)` - Find field at offset\n- `total_size` - Struct size in bytes\n- `is_union` - True if union, false if struct\n- `taudt_bits` - Alignment flags\n\n### udm_t\nSingle struct/union field.\n- `name` - Field name\n- `type` - tinfo_t of field type\n- `offset` - Byte offset (0 for unions)\n- `size` - Field size in bytes\n- `cmt` / `rptcmt` - Comments\n\n### enum_type_data_t\nEnumeration representation (vector of edm_t).\n- `[i]` / `size()` - Access edm_t members by index\n- `push_back(edm)` - Add enumerator\n- `bte` - Storage size flags\n- `taenum_bits` - Display format (hex/dec/oct/bin)\n\n### edm_t\nSingle enum member.\n- `name` - Enumerator name\n- `value` - Numeric value\n\n### til_t\nType info library (persistent storage).\n- `get_named_type(name)` - Load type by name\n- `get_numbered_type(ordinal)` - Load type by ordinal number\n- `import_type(src)` - Import type from another til\n- `named_types()` / `numbered_types()` - Iterate all types\n- `cc` - Compiler info (calling conventions, sizes)\n\n## Key Functions\n\n### Type Library Management\n\n#### get_idati()\nGet the local type library (IDB's \"Local Types\").\n\n#### add_til(name, flags)\nAdd base type library (e.g., \"mssdk64_win7\" for Windows types).\n\n#### load_til(name, tildir)\nLoad til file without adding to IDB.\n\n### Type Application\n\n#### apply_tinfo(ea, tinfo, flags)\nApply type to address (function/data). Flags: TINFO_DEFINITE (override), TINFO_GUESSED (suggestion).\n\n#### apply_cdecl(til, ea, decl)\nParse C declaration and apply to address.\n\n#### guess_tinfo(ea)\nAuto-analyze and infer type at address.\n\n### Type Creation\n\n#### parse_decl(til, decl, flags)\nParse C declaration string into tinfo_t. Returns (tinfo, name) tuple.\n\n#### create_typedef(til, name)\nCreate typedef for existing type.\n\n### Type Queries\n\n#### get_tinfo(ea)\nRetrieve type applied to address.\n\n#### print_type(ea, flags)\nFormat type as C declaration string.\n\n#### get_named_type(til, name)\nLoad type from library by name.\n\n### Type Comparison\n\n#### compare_tinfo(t1, t2, flags)\nCheck type compatibility. Flags: TCMP_EQUAL (exact), TCMP_MANCAST (manual cast allowed), etc.\n\n## Base Type Constants\n\n### Integers\n- `BT_INT8` / `BT_INT16` / `BT_INT32` / `BT_INT64` / `BT_INT128`\n- Combined with: `BTMT_SIGNED`, `BTMT_UNSIGNED`, `BTMT_CHAR`\n- Shortcuts: `BTF_INT8`, `BTF_UINT8`, `BTF_CHAR`, `BTF_UCHAR`, etc.\n\n### Floating Point\n- `BT_FLOAT` - 4/8/10 byte float (use with BTMT_FLOAT/DOUBLE/LNGDBL)\n- Shortcuts: `BTF_FLOAT`, `BTF_DOUBLE`, `BTF_LDOUBLE`, `BTF_TBYTE`\n\n### Complex Types\n- `BT_PTR` - Pointer (use with BTMT_NEAR/FAR/CLOSURE)\n- `BT_ARRAY` - Array\n- `BT_FUNC` - Function\n- `BT_COMPLEX` - Struct/union/enum/typedef (use with BTMT_STRUCT/UNION/ENUM/TYPEDEF)\n- `BT_BITFIELD` - Bitfield (struct member only)\n\n### Special\n- `BT_VOID` - void type\n- `BT_BOOL` - bool type\n- `BT_UNK` - Unknown type\n\n## Type Modifiers\n\n- `BTM_CONST` - const qualifier\n- `BTM_VOLATILE` - volatile qualifier\n\n## Calling Conventions\n\n- `CM_CC_INVALID` / `CM_CC_UNKNOWN`\n- `CM_CC_CDECL` - C declaration (caller cleans stack)\n- `CM_CC_STDCALL` - Standard call (callee cleans)\n- `CM_CC_FASTCALL` - Fast call (register args)\n- `CM_CC_THISCALL` - C++ member (ecx/rcx = this)\n- `CM_CC_PASCAL` - Pascal (right-to-left)\n- `CM_CC_SWIFT` - Swift ABI\n- `CM_CC_GOLANG` - Go ABI\n\n## Flags\n\n### Type Application (apply_tinfo)\n- `TINFO_GUESSED` - Suggested type (user can override)\n- `TINFO_DEFINITE` - Force type (overwrite existing)\n- `TINFO_DELAYFUNC` - Delay function analysis\n\n### Parsing (parse_decl)\n- `PT_SIL` - Silent (no error messages)\n- `PT_TYP` - Parse type only (no name)\n- `PT_VAR` - Parse variable (type + name)\n- `PT_REPLACE` - Replace existing type\n\n### Printing (print_tinfo)\n- `PRTYPE_1LINE` - Single line output\n- `PRTYPE_MULTI` - Multiple lines\n- `PRTYPE_TYPE` - Type only (no name)\n- `PRTYPE_DEF` - Include typedef keyword\n\n## Common Patterns\n\n### Create Function Prototype\n```python\n# int func(const char *str, int count)\nftd = ida_typeinf.func_type_data_t()\nftd.rettype = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\n\narg1 = ida_typeinf.funcarg_t()\narg1.name = \"str\"\narg1.type = ida_typeinf.tinfo_t(\"const char *\")\nftd.push_back(arg1)\n\narg2 = ida_typeinf.funcarg_t()\narg2.name = \"count\"\narg2.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\nftd.push_back(arg2)\n\ntif = ida_typeinf.tinfo_t()\ntif.create_func(ftd)\nida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)\n```\n\n### Create Structure\n```python\nudt = ida_typeinf.udt_type_data_t()\nudt.is_union = False\n\n# Add field: int x\nm1 = ida_typeinf.udm_t()\nm1.name = \"x\"\nm1.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\nm1.offset = 0\nm1.size = 4\nudt.push_back(m1)\n\ntif = ida_typeinf.tinfo_t()\ntif.create_udt(udt, ida_typeinf.BTF_STRUCT)\ntif.set_numbered_type(ida_typeinf.get_idati(), 0,\n    ida_typeinf.NTF_REPLACE, \"MyStruct\")\n```\n\n### Inspect Function Type\n```python\ntif = ida_typeinf.tinfo_t()\nif ida_typeinf.get_tinfo(tif, ea):\n    if tif.is_func():\n        ftd = ida_typeinf.func_type_data_t()\n        tif.get_func_details(ftd)\n        print(f\"Return: {ftd.rettype}\")\n        for i in range(ftd.size()):\n            arg = ftd[i]\n            print(f\"Arg {i}: {arg.name} : {arg.type}\")\n```\n\n## See Also\nFull docs: skill/docs/ida_typeinf.rst\nIDA Domain API: https://ida-domain.docs.hex-rays.com/ (simplified type operations)\n","skills/idapython/docs/ida_ua.md":"# ida_ua\n\nInstruction disassembly, operand decoding, and instruction analysis.\n\n## Key Classes\n\n### insn_t\nDecoded instruction with full operand details.\n- Access via: `idaapi.insn_t()` or `idautils.DecodeInstruction(ea)`\n- Contains array of up to 8 `op_t` operands\n\n### op_t\nSingle instruction operand representation.\n- `type` - Operand type (o_reg, o_mem, o_imm, o_displ, etc)\n- `dtype` - Data type (dt_byte, dt_word, dt_dword, dt_qword, etc)\n- `reg` - Register number (for o_reg)\n- `addr` - Memory address (for o_mem, o_displ, o_near, o_far)\n- `value` - Immediate value (for o_imm) or displacement\n- `phrase` - Register phrase number (for o_phrase, o_displ)\n- `shown()` - Check if operand should be displayed\n- `is_reg(r)` / `is_imm(v)` - Type checks\n\n## Operand Types\n\n- `o_void` - No operand\n- `o_reg` - Register (al, rax, xmm0, etc)\n- `o_mem` - Direct memory `[0x401000]`\n- `o_phrase` - Register indirect `[rax]`, `[rsi+rdi*4]`\n- `o_displ` - Register + displacement `[rbp+var_10]`\n- `o_imm` - Immediate constant `42`, `0x1000`\n- `o_near` / `o_far` - Code reference (branch/call target)\n- `o_idpspec0-5` - Processor-specific types\n\n## Data Types (dtype)\n\n- `dt_byte` (8), `dt_word` (16), `dt_dword` (32), `dt_qword` (64)\n- `dt_byte16` (128), `dt_byte32` (256), `dt_byte64` (512)\n- `dt_float`, `dt_double`, `dt_ldbl`, `dt_tbyte`\n\n## Key Functions\n\n### create_insn(ea)\nAnalyze and create instruction at address (updates IDB).\n\n### decode_insn(insn, ea)\nDecode instruction into insn_t object (read-only, no IDB changes).\n\n### decode_prev_insn(insn, ea)\nDecode instruction before given address.\n\n### print_insn_mnem(ea)\nGet instruction mnemonic string.\n\n### print_operand(ea, n)\nGet operand text representation (operand index n).\n\n### get_dtype_size(dtype)\nGet size in bytes for data type.\n\n### get_dtype_by_size(size)\nGet appropriate dtype for byte size.\n\n## Usage Pattern\n\n```python\ninsn = idaapi.insn_t()\nif idaapi.decode_insn(insn, ea) > 0:\n    for op in insn.ops:\n        if op.type == idaapi.o_void:\n            break  # No more operands\n        if op.type == idaapi.o_reg:\n            print(f\"Register: {op.reg}\")\n        elif op.type == idaapi.o_imm:\n            print(f\"Immediate: {op.value:#x}\")\n```\n\n## See Also\nFull docs: skill/docs/ida_ua.rst\n","skills/idapython/docs/ida_undo.md":"# ida_undo\n\nDatabase undo/redo operations for IDA changes.\n\n## Key Functions\n\n### create_undo_point(bytes, size)\nCreate restore point. User can undo to this point later. Returns False if undo disabled.\n\n### perform_undo()\nUndo last action. Returns True on success.\n\n### perform_redo()\nRedo previously undone action. Returns True on success.\n\n### get_undo_action_label()\nGet description of action that will be undone (for UI display).\n\n### get_redo_action_label()\nGet description of action that will be redone (for UI display).\n\n## Usage\n\nRarely needed in plugins - IDA automatically creates undo points for most operations. Use `create_undo_point()` only for custom atomic operations requiring explicit undo boundaries.\n\n## See Also\nFull docs: skill/docs/ida_undo.rst\n","skills/idapython/docs/ida_xref.md":"# ida_xref\n\nCross-reference (xref) tracking between code and data locations.\n\n## Key Classes\n\n### xrefblk_t\nIterator for traversing cross-references efficiently.\n- `first_from(ea, flags)` / `next_from()` - Iterate xrefs FROM address\n- `first_to(ea, flags)` / `next_to()` - Iterate xrefs TO address\n- `frm` / `to` - Source and target addresses\n- `type` - Reference type (cref_t or dref_t)\n- `iscode` - True if code reference, false if data\n- `user` - User-defined (won't be deleted by IDA)\n\nIterator helpers:\n- `crefs_from(ea)` / `crefs_to(ea)` - Code references including flow\n- `fcrefs_from(ea)` / `fcrefs_to(ea)` - Code references (no flow)\n- `drefs_from(ea)` / `drefs_to(ea)` - Data references\n\n## Key Functions\n\n### add_cref(frm, to, type) / add_dref(frm, to, type)\nCreate code or data cross-reference.\n\n### del_cref(frm, to, expand) / del_dref(frm, to)\nDelete cross-reference (expand=1 deletes target if no more refs).\n\n### get_first_cref_from(frm) / get_next_cref_from(frm, current)\nLegacy API for iterating code xrefs FROM address.\n\n### get_first_dref_to(to) / get_next_dref_to(to, current)\nLegacy API for iterating data xrefs TO address.\n\n### has_external_refs(pfn, ea)\nCheck if address has references from outside function.\n\n### create_switch_xrefs(ea, si)\nGenerate xrefs for switch jump table.\n\n## Reference Types\n\n### Code (cref_t)\n- `fl_CF` / `fl_CN` - Call Far/Near (creates function)\n- `fl_JF` / `fl_JN` - Jump Far/Near\n- `fl_F` - Ordinary flow to next instruction\n\n### Data (dref_t)\n- `dr_R` / `dr_W` - Read/Write access\n- `dr_O` - Offset reference\n- `dr_T` - Text reference (forced operand)\n\n## Flags\n\n- `XREF_USER` - User-defined (persistent)\n- `XREF_TAIL` - Reference to tail byte\n- `XREF_PASTEND` - Preserve alignment directives\n- `XREF_CODE` / `XREF_DATA` - Filter by type\n- `XREF_FLOW` / `XREF_NOFLOW` - Include/skip ordinary flow\n\n## See Also\nFull docs: skill/docs/ida_xref.rst\n","skills/idapython/docs/idaapi.md":"# idaapi\n\nLow-level module exposing global C variables via `cvar` attribute.\n\n## Key Attributes\n\n### cvar\nGlobal variable container - provides access to IDA's C-level global variables (e.g., `idaapi.cvar.inf` for binary info, `idaapi.cvar.database_flags` for IDB state).\n\n## See Also\nFull docs: skill/docs/idaapi.rst\n","skills/idapython/docs/idadex.md":"# idadex\n\nDEX (Dalvik Executable) file parsing utilities for Android reverse engineering.\n\n## Key Classes\n\n### Dex\nPrimary DEX file parser exposing methods/fields/strings/types from Android binaries.\n\n**String Operations**:\n- `get_string(from_ea, string_idx)` - retrieve string by index\n- `as_string(s)` - convert DEX string to Python string\n\n**Method Operations**:\n- `get_method(from_ea, method_idx)` - retrieve method by index\n- `get_method_name(from_ea, method_idx)` - get method name\n- `get_short_method_name(method)` - short form (e.g., `onCreate`)\n- `get_full_method_name(method)` - fully qualified (e.g., `android.app.Activity.onCreate`)\n- `get_call_method_name(method)` - name for call sites\n\n**Type Operations**:\n- `get_type_string(from_ea, type_idx)` - get type descriptor\n- `decorate_java_typename(desc)` - convert type descriptor to Java notation\n- `is_wide_type(typechar)` - check if type is 64-bit\n\n**Field Operations**:\n- `get_field(from_ea, field_idx)` - retrieve field by index\n- `get_field_name(from_ea, field_idx)` - get field name\n- `get_full_field_name(field_idx, field, field_name)` - fully qualified field name\n\n**Utility**:\n- `access_string(flags)` - convert access flags to string (public/private/etc)\n- `idx_to_ea(from_ea, idx, tag)` - convert DEX index to IDA address\n\n### dex_method\n`ctypes.LittleEndianStructure` representing DEX method metadata.\n- `IS_LOCAL = 1` - flag for local method\n- `HAS_CODE = 2` - flag indicating method has code\n- `is_local()` - check if method is local\n\n### dex_field\n`ctypes.LittleEndianStructure` representing DEX field metadata.\n\n## Key Functions\n\n- `to_uint32(v)` - convert to unsigned 32-bit int\n- `unpack_db(buf, off)` - unpack byte from buffer\n- `unpack_dw(buf, off)` - unpack word from buffer\n- `unpack_dd(buf, off)` - unpack dword from buffer\n- `unpack_dq(buf, off)` - unpack qword from buffer\n- `unpack_ea(buf, off)` - unpack effective address from buffer\n\n## Global Object\n\n### dex\nGlobal `Dex` instance - use this to access DEX parsing functions.\n\n## See Also\nFull docs: skill/docs/idadex.rst\n","skills/idapython/docs/idautils.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Fidautils.md -->","skills/idapython/docs/idc.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Fidc.md -->","skills/idapython/docs/init.md":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Finit.md -->"},"items":[{"name":"CLAUDE.md","path":"CLAUDE.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/CLAUDE.md","title":"Claude Agent Guidelines & System Prompt","category":"claude-rule","format":"markdown","content":"# CLAUDE.md\n\nGuidance for working in this repository.\n\n## What this project is\n\nIDA Pro MCP Server: exposes IDA Pro / idalib functionality to MCP clients.\n\nMain pieces:\n- `src/ida_pro_mcp/server.py`: MCP server entrypoint\n- `src/ida_pro_mcp/idalib_server.py`: headless idalib server\n- `src/ida_pro_mcp/ida_mcp/`: IDA/plugin-side APIs\n\nImportant API modules:\n- `api_core.py`: IDB metadata, functions, strings, imports\n- `api_analysis.py`: decompilation, disassembly, xrefs, paths, pattern search\n- `api_memory.py`: bytes/ints/strings, patching\n- `api_types.py`: structs, type inference, type application\n- `api_modify.py`: comments, renaming, asm patching\n- `api_stack.py`: stack frame operations\n- `api_sigmaker.py`: signature creation, scanning, xref signatures (uses sigmaker.py)\n- `api_debug.py`: debugger control, unsafe / low priority for tests\n- `api_python.py`: execute Python in IDA context\n- `api_resources.py`: `ida://` MCP resources\n\n## Core implementation rules\n\n### IDA thread safety\nAll IDA SDK calls must run on the main thread.\nUse:\n```python\nfrom .rpc import tool\nfrom .sync import idasync\n\n@tool\n@idasync\ndef my_tool(...):\n    ...\n```\n\n### API conventions\n- Prefer batch-first APIs.\n- Many functions accept either a comma-separated string or a list.\n- Use full type hints and `Annotated[...]` descriptions.\n- The function docstring becomes the MCP tool description.\n\nExample:\n```python\ndef my_api(addrs: Annotated[str, \"Addresses (0x401000, main) or list\"]) -> list[dict]:\n    ...\n```\n\n### Common helpers\n- Parse addresses with `parse_address()`\n- Normalize batch input with `normalize_list_input()` / `normalize_dict_list()`\n- Use shared pagination / filtering helpers from `utils.py`\n\n### Unsafe operations\nDebugger or destructive operations should be marked unsafe:\n```python\nfrom .rpc import tool, unsafe\n\n@unsafe\n@tool\n@idasync\ndef dangerous_op(...):\n    ...\n```\n\n## Development commands\n\n### Run\n```bash\nuv run ida-pro-mcp\nuv run ida-pro-mcp --transport http://127.0.0.1:8744/sse\nuv run idalib-mcp --stdio path/to/binary\nuv run idalib-mcp --host 127.0.0.1 --port 8745 path/to/binary\nuv run ida-pro-mcp --unsafe\n```\n\n### MCP inspector\n```bash\nuv run mcp dev src/ida_pro_mcp/server.py\n```\n\n### Install / uninstall\n```bash\nuv run ida-pro-mcp --install\nuv run ida-pro-mcp --uninstall\n```\n\n## Testing and coverage\n\n### Run tests\nUse the headless test runner:\n```bash\nuv run ida-mcp-test tests/crackme03.elf -q\nuv run ida-mcp-test tests/typed_fixture.elf -q\nuv run ida-mcp-test tests/crackme03.elf -c api_analysis\nuv run ida-mcp-test tests/typed_fixture.elf -p \"*stack*\"\n```\n\nNotes:\n- Use `uv run ...`\n- Non-interactive output should show failures only plus a summary\n- Binary-specific tests should use `@test(binary=\"...\")` with the executable basename\n\n### Coverage\nMeasure coverage across both maintained fixtures:\n```bash\nuv run coverage erase\nuv run coverage run -m ida_pro_mcp.test tests/crackme03.elf -q\nuv run coverage run --append -m ida_pro_mcp.test tests/typed_fixture.elf -q\nuv run coverage report --show-missing\n```\n\nCurrent fixture intent:\n- `tests/crackme03.elf`: compact general regression fixture\n- `tests/typed_fixture.elf`: typed globals / structs / locals / stack coverage fixture\n\n### Test expectations\n- Prefer semantic assertions, not weak \"field exists\" checks\n- Prefer round-trip tests for mutating APIs\n- If tests expose clearly wrong API behavior, fix the API instead of weakening the test\n- Focus on IDA-facing modules, not server/config plumbing\n- Expect some IDA / Hex-Rays variance; guarded assertions or runtime skips are acceptable when justified\n\n### Generic-test sanity check\nWhen adding generic tests, also try a non-fixture binary to avoid ELF-specific assumptions:\n```bash\nuv run ida-mcp-test \"C:\\CodeBlocks\\x64dbg\\bin\\x64\\x64dbg.dll\" -q\n```\n\n## Scope priorities\n\nHigh priority:\n- `api_analysis.py`\n- `api_types.py`\n- `api_modify.py`\n- `api_stack.py`\n- `api_memory.py`\n- `api_core.py`\n- `api_resources.py`\n- `utils.py`\n- `framework.py`\n\nLower priority:\n- `api_debug.py`\n- MCP transport / hosting details\n- install / config mutation logic\n\n## Practical notes\n\n- Server/plugin Python: 3.11+\n- IDA Pro 8.3+; 9.0 recommended\n- IDA Free is not supported\n- If IDA uses the wrong Python, use `idapyswitch`\n","isInternal":false,"tokens":1149,"sizeBytes":4255},{"name":"ida_auto.md","path":"skills/idapython/docs/ida_auto.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_auto.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_auto\n\nAutoanalysis queue management and IDA status indicators.\n\n## Key Functions\n\n### Auto State Management\n- `get_auto_state()` - Get current autoanalyzer state (AU_NONE when idle)\n- `set_auto_state(new_state)` - Set autoanalyzer state\n- `auto_is_ok()` - Check if all queues empty (analysis finished)\n- `is_auto_enabled()` / `enable_auto(enable)` - Get/set autoanalyzer enabled state\n\n### Queue Operations\n- `auto_mark(ea, type)` - Add single address to queue (sorted)\n- `auto_mark_range(start, end, type)` - Add address range to queue\n- `auto_unmark(start, end, type)` - Remove range from queue\n- `auto_cancel(ea1, ea2)` - Remove range from AU_CODE/AU_PROC/AU_USED queues\n\n### Analysis Planning\n- `plan_ea(ea)` / `plan_range(sEA, eEA)` - Plan reanalysis\n- `auto_make_code(ea)` - Plan to make code\n- `auto_make_proc(ea)` - Plan to make code+function\n- `reanalyze_callers(ea, noret)` - Reanalyze all callers of address\n- `revert_ida_decisions(ea1, ea2)` - Delete IDA-generated analysis for range\n\n### Synchronous Analysis\n- `auto_wait()` - Process all queues and wait (returns false if cancelled)\n- `auto_wait_range(ea1, ea2)` - Process range and wait (returns step count or -1)\n- `plan_and_wait(ea1, ea2, final_pass=True)` - Analyze range synchronously\n- `auto_make_step(ea1, ea2)` - Analyze one address in range\n\n### Queue Types (atype_t)\n- `AU_CODE` (1) - Convert to instruction\n- `AU_PROC` (3) - Convert to procedure start\n- `AU_USED` (6) - Reanalyze\n- `AU_TYPE` (8) - Apply type information\n- `AU_FINAL` (13) - Final pass\n\n### IDA State (idastate_t)\n- `st_Ready` - IDA idle\n- `st_Think` - Autoanalysis on\n- `st_Waiting` - Waiting for input\n- `st_Work` - IDA busy\n\n## See Also\nFull docs: skill/docs/ida_auto.rst\n","isInternal":false,"tokens":508,"sizeBytes":1722},{"name":"ida_bitrange.md","path":"skills/idapython/docs/ida_bitrange.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_bitrange.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_bitrange\n\nBitfield and bit-level range operations (low-priority, specialized use).\n\n## Key Class\n\n### bitrange_t\nRepresents a range of bits within a larger value.\n\n- `init(bit_ofs, size_in_bits)` - Initialize offset and size\n- `reset()` - Make empty\n- `empty()` - Check if empty\n- `bitoff()` / `bitsize()` / `bytesize()` - Get offset/size\n- `mask64()` - Convert to 64-bit mask\n- `has_common(r)` - Check overlap with another bitrange\n- `intersect(r)` - Intersect two ranges\n- `create_union(r)` - Union including hole between ranges\n- `shift_down(cnt)` / `shift_up(cnt)` - Shift range left/right\n\n## See Also\nFull docs: skill/docs/ida_bitrange.rst\n","isInternal":false,"tokens":181,"sizeBytes":652},{"name":"ida_bytes.md","path":"skills/idapython/docs/ida_bytes.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_bytes.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_bytes\n\nByte-level operations: reading, writing, patching, flags, and data type creation.\n\n## Navigation\n\n### Head/Item Navigation\n- `next_head(ea, maxea)` / `prev_head(ea, minea)` - Next/prev item head\n- `get_item_head(ea)` - Get start of item containing ea\n- `get_item_end(ea)` - Get address after item\n- `get_item_size(ea)` - Get item size in bytes\n- `next_chunk(ea, maxea)` / `prev_chunk(ea, minea)` - Next/prev contiguous chunk\n- `next_unknown(ea, maxea)` / `prev_unknown(ea, minea)` - Next/prev undefined byte\n\n## Reading Bytes\n\n### Single Values\n- `get_byte(ea)` / `get_word(ea)` / `get_dword(ea)` / `get_qword(ea)` - Read values\n- `get_original_byte(ea)` - Read original file byte (before patches)\n- `get_wide_byte(ea)` / `get_wide_word(ea)` - Read with byte size from inf.cc.size_i/size_s\n- `get_data_value(ea, size)` - Read data item value (up to 64 bits)\n\n### Bulk Operations\n- `get_bytes(ea, size, gmb_flags=GMB_READALL)` - Read byte array\n- `get_bytes_and_mask(ea, size, gmb_flags)` - Read bytes + mask (for wildcards)\n- `get_strlit_contents(ea, length, strtype)` - Extract string literal\n\n## Writing/Patching Bytes\n\n### Patching (modifies IDB + file)\n- `patch_byte(ea, value)` / `patch_word(ea)` / `patch_dword(ea)` / `patch_qword(ea)` - Patch values\n- `patch_bytes(ea, buf)` - Patch byte array\n- `revert_byte(ea)` - Revert to original file byte\n\n### IDB Only (no file modification)\n- `put_byte(ea, value)` / `put_word(ea)` / `put_dword(ea)` / `put_qword(ea)` - Update IDB only\n- `put_bytes(ea, buf)` - Update byte array in IDB\n\n## Flags & Type Checking\n\n### Item Type\n- `is_code(flags)` / `is_data(flags)` / `is_unknown(flags)` - Check item type\n- `is_byte(ea)` / `is_word(ea)` / `is_dword(ea)` / `is_qword(ea)` - Check data size\n- `is_strlit(ea)` - Check if string literal\n- `is_struct(ea)` - Check if structure\n- `is_tail(ea)` - Check if tail byte (not item head)\n\n### Flag Operations\n- `get_flags(ea)` - Get flags for address\n- `get_full_flags(ea)` - Get full flags (includes hidden/extra data)\n\n## Creating Data Items\n\n### Basic Types\n- `create_byte(ea, length, force=False)` - Create byte array\n- `create_word(ea, length, force)` - Create word array\n- `create_dword(ea, length, force)` - Create dword array\n- `create_qword(ea, length, force)` - Create qword array\n- `create_float(ea)` / `create_double(ea)` / `create_packed_real(ea)` - Create floats\n\n### String & Struct\n- `create_strlit(ea, length, strtype)` - Create string literal\n- `create_struct(ea, size, tid)` - Apply structure at address\n- `del_items(ea, flags=0, nbytes=1)` - Undefine items in range\n\n## Searching\n\n### Pattern Search\n- `find_bytes(bs, range_start, range_size, mask, flags)` - Find byte pattern\n- `bin_search(start, end, pattern, flags)` - Binary pattern search\n- `parse_binpat_str(pattern, radix, strlits)` - Parse pattern string to compiled form\n\n### Simple Search\n- `find_byte(sEA, size, value, flags)` - Find single byte value\n- `find_byter(sEA, size, value, flags)` - Find byte (reverse direction)\n\n## Operand Representation\n\n### Number Display\n- `op_hex(ea, n)` / `op_dec(ea, n)` / `op_oct(ea, n)` / `op_bin(ea, n)` - Set operand radix\n- `op_chr(ea, n)` - Display as character\n- `op_num(ea, n)` - Display as number (default radix)\n- `toggle_sign(ea, n)` - Toggle sign display\n\n### Complex Types\n- `op_offset(ea, n, reftype, target, base, tdelta)` - Create offset reference\n- `op_enum(ea, n, enum_id, serial)` - Apply enum\n- `op_stroff(ea, n, path, path_len, delta)` - Create structure offset\n- `op_stkvar(ea, n)` - Reference stack variable\n\n## Comments\n- `get_cmt(ea, rptble)` / `set_cmt(ea, comm, rptble)` - Get/set comment\n- `append_cmt(ea, str, rptble)` - Append to comment\n\n## Constants\n\n### Item Type Flags\n- `FF_CODE` / `FF_DATA` / `FF_TAIL` / `FF_UNK` - Main type flags\n- `FF_BYTE` / `FF_WORD` / `FF_DWORD` / `FF_QWORD` - Data size flags\n\n### Search Flags\n- `BIN_SEARCH_FORWARD` / `BIN_SEARCH_BACKWARD` - Search direction\n- `BIN_SEARCH_CASE` / `BIN_SEARCH_NOCASE` - Case sensitivity\n- `BIN_SEARCH_NOSHOW` - Suppress progress dialog\n\n## See Also\nFull docs: skill/docs/ida_bytes.rst\n","isInternal":false,"tokens":1271,"sizeBytes":4094},{"name":"ida_dbg.md","path":"skills/idapython/docs/ida_dbg.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_dbg.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_dbg\n\nDebugger control and tracing (unsafe operations require --unsafe flag).\n\n## Process Control\n\n### Start/Stop\n- `start_process(path, args, sdir)` / `request_start_process(...)` - Start debugging\n- `attach_process(pid, event_id)` / `request_attach_process(...)` - Attach to process\n- `detach_process()` / `request_detach_process()` - Detach from process\n- `exit_process()` / `request_exit_process()` - Terminate debugged process\n- `get_process_state()` / `set_process_state(state)` - Get/set state (DSTATE_SUSP/RUN/NOTASK)\n\n### Execution\n- `suspend_process()` / `continue_process()` - Pause/resume execution\n- `step_into()` / `step_over()` - Single step (into/over calls)\n- `step_until_ret()` - Run until return\n- `run_to(ea)` - Run until address\n- `run_to_backwards(ea)` / `continue_backwards()` - Reverse execution (if debugger supports)\n\n### State\n- `is_debugger_busy()` - Check if debugger processing request\n- `get_running_request()` / `is_request_running()` - Query pending requests\n- `invalidate_dbg_state(what)` - Invalidate cached state (DBGINV_MEMORY/REGS/ALL)\n\n## Threads\n\n- `get_thread_qty()` - Get thread count\n- `getn_thread(idx)` - Get thread ID by index\n- `get_current_thread()` - Get current thread ID\n- `select_thread(tid)` - Switch to thread\n- `suspend_thread(tid)` / `resume_thread(tid)` - Pause/resume thread\n\n## Breakpoints\n\n### Management\n- `add_bpt(ea, size, bpt_type)` - Add breakpoint (BPT_BRK/BPT_TRACE)\n- `del_bpt(ea)` - Delete breakpoint\n- `enable_bpt(ea, enable)` - Enable/disable breakpoint\n- `update_bpt(bpt)` - Update breakpoint properties\n- `get_bpt_qty()` / `getn_bpt(idx)` / `get_bpt(ea)` - Query breakpoints\n\n### Breakpoint Types\n- `BPT_BRK` - Stop execution\n- `BPT_TRACE` - Log and continue\n- `BPT_ENABLED` - Breakpoint active\n- `BPT_LOWCND` - Has condition\n\n### Location Types\n- `BPLT_ABS` - Absolute address\n- `BPLT_REL` - Relative to module\n- `BPLT_SYM` - Symbol name\n- `BPLT_SRC` - Source file:line\n\n## Registers\n\n- `get_dbg_reg_info(reg_name)` - Get register info\n- `get_sp_val()` / `get_ip_val()` - Get stack/instruction pointer\n- `is_reg_integer(reg_name)` / `is_reg_float(reg_name)` - Check register type\n\n## Tracing\n\n### Step Trace\n- `enable_step_trace(enable)` / `is_step_trace_enabled()` - Enable/check step tracing\n- `set_step_trace_options(opts)` / `get_step_trace_options()` - Configure tracing\n- `ST_OVER_DEBUG_SEG` / `ST_OVER_LIB_FUNC` / `ST_SKIP_LOOPS` - Step options\n\n### Instruction/Function/Block Trace\n- `enable_insn_trace(enable)` / `enable_func_trace(enable)` / `enable_bblk_trace(enable)` - Enable tracing\n- `set_insn_trace_options(opts)` / `set_func_trace_options(opts)` - Configure\n- `IT_LOG_SAME_IP` / `FT_LOG_RET` / `BT_LOG_INSTS` - Trace options\n\n### Trace Events\n- `get_tev_qty()` - Get trace event count\n- `get_tev_info(tev)` - Get trace event details\n- `get_insn_tev_reg_val(tev, reg)` - Get register value at instruction event\n- `clear_trace()` - Clear trace buffer\n- `set_trace_size(size)` - Set trace buffer size\n\n## Event Types\n\n### Debug Events\n- `dbg_process_start` / `dbg_process_exit` - Process lifetime\n- `dbg_thread_start` / `dbg_thread_exit` - Thread lifetime\n- `dbg_library_load` / `dbg_library_unload` - Module events\n- `dbg_bpt` / `dbg_exception` - Exception events\n- `dbg_step_into` / `dbg_step_over` / `dbg_run_to` - Step events\n\n### Trace Event Types\n- `tev_insn` - Instruction execution\n- `tev_call` - Function call\n- `tev_ret` - Function return\n- `tev_bpt` - Breakpoint hit\n- `tev_mem` - Memory access\n\n## Debugger Options (DOPT_*)\n- `DOPT_START_BPT` - Break on process start\n- `DOPT_ENTRY_BPT` - Break on entry point\n- `DOPT_THREAD_BPT` - Break on new thread\n- `DOPT_LIB_BPT` - Break on library load\n- `DOPT_SUSPEND_ON_EXCEPTION` - Stop on exception\n\n## DBG_Hooks\nOverride methods to receive debugger events (use `ida_dbg.DBG_Hooks` base class).\n\n## See Also\nFull docs: skill/docs/ida_dbg.rst\n","isInternal":false,"tokens":1094,"sizeBytes":3891},{"name":"ida_dirtree.md","path":"skills/idapython/docs/ida_dirtree.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_dirtree.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_dirtree\n\nDirectory tree organization for IDA items (types, functions, names, etc).\n\n## Overview\nProvides virtual directory structure over collections accessed by inode (ID). Used for organizing local types, structures, enums, functions, names, bookmarks, etc.\n\n## Standard Trees\n- `DIRTREE_LOCAL_TYPES` - Local type library\n- `DIRTREE_FUNCS` - Function list\n- `DIRTREE_NAMES` - Named locations\n- `DIRTREE_IMPORTS` - Imported functions\n- `DIRTREE_BPTS` - Breakpoints\n- `get_std_dirtree(id)` - Access standard tree\n\n## Key Classes\n\n### dirtree_t\nMain directory tree interface.\n\n- `chdir(path)` / `getcwd()` - Navigate directories\n- `mkdir(path)` / `rmdir(path)` - Create/delete directories\n- `link(path/inode)` / `unlink(path/inode)` - Add/remove items\n- `rename(from, to)` - Rename entry\n- `resolve_path(path)` - Convert path to direntry_t\n- `get_abspath(cursor/relpath)` - Get absolute path\n- `isdir(path/de)` / `isfile(path/de)` - Check entry type\n- `findfirst(ff, pattern)` / `findnext(ff)` - Iterate entries\n- `traverse(visitor)` - Depth-first traversal with callback\n\n### direntry_t\nRepresents a directory entry (inode or directory).\n\n- `idx` - inode_t or diridx_t\n- `isdir` - True if directory, false if file\n- `valid()` - Check if entry exists\n\n### dirtree_cursor_t\nCursor for navigating tree.\n\n- `parent` - Parent directory index\n- `rank` - Index within parent\n- `is_root_cursor()` / `set_root_cursor()` - Root operations\n\n### dirspec_t\nSpecialization interface (defines how inodes map to items).\n\n- `get_name(inode, name_flags)` - Get item name\n- `get_inode(dirpath, name)` - Lookup inode by name\n- `rename_inode(inode, newname)` - Rename item\n- `unlink_inode(inode)` - Notification when unlinked\n\n## Error Codes\n- `DTE_OK` - Success\n- `DTE_ALREADY_EXISTS` - Item exists\n- `DTE_NOT_FOUND` - Item not found\n- `DTE_NOT_DIRECTORY` - Not a directory\n- `DTE_NOT_EMPTY` - Directory not empty\n- `DTE_BAD_PATH` - Invalid path\n\n## See Also\nFull docs: skill/docs/ida_dirtree.rst\n","isInternal":false,"tokens":540,"sizeBytes":1983},{"name":"ida_diskio.md","path":"skills/idapython/docs/ida_diskio.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_diskio.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_diskio\n\nFile I/O and IDA directory/resource management.\n\n## IDA Directories\n\n### Path Queries\n- `idadir(subdir)` - Get IDA install directory or subdirectory\n- `get_user_idadir()` - Get user data directory ($IDAUSR or default)\n- `get_ida_subdirs(subdir, flags)` - List all search paths for resource\n- `getsysfile(filename, subdir)` - Search for file in IDA paths\n\n### Subdirectory Constants\n- `CFG_SUBDIR` - Configuration files\n- `IDC_SUBDIR` - IDC scripts\n- `IDS_SUBDIR` - IDS files (function signatures)\n- `IDP_SUBDIR` - Processor modules\n- `LDR_SUBDIR` - Loader modules\n- `SIG_SUBDIR` - FLIRT signatures\n- `TIL_SUBDIR` - Type libraries\n- `PLG_SUBDIR` - Plugins\n- `THM_SUBDIR` - Themes\n\n### Search Flags\n- `IDA_SUBDIR_IDP` - Append processor name\n- `IDA_SUBDIR_IDADIR_FIRST` - Search $IDADIR before $IDAUSR\n- `IDA_SUBDIR_ONLY_EXISTING` - Only return existing directories\n\n## File Operations\n\n### Standard I/O Wrappers (use instead of C stdio)\n- `fopenRT(file)` / `fopenWT(file)` - Open text read/write\n- `fopenRB(file)` / `fopenWB(file)` - Open binary read/write\n- `fopenM(file)` - Open for modification\n- `fopenA(file)` - Open for append\n\n## Linput (IDA Binary Input)\n\n### Creation\n- `open_linput(file, remote)` - Open file as linput\n- `create_memory_linput(start, size)` - Create from IDB memory range\n- `create_bytearray_linput(s)` - Create from Python bytes\n- `create_generic_linput(gl)` - Create from custom reader\n\n### Operations\n- `qlgetz(li, fpos)` - Read null-terminated string at position\n- `get_linput_type(li)` - Get linput type (LINPUT_LOCAL/RFILE/PROCMEM/GENERIC)\n- `close_linput(li)` - Close linput\n\n### Linput Types\n- `LINPUT_LOCAL` - Local file\n- `LINPUT_RFILE` - Remote file\n- `LINPUT_PROCMEM` - Process memory\n- `LINPUT_GENERIC` - Custom reader\n\n### generic_linput_t\nBase class for custom binary readers.\n\n- `filesize` - Total size\n- `blocksize` - Read block size\n- `read(off, buffer, nbytes)` - Read bytes at offset\n\n## File Enumeration\n- `enumerate_files(path, fname, callback)` - Enumerate files matching pattern\n\n## Platform Folders\n- `get_special_folder(csidl)` - Get OS-specific folders\n  - `CSIDL_APPDATA` - Application data\n  - `CSIDL_LOCAL_APPDATA` - Local app data\n  - `CSIDL_PROGRAM_FILES` - Program files directory\n\n## See Also\nFull docs: skill/docs/ida_diskio.rst\n","isInternal":false,"tokens":661,"sizeBytes":2303},{"name":"ida_entry.md","path":"skills/idapython/docs/ida_entry.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_entry.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_entry\n\nEntry point and exported function management - addresses, names, and ordinal numbers.\n\n## Key Functions\n\n- `get_entry_qty() -> int` - Get number of entry points\n- `add_entry(ord, ea, name, makecode, flags=0) -> bool` - Add entry point with ordinal number\n- `get_entry(ord) -> ea_t` - Get address by ordinal number\n- `get_entry_ordinal(idx) -> int` - Get ordinal by index (0..get_entry_qty()-1)\n- `get_entry_name(ord) -> str` - Get entry point name by ordinal\n- `rename_entry(ord, name, flags=0) -> bool` - Rename entry point\n- `set_entry_forwarder(ord, name, flags=0) -> bool` - Set forwarder name (for DLL exports)\n- `get_entry_forwarder(ord) -> str` - Get forwarder name\n\n## Flags (AEF_*)\n\n- `AEF_UTF8` - Name is UTF-8 encoded (default)\n- `AEF_IDBENC` - Name is IDB encoded (implies AEF_NODUMMY)\n- `AEF_NODUMMY` - Prepend '_' if name begins with dummy suffix\n- `AEF_WEAK` - Make name weak\n- `AEF_NOFORCE` - Append to comment if name exists (unless old name is weak)\n\n## See Also\nFull docs: skill/docs/ida_entry.rst\n","isInternal":false,"tokens":306,"sizeBytes":1030},{"name":"ida_expr.md","path":"skills/idapython/docs/ida_expr.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_expr.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_expr\n\nIDC language interpreter - compile/execute IDC scripts, evaluate expressions, manipulate IDC values and objects.\n\n## Key Functions\n\n### Expression Evaluation\n- `eval_expr(rv, where, line) -> str` - Compile and evaluate expression at address context\n- `eval_idc_expr(rv, where, line) -> str` - Same as eval_expr but forces IDC interpreter\n\n### Script Execution\n- `compile_idc_file(line) -> str` - Compile IDC file\n- `compile_idc_text(line) -> str` - Compile IDC text\n- `compile_idc_snippet(func, text, resolver=None, only_safe_funcs=False) -> str` - Compile text into named function\n- `exec_idc_script(result, path, func, args, argsnum) -> str` - Compile and execute function from file\n- `exec_system_script(file, complain_if_no_file=True) -> bool` - Compile and execute \"main\" from system file\n\n### IDC Value Manipulation\n- `idcv_long(v) -> error_t` - Convert to 32/64-bit number\n- `idcv_int64(v) -> error_t` - Convert to 64-bit number\n- `idcv_num(v) -> error_t` - Convert to long (\"true\"→1, \"false\"→0)\n- `idcv_string(v) -> error_t` - Convert to string\n- `idcv_float(v) -> error_t` - Convert to float\n- `idcv_object(v, icls=None) -> error_t` - Create IDC object\n- `move_idcv(dst, src) -> error_t` - Move value (efficient, no copy)\n- `copy_idcv(dst, src) -> error_t` - Shallow copy (objects copied by reference)\n- `deep_copy_idcv(dst, src) -> error_t` - Deep copy objects\n- `free_idcv(v)` - Free VT_STR/VT_OBJ storage\n- `swap_idcvs(v1, v2)` - Swap two variables\n\n### Object/Attribute Access\n- `get_idcv_attr(res, obj, attr, may_use_getattr=False) -> error_t` - Get object attribute\n- `set_idcv_attr(obj, attr, value, may_use_setattr=False) -> error_t` - Set object attribute\n- `del_idcv_attr(obj, attr) -> error_t` - Delete attribute\n- `first_idcv_attr(obj) -> str`, `last_idcv_attr(obj) -> str` - Iterate attributes\n- `get_idcv_slice(res, v, i1, i2, flags=0) -> error_t` - Get slice of string/object\n- `set_idcv_slice(v, i1, i2, _in, flags=0) -> error_t` - Set slice\n\n### Class/Variable Management\n- `add_idc_class(name, super=None) -> idc_class_t*` - Create IDC class\n- `find_idc_class(name) -> idc_class_t*` - Find existing class\n- `add_idc_gvar(name) -> idc_value_t*` - Add global variable\n- `find_idc_gvar(name) -> idc_value_t*` - Find global variable\n- `find_idc_func(prefix, n=0) -> str` - Find IDC function by prefix\n\n## idc_value_t Class\n\nCore IDC value container with variant type support.\n\n### Attributes\n- `vtype: char` - Type (VT_LONG, VT_FLOAT, VT_STR, VT_OBJ, VT_FUNC, VT_PVOID, VT_INT64, VT_REF)\n- `num: int` - Integer value (VT_LONG)\n- `i64: int64` - 64-bit integer (VT_INT64)\n- `e: fpvalue_t` - Float value (VT_FLOAT)\n- `obj: idc_object_t*` - Object reference (VT_OBJ)\n\n### Methods\n- `clear()` - Free storage\n- `qstr() -> str`, `c_str() -> str` - Get string value\n- `set_string(...)`, `set_long(v)`, `set_int64(v)`, `set_float(f)` - Set typed values\n- `is_zero() -> bool`, `is_integral() -> bool`, `is_convertible() -> bool` - Type checks\n\n## Value Types (VT_*)\n- `VT_LONG` - Integer\n- `VT_INT64` - 64-bit integer\n- `VT_FLOAT` - Floating point\n- `VT_STR` - String\n- `VT_OBJ` - Object\n- `VT_FUNC` - Function\n- `VT_PVOID` - void pointer\n- `VT_REF` - Reference\n\n## Compilation Flags (CPL_*)\n- `CPL_DEL_MACROS` - Delete macros after compilation\n- `CPL_USE_LABELS` - Allow program labels\n- `CPL_ONLY_SAFE` - Only thread-safe functions\n\n## Function Flags (EXTFUN_*)\n- `EXTFUN_BASE` - Requires open database\n- `EXTFUN_NORET` - Does not return\n- `EXTFUN_SAFE` - Thread-safe, callable from any thread\n\n## See Also\nFull docs: skill/docs/ida_expr.rst\n","isInternal":false,"tokens":1092,"sizeBytes":3573},{"name":"ida_fixup.md","path":"skills/idapython/docs/ida_fixup.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_fixup.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_fixup\n\nRelocation/fixup information for loaders - manage target addresses, offsets, and displacement values.\n\n## Key Functions\n\n- `get_fixup(fd, source) -> bool` - Get fixup information at address\n- `exists_fixup(source) -> bool` - Check if fixup exists\n- `set_fixup(source, fd)` - Set fixup information (loaders use this)\n- `del_fixup(source)` - Delete fixup\n- `get_first_fixup_ea() -> ea_t` - Get first fixup address\n- `get_next_fixup_ea(ea) -> ea_t` - Next fixup after ea\n- `get_prev_fixup_ea(ea) -> ea_t` - Previous fixup before ea\n- `get_fixup_value(ea, type) -> int` - Read bytes and convert to operand value (get relocation addend)\n- `patch_fixup_value(ea, fd) -> bool` - Update bytes from fixup data\n- `get_fixup_desc(source, fd) -> str` - Get description comment\n- `calc_fixup_size(type) -> int` - Calculate fixup size in bytes (-1 on error)\n- `contains_fixups(ea, size) -> bool` - Check if range contains fixups\n- `gen_fix_fixups(from, to, size)` - Relocate bytes when moving segments/rebasing\n\n## fixup_data_t Class\n\nFixup metadata container.\n\n### Attributes\n- `sel: sel_t` - Target segment selector (BADSEL for absolute)\n- `off: ea_t` - Target offset\n- `displacement: adiff_t` - Displacement from target\n\n### Methods\n- `get_type() -> fixup_type_t`, `set_type(type)` - Fixup type access\n- `set_type_and_flags(type, flags=0)` - Set both type and flags\n- `is_custom() -> bool` - Is processor-specific fixup\n- `get_flags() -> int` - Get flags\n- `is_extdef() -> bool`, `set_extdef()`, `clr_extdef()` - Target is symbol vs segment offset\n- `is_unused() -> bool`, `set_unused()`, `clr_unused()` - IDA ignores this fixup\n- `has_base() -> bool` - Is relative fixup (vs segment-relative)\n- `was_created() -> bool` - Was created by IDA (not in original file)\n- `get_base() -> ea_t`, `set_base(new_base)` - Base address for relative fixups\n- `set(source)` - set_fixup wrapper\n- `get(source) -> bool` - get_fixup wrapper\n- `calc_size() -> int` - Fixup size\n\n## Fixup Types (FIXUP_*)\n\n- `FIXUP_OFF8`, `FIXUP_OFF16`, `FIXUP_OFF32`, `FIXUP_OFF64` - Unsigned offsets (8/16/32/64-bit)\n- `FIXUP_OFF8S`, `FIXUP_OFF16S`, `FIXUP_OFF32S` - Signed offsets\n- `FIXUP_SEG16` - 16-bit segment selector\n- `FIXUP_PTR16` - 32-bit pointer (16:16 base:offset)\n- `FIXUP_PTR32` - 48-bit pointer (16:32 base:offset)\n- `FIXUP_HI8`, `FIXUP_HI16` - High 8/16 bits of offset\n- `FIXUP_LOW8`, `FIXUP_LOW16` - Low 8/16 bits of offset\n- `FIXUP_CUSTOM` - Start of custom (processor-specific) types\n\n## Fixup Flags (FIXUPF_*)\n\n- `FIXUPF_REL` - Relative to linear address `base` (else segment-relative)\n- `FIXUPF_EXTDEF` - Target is symbol (else segment offset)\n- `FIXUPF_UNUSED` - Ignored by IDA, disables operand conversion\n- `FIXUPF_CREATED` - Not present in input file\n- `FIXUPF_LOADER_MASK` - Loader-specific flags (not stored in DB)\n\n## See Also\nFull docs: skill/docs/ida_fixup.rst\n","isInternal":false,"tokens":881,"sizeBytes":2859},{"name":"ida_fpro.md","path":"skills/idapython/docs/ida_fpro.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_fpro.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_fpro\n\nSystem-independent FILE* operations - cross-module file I/O (use these instead of C stdlib functions).\n\n## qfile_t Class\n\nIDA's FILE* wrapper for cross-module compatibility.\n\n### Constructor Methods\n- `open(filename, mode) -> bool` - Open file (fopen-style mode string)\n- `from_fp(fp) -> qfile_t*` - Wrap existing FILE*\n- `from_capsule(pycapsule) -> qfile_t*` - Wrap Python capsule\n- `tmpfile() -> qfile_t*` - Create temporary file\n\n### File Operations\n- `close()` - Close file\n- `opened() -> bool` - Check if open\n- `flush()` - Flush buffers\n- `size() -> int64` - Get file size\n- `filename() -> str` - Get filename\n\n### Reading\n- `read(size) -> str` - Read bytes (None on error)\n- `readbytes(size, big_endian) -> str` - Read with endianness conversion\n- `gets(len) -> str` - Read line (None on EOF)\n- `get_byte() -> int` - Read single byte (None on EOF)\n\n### Writing\n- `write(buf) -> int` - Write bytes (0 on error, else bytes written)\n- `writebytes(size, big_endian) -> int` - Write with endianness conversion\n- `puts(str) -> int` - Write string\n- `put_byte(chr)` - Write single byte\n\n### Positioning\n- `seek(offset, whence=SEEK_SET) -> int` - Seek (returns new position, not 0 like fseek)\n- `tell() -> int` - Get current position\n\n## Functions\n\n- `qfclose(fp)` - Close FILE*\n\n## Move Flags (QMOVE_*)\n- `QMOVE_CROSS_FS` - Allow cross-filesystem moves\n- `QMOVE_OVERWRITE` - Overwrite existing files\n- `QMOVE_OVR_RO` - Overwrite read-only files\n\n## Important\n\n**Never mix C stdlib FILE* functions with IDA kernel functions.** Each module has its own FILE* state when statically linked. Use qfile_t for all file I/O in plugins.\n\n## See Also\nFull docs: skill/docs/ida_fpro.rst\n","isInternal":false,"tokens":481,"sizeBytes":1687},{"name":"ida_frame.md","path":"skills/idapython/docs/ida_frame.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_frame.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_frame\n\nFunction stack frame manipulation - local variables, register variables, stack pointer tracking.\n\n## Frame Structure\n\n```\n+------------------------------------------------+\n| function arguments                             |\n+------------------------------------------------+\n| return address                                 |\n+------------------------------------------------+\n| saved registers (SI, DI, etc)                  |\n+------------------------------------------------+ <- typical BP\n|                                                |\n| local variables                                |\n|                                                |\n+------------------------------------------------+ <- SP\n```\n\nAccess via: `tinfo_t::get_func_frame(pfn)` or `get_func_frame(out, pfn)` + `tinfo_t::get_udt_details()`\n\n## Key Functions\n\n### Frame Management\n- `add_frame(pfn, frsize, frregs, argsize) -> bool` - Create frame (frsize=locals, frregs=saved regs, argsize=purged bytes)\n- `del_frame(pfn) -> bool` - Delete frame\n- `set_frame_size(pfn, frsize, frregs, argsize) -> bool` - Resize frame\n- `get_frame_size(pfn) -> asize_t` - Full size (locals + saved regs + retaddr + purged bytes)\n- `get_frame_retsize(pfn) -> int` - Return address size\n- `get_func_frame(out, pfn) -> bool` - Get frame type info\n\n### Frame Parts\n- `frame_off_args(pfn) -> ea_t` - Arguments section start\n- `frame_off_retaddr(pfn) -> ea_t` - Return address section start\n- `frame_off_savregs(pfn) -> ea_t` - Saved registers section start\n- `frame_off_lvars(pfn) -> ea_t` - Local variables section start\n- `get_frame_part(range, pfn, part)` - Get part offsets (FPC_ARGS/FPC_RETADDR/FPC_SAVREGS/FPC_LVARS)\n\n### Stack Variables\n- `define_stkvar(pfn, name, off, tif, repr=None) -> bool` - Define stack var (negative off=locals, positive=args)\n- `add_frame_member(pfn, name, offset, tif, repr=None, etf_flags=0) -> bool` - Add member to frame type\n- `set_frame_member_type(pfn, offset, tif, repr=None, etf_flags=0) -> bool` - Change member type\n- `delete_frame_members(pfn, start_offset, end_offset) -> bool` - Delete members in range\n- `build_stkvar_name(pfn, v) -> str` - Auto-generate stack var name\n- `calc_stkvar_struc_offset(pfn, insn, n) -> ea_t` - Calculate stack var offset in frame\n- `calc_frame_offset(pfn, off, insn=None, op=None) -> int` - Calculate offset in frame from SP/BP offset\n- `build_stkvar_xrefs(out, pfn, start_offset, end_offset)` - Get xrefs to stack frame range\n\n### Utilities\n- `is_funcarg_off(pfn, frameoff) -> bool` - Is offset in arguments range\n- `lvar_off(pfn, frameoff) -> int` - Convert to local var offset\n- `is_anonymous_member_name(name) -> bool` - Prefixed with \"anonymous\"\n- `is_dummy_member_name(name) -> bool` - Auto-generated name\n- `is_special_frame_member(tid) -> bool` - Is retaddr or saved regs slot\n- `soff_to_fpoff(pfn, soff) -> int` - Convert struct offset to FP-relative\n- `update_fpd(pfn, fpd) -> bool` - Update frame pointer delta\n- `set_purged(ea, nbytes, override_old_value) -> bool` - Set purged bytes (__stdcall/__pascal)\n\n### Register Variables\n- `add_regvar(pfn, ea1, ea2, canon, user, cmt) -> int` - Define register variable in range\n- `find_regvar(pfn, ea, canon) -> regvar_t*` - Find register variable definition\n- `has_regvar(pfn, ea) -> bool` - Check if regvar exists\n- `rename_regvar(pfn, v, user) -> int` - Rename register variable\n- `set_regvar_cmt(pfn, v, cmt) -> int` - Set comment\n- `del_regvar(pfn, ea1, ea2, canon) -> int` - Delete register variable\n- `free_regvar(v)` - Free regvar_t\n\n### Stack Pointer Tracking\n- `get_spd(pfn, ea) -> int` - Get SP delta before instruction (initial SP - current SP)\n- `get_effective_spd(pfn, ea) -> int` - Get SP delta used by instruction (differs for \"pop [esp+N]\")\n- `get_sp_delta(pfn, ea) -> int` - Get SP modification at location (0 if no change point)\n- `add_auto_stkpnt(pfn, ea, delta) -> bool` - Add automatic SP change point\n- `add_user_stkpnt(ea, delta) -> bool` - Add user-defined SP change point\n- `del_stkpnt(pfn, ea) -> bool` - Delete SP change point\n- `set_auto_spd(pfn, ea, new_spd) -> bool` - Set cumulative SP delta at address\n- `recalc_spd(cur_ea) -> bool` - Recalculate SP for non-fallthrough instructions\n- `recalc_spd_for_basic_block(pfn, cur_ea) -> bool` - Recalculate SP for basic block\n\n## regvar_t Class\n\nRegister variable definition (extends range_t).\n\n### Attributes\n- `canon: str` - Canonical register name (case-insensitive)\n- `user: str` - User-defined name\n- `cmt: str` - Comment near definition\n\n## Error Codes\n\n- `REGVAR_ERROR_OK` - Success\n- `REGVAR_ERROR_ARG` - Bad function arguments\n- `REGVAR_ERROR_RANGE` - Bad definition range\n- `REGVAR_ERROR_NAME` - Name can't be accepted\n\n## Flags\n\n- `STKVAR_VALID_SIZE` - dtyp contains correct variable type (off for \"lea\")\n- `STKVAR_KEEP_EXISTING` - Don't create new var if one exists\n\n## See Also\nFull docs: skill/docs/ida_frame.rst\n","isInternal":false,"tokens":1353,"sizeBytes":4895},{"name":"ida_funcs.md","path":"skills/idapython/docs/ida_funcs.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_funcs.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_funcs\n\nFunction management - define, modify, analyze functions and function chunks. Includes FLIRT signature support.\n\n## Architecture\n\nFunctions consist of:\n- **Entry chunk** - function start (required)\n- **Tail chunks** - optional additional code ranges shared between functions\n- Each tail has an **owner** function\n\n## func_t Class\n\nCore function descriptor (extends range_t).\n\n### Key Attributes\n- `flags: uint64` - Function flags (FUNC_*)\n- `frame: int` - Frame structure netnode ID\n- `frsize: asize_t` - Local variables size\n- `frregs: ushort` - Saved registers size\n- `argsize: asize_t` - Purged bytes on return (__stdcall/__pascal)\n- `fpd: asize_t` - Frame pointer delta (usually 0)\n- `color: bgcolor_t` - User-defined color\n- `points: stkpnt_t*`, `pntqty: int` - SP change points\n- `regvars: regvar_t*`, `regvarqty: int` - Register variables\n- `regargs: regarg_t*`, `regargqty: int` - Register arguments (temporary, cleared when type determined)\n- `tails: range_t*`, `tailqty: int` - Function tails\n- `owner: ea_t` - Tail owner address\n- `referers: ea_t*`, `refqty: int` - Parent functions using this tail\n\n### Methods\n- `is_far() -> bool` - Far function\n- `does_return() -> bool` - Returns to caller\n- `analyzed_sp() -> bool` - SP-analysis performed\n- `need_prolog_analysis() -> bool` - Needs prolog analysis\n- `get_name() -> str` - Function name\n- `get_prototype() -> tinfo_t` - Function prototype\n- `get_frame_object() -> tinfo_t` - Frame structure\n- `addresses()`, `code_items()`, `data_items()`, `head_items()`, `not_tails()` - Iterators\n\n## Key Functions\n\n### Querying Functions\n- `get_func(ea) -> func_t*` - Get function by address (returns entry chunk)\n- `getn_func(n) -> func_t*` - Get function by index (0..get_func_qty()-1)\n- `get_func_qty() -> size_t` - Total function count\n- `get_func_num(ea) -> int` - Get function index (-1 if not found)\n- `get_prev_func(ea) -> func_t*`, `get_next_func(ea) -> func_t*` - Navigate functions\n- `func_contains(pfn, ea) -> bool` - Does function contain address\n- `is_same_func(ea1, ea2) -> bool` - Do addresses belong to same function\n- `get_func_chunknum(pfn, ea) -> int` - Get chunk number (-1=not contained, 0=entry, >0=tail)\n\n### Creating/Modifying Functions\n- `add_func(ea1, ea2=BADADDR) -> bool` - Create function (auto-determines bounds if ea2=BADADDR)\n- `add_func_ex(pfn) -> bool` - Create from func_t struct\n- `del_func(ea) -> bool` - Delete function\n- `update_func(pfn) -> bool` - Update function info (don't use for start/end changes)\n- `set_func_start(ea, newstart) -> int` - Move start address (returns MOVE_FUNC_*)\n- `set_func_end(ea, newend) -> bool` - Move end address\n- `find_func_bounds(nfn, flags) -> int` - Auto-determine boundaries (returns FIND_FUNC_*)\n- `reanalyze_function(pfn, ea1=None, ea2=None, analyze_parents=False)` - Reanalyze function\n\n### Function Information\n- `get_func_name(ea) -> str` - Get name\n- `get_func_cmt(pfn, repeatable) -> str`, `set_func_cmt(pfn, cmt, repeatable) -> bool` - Comments\n- `get_func_ranges(ranges, pfn) -> ea_t` - Get all ranges\n- `calc_func_size(pfn) -> asize_t` - Total size including tails\n- `get_func_bitness(ea) -> int` - Bitness (0=16, 1=32, 2=64, -1=error)\n- `get_func_bits(ea) -> int` - Bits (16/32/64)\n- `get_func_bytes(ea) -> bytes` - Function bytes\n- `is_visible_func(pfn) -> bool`, `set_visible_func(pfn, visible)` - Visibility control\n- `is_finally_visible_func(pfn) -> bool` - Final visibility after all checks\n\n### Function Analysis\n- `func_does_return(ea) -> bool` - Does function return\n- `reanalyze_noret_flag(ea)` - Reanalyze non-return flag\n- `set_noret_insn(ea, noret)` - Mark instruction as non-returning\n- `calc_thunk_func_target(pfn) -> ea_t` - Get thunk target\n- `set_func_name_if_jumpfunc(pfn, name)` - Auto-name jump functions\n\n### Function Chunks (Tails)\n- `get_fchunk(ea) -> func_t*` - Get chunk by address (entry or tail)\n- `getn_fchunk(n) -> func_t*` - Get chunk by index\n- `get_fchunk_qty() -> size_t` - Total chunk count\n- `get_fchunk_num(ea) -> int` - Get chunk index\n- `get_prev_fchunk(ea) -> func_t*`, `get_next_fchunk(ea) -> func_t*` - Navigate chunks\n- `append_func_tail(pfn, tail_ea1, tail_ea2) -> bool` - Add tail to function\n- `remove_func_tail(pfn, tail_ea) -> bool` - Remove tail\n- `set_tail_owner(tail, owner_ea) -> bool` - Change tail owner\n- `get_fchunk_referer(ea, idx) -> ea_t` - Get parent function using tail\n- `func_tail_iterator_set(pfn, fti)` - Initialize tail iterator\n- `func_parent_iterator_set(pfn, fpi)` - Initialize parent iterator\n\n### Locking\n- `lock_func_range(pfn, lock)` - Lock function pointer (prevents deletion/move)\n- `is_func_locked(pfn) -> bool` - Check if locked\n- `lock_func(pfn)`, `lock_func_with_tails_t(pfn)` - RAII lock helpers\n\n### FLIRT Signatures\n- `plan_to_apply_idasgn(name) -> int` - Plan signature application (returns IDASGN_*)\n- `apply_idasgn_to(name, ea, may_show_wait_box) -> int` - Apply signature at address\n- `get_idasgn_qty() -> int` - Number of loaded signatures\n- `get_current_idasgn() -> str` - Current signature name\n- `calc_idasgn_state(n) -> int` - Signature state (IDASGN_*)\n- `del_idasgn(n)` - Delete signature\n- `get_idasgn_title(n) -> str` - Get signature title\n- `get_idasgn_desc(n) -> str` - Get description\n- `get_idasgn_desc_with_matches(n) -> str` - Get description with match count\n- `apply_startup_sig(ea1, ea2)` - Apply startup signature\n- `try_to_add_libfunc(pfn, ea) -> int` - Try to add library function (returns LIBFUNC_*)\n\n### Register Arguments\n- `read_regargs(pfn) -> dyn_regarg_array` - Read register arguments\n- `add_regarg(pfn, reg, type, name) -> bool` - Add register argument\n\n## Function Flags (FUNC_*)\n\n- `FUNC_NORET` - Doesn't return\n- `FUNC_FAR` - Far function\n- `FUNC_LIB` - Library function\n- `FUNC_STATICDEF` - Static\n- `FUNC_FRAME` - Uses frame pointer (BP)\n- `FUNC_USERFAR` - User-specified far\n- `FUNC_HIDDEN` - Hidden chunk\n- `FUNC_THUNK` - Jump/thunk function\n- `FUNC_BOTTOMBP` - BP points to stack frame bottom\n- `FUNC_NORET_PENDING` - Non-return analysis pending\n- `FUNC_SP_READY` - SP-analysis complete\n- `FUNC_FUZZY_SP` - SP changes untraceably (e.g., \"and esp, 0FFFFFFF0h\")\n- `FUNC_PROLOG_OK` - Prolog analyzed\n- `FUNC_PURGED_OK` - argsize validated\n- `FUNC_TAIL` - Function tail chunk\n- `FUNC_LUMINA` - Info from Lumina\n- `FUNC_OUTLINE` - Outlined code, not real function\n- `FUNC_REANALYZE` - Frame changed, needs reanalysis\n- `FUNC_UNWIND` - Exception unwind handler\n- `FUNC_CATCH` - Exception catch handler\n\n## Return Codes\n\n### MOVE_FUNC_*\n- `MOVE_FUNC_OK` - Success\n- `MOVE_FUNC_NOCODE` - No instruction at newstart\n- `MOVE_FUNC_BADSTART` - Bad new start\n- `MOVE_FUNC_NOFUNC` - No function at ea\n- `MOVE_FUNC_REFUSED` - Plugin refused\n\n### FIND_FUNC_* (flags)\n- `FIND_FUNC_NORMAL` - Stop on undefined byte\n- `FIND_FUNC_DEFINE` - Create instruction on undefined byte\n- `FIND_FUNC_IGNOREFN` - Ignore existing function boundaries\n- `FIND_FUNC_KEEPBD` - Don't modify boundaries, just create instructions\n\n### FIND_FUNC_* (results)\n- `FIND_FUNC_OK` - Ready for add_func()\n- `FIND_FUNC_EXIST` - Already exists\n- `FIND_FUNC_UNDEF` - Has unexplored bytes\n\n### IDASGN_*\n- `IDASGN_OK` - Success\n- `IDASGN_BADARG` - Bad argument\n- `IDASGN_APPLIED` - Already applied\n- `IDASGN_CURRENT` - Current signature\n- `IDASGN_PLANNED` - Planned for application\n\n### LIBFUNC_*\n- `LIBFUNC_FOUND` - Found and added\n- `LIBFUNC_NONE` - Not found\n- `LIBFUNC_DELAY` - Delayed (needs more analysis)\n\n## Iterators\n\n- `func_tail_iterator_t` - Iterate function tails\n- `func_item_iterator_t` - Iterate function items (addresses/code/data/heads)\n- `func_parent_iterator_t` - Iterate parent functions using tail\n\n## See Also\nFull docs: skill/docs/ida_funcs.rst\n","isInternal":false,"tokens":2303,"sizeBytes":7691},{"name":"ida_gdl.md","path":"skills/idapython/docs/ida_gdl.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_gdl.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_gdl\n\nLow level graph drawing operations - flow charts and call graphs.\n\n## Key Classes\n\n### FlowChart\nPythonic flowchart class for determining basic blocks.\n- `FlowChart(f, bounds, flags)` - Create flow chart for function\n- `size` - Number of blocks in flow chart\n- `refresh()` - Refresh flow chart\n- Iterate blocks directly: `for bb in fc: ...`\n\n### BasicBlock\nBasic block within a flowchart.\n- `id` - Block number\n- `start_ea`, `end_ea` - Address range\n- `type` - Block type (fcb_normal, fcb_ret, fcb_noret, etc.)\n- `preds()` - Iterator over predecessor blocks\n- `succs()` - Iterator over successor blocks\n\n### qflow_chart_t\nLow-level flow chart builder (use FlowChart instead for Python).\n- `create(title, pfn, ea1, ea2, flags)` - Build flow chart\n- `nsucc(node)`, `npred(node)` - Successor/predecessor counts\n- `succ(node, i)`, `pred(node, i)` - Get nth successor/predecessor\n\n## Key Functions\n\n- `gen_flow_graph(filename, title, pfn, ea1, ea2, gflags)` - Generate flow graph to .dot/.gdl\n- `gen_simple_call_chart(filename, wait, title, gflags)` - Simple call graph\n- `is_ret_block(btype)` - Check if block returns\n- `is_noret_block(btype)` - Check if block never returns\n\n## Constants\n\n**Block types**: fcb_normal, fcb_indjump, fcb_ret, fcb_cndret, fcb_noret, fcb_enoret, fcb_extern, fcb_error\n\n**Flow chart flags**: FC_NOEXT (no external blocks), FC_CALL_ENDS (calls end blocks), FC_NOPREDS (skip predecessors)\n\n**Chart generation**: CHART_GEN_DOT, CHART_GEN_GDL, CHART_WINGRAPH, CHART_NOLIBFUNCS\n\n## See Also\nFull docs: skill/docs/ida_gdl.rst\n","isInternal":false,"tokens":455,"sizeBytes":1556},{"name":"ida_graph.md","path":"skills/idapython/docs/ida_graph.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_graph.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_graph\n\nGraph view management - custom graph visualization and interaction (medium priority for typical reverse engineering).\n\n## Key Classes\n\n### GraphViewer\nPythonic class for creating custom graph views.\n- Override `OnRefresh()` - Populate graph nodes/edges\n- Override `OnGetText(node)` - Get node display text\n- Override `OnDblClick(node)` - Handle double-click\n- Override `OnClick(node)` - Handle single-click\n- `Show()` - Display graph viewer\n- `Close()` - Close graph viewer\n\n### interactive_graph_t\nLow-level interactive graph implementation (use GraphViewer instead for Python).\n\n### mutable_graph_t\nAbstract graph structure for manipulation.\n- `create_mutable_graph()` - Create new graph\n- `delete_mutable_graph(g)` - Delete graph\n\n## Key Functions\n\n### Graph Creation\n- `create_graph_viewer(title, gid, callback)` - Create graph viewer widget\n- `create_interactive_graph(title)` - Create interactive graph\n- `create_disasm_graph(ea)` - Create disassembly graph at address\n\n### Graph Manipulation\n- `get_node_info(graph, node)` - Get node display info (color, text, etc.)\n- `set_node_info(graph, node, info, flags)` - Set node properties\n- `del_node_info(graph, node)` - Delete node info\n- `viewer_set_node_info(viewer, node, info, flags)` - Set node info in viewer\n\n### Graph Navigation\n- `viewer_get_curnode(viewer)` - Get currently selected node\n- `viewer_center_on(viewer, node)` - Center view on node\n- `viewer_fit_window(viewer)` - Zoom to fit\n- `viewer_get_selection(viewer)` - Get selected items\n\n### Graph Groups\n- `viewer_create_groups(viewer, groups)` - Create node groups\n- `viewer_delete_groups(viewer, groups)` - Delete groups\n- `viewer_set_groups_visibility(viewer, groups, visible)` - Show/hide groups\n\n## Constants\n\n**Node info flags**: NIF_BG_COLOR, NIF_FRAME_COLOR, NIF_EA, NIF_TEXT, NIF_FLAGS, NIF_ALL\n\n**Layout types**: layout_digraph, layout_tree, layout_circle, layout_polar_tree, layout_orthogonal, layout_radial_tree\n\n**Graph item types**: git_none, git_edge, git_node, git_tool, git_text\n\n## See Also\nFull docs: skill/docs/ida_graph.rst\n","isInternal":false,"tokens":510,"sizeBytes":2078},{"name":"ida_hexrays.md","path":"skills/idapython/docs/ida_hexrays.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_hexrays.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_hexrays\n\nHex-Rays decompiler - microcode and ctree (AST) representations. **Critical for decompilation work.**\n\n## Core Architecture\n\n**Two representations**:\n- **Microcode**: Low-level optimized IR (mba_t, mblock_t, minsn_t, mop_t)\n- **Ctree**: High-level AST-like C code (cfunc_t, cinsn_t, cexpr_t)\n\n## Key Functions\n\n### Decompilation\n- `decompile(ea, hf=None, flags=0)` - Decompile function at address, returns cfuncptr_t\n- `decompile_func(pfn, hf=None, flags=0)` - Decompile func_t object\n- `gen_microcode(mbr, hf=None, retlist=None, flags=0, reqmat=MMAT_GLBOPT3)` - Generate microcode only\n\n### Callbacks\n- `install_hexrays_callback(callback)` - Register event hook (hxe_maturity, hxe_print_func, etc.)\n\n## Ctree Classes (High-Level)\n\n### cfunc_t\nDecompiled function - the main result.\n- `body` - Root cinsn_t (function body)\n- `lvars` - List of local variables (lvar_t)\n- `mba` - Underlying microcode (mba_t)\n- `get_pseudocode()` - Get text as list of lines\n- `build_c_tree()` - Rebuild ctree from microcode\n- `verify(allow_cot_empty)` - Validate ctree integrity\n\n### cinsn_t\nC statement (if, for, while, return, expression, block, etc.).\n- `op` - Statement type (cit_block, cit_if, cit_for, cit_while, cit_return, etc.)\n- `ea` - Associated address\n- `cif`, `cfor`, `cwhile`, `creturn`, `cexpr` - Type-specific data unions\n- Access via: `insn.cif.expr` (if condition), `insn.cblock` (compound statement)\n\n### cexpr_t\nC expression (operators, variables, constants, calls, etc.).\n- `op` - Expression type (cot_var, cot_num, cot_call, cot_add, cot_cast, etc.)\n- `type` - Expression type info (tinfo_t)\n- `x`, `y`, `z` - Operands (for binary/ternary ops)\n- `n` - Number value (cnumber_t)\n- `v` - Variable reference (var_ref_t)\n- `obj_ea` - Global variable/function address\n- `print1()` - Format as text\n\n### citem_t\nBase class for cinsn_t and cexpr_t.\n- `ea` - Address\n- `op` - Opcode (ctype_t enum)\n- `contains_label()` - Has goto label\n\n## Microcode Classes (Low-Level)\n\n### mba_t\nMicrocode array - function as basic blocks.\n- `qty` - Number of blocks\n- `get_mblock(n)` - Get block by index\n- `natural` - Natural (entry) block array\n- `vars` - Local variables (lvars_t)\n- `maturity` - Optimization level (MMAT_ZERO to MMAT_LVARS)\n- `build_graph()` - Construct CFG\n- `optimize_local(blk)` - Optimize single block\n- `optimize_global()` - Global optimization pass\n\n### mblock_t\nBasic block in microcode.\n- `head`, `tail` - First/last instruction (minsn_t)\n- `start`, `end` - Address range\n- `type` - Block type (BLT_STOP, BLT_1WAY, BLT_2WAY, BLT_NWAY)\n- `nsucc()`, `npred()` - Successor/predecessor counts\n- `succ(n)`, `pred(n)` - Get nth successor/predecessor\n- `for_all_insns(visitor)` - Iterate instructions\n- `insert_into_block(ins, where)` - Add instruction\n\n### minsn_t\nMicrocode instruction.\n- `opcode` - Operation (m_mov, m_add, m_call, m_ldx, m_stx, etc.)\n- `l`, `r`, `d` - Left, right, destination operands (mop_t)\n- `ea` - Instruction address\n- `next`, `prev` - Linked list pointers\n- `is_assert()` - Check if assertion\n- `equal_mops(other)` - Compare operands\n- `for_all_ops(visitor)` - Iterate operands\n\n### mop_t\nMicrocode operand.\n- `t` - Operand type (mop_z=none, mop_r=register, mop_n=immediate, mop_S=stack, mop_v=global, mop_b=block, mop_f=case, mop_l=local var, mop_a=address, mop_h=helper, mop_str=string, mop_c=call, mop_fn=function, mop_p=pair, mop_sc=scattered)\n- `r` - Register number (if mop_r)\n- `nnn` - Immediate value (mnumber_t, if mop_n)\n- `g` - Global address (if mop_v)\n- `s` - Stack offset (stkvar_ref_t, if mop_S)\n- `l` - Local var reference (lvar_t, if mop_l)\n- `size` - Operand size in bytes\n- `is_reg(reg, size)` - Check if specific register\n- `is_const()` - Check if constant\n\n### lvar_t\nLocal variable (stack/register).\n- `name` - Variable name\n- `type` - Variable type (tinfo_t)\n- `location` - vdloc_t (register or stack location)\n- `defea` - Definition address\n- `width` - Size in bytes\n- `is_stk_var()`, `is_reg_var()` - Location checks\n- `set_lvar_type(tif)` - Change type\n\n## Key Event Types\n\n**Maturity levels** (microcode optimization stages):\n- MMAT_ZERO - Unoptimized\n- MMAT_GENERATED - After instruction generation\n- MMAT_PREOPTIMIZED - After pre-optimization\n- MMAT_LOCOPT - After local optimization\n- MMAT_CALLS - After call analysis\n- MMAT_GLBOPT1/2/3 - Global optimization passes\n- MMAT_LVARS - After local variable allocation\n\n**Callback events**:\n- hxe_maturity - Microcode maturity changed\n- hxe_print_func - About to print function\n- hxe_func_printed - Function printed\n- hxe_open_pseudocode - Pseudocode window opened\n- hxe_create_hint - Create hover hint\n\n## Common Patterns\n\n### Decompile and get text\n```python\ncfunc = ida_hexrays.decompile(ea)\nfor line in cfunc.get_pseudocode():\n    print(line.line)\n```\n\n### Modify variable name/type\n```python\ncfunc = ida_hexrays.decompile(ea)\nlvar = cfunc.lvars[0]\nlvar.name = \"new_name\"\nlvar.set_lvar_type(new_tinfo)\ncfunc.save_user_labels()\n```\n\n### Walk ctree\n```python\nclass visitor(ida_hexrays.ctree_visitor_t):\n    def visit_expr(self, e):\n        if e.op == ida_hexrays.cot_call:\n            print(f\"Call at {e.ea:#x}\")\n        return 0\n\ncfunc = ida_hexrays.decompile(ea)\nvisitor().apply_to(cfunc.body, None)\n```\n\n### Walk microcode\n```python\nmba = ida_hexrays.gen_microcode(...)\nfor blk in mba.natural:\n    ins = blk.head\n    while ins:\n        print(f\"{ins.ea:#x}: {ins.opcode}\")\n        ins = ins.next\n```\n\n## See Also\nFull docs: skill/docs/ida_hexrays.rst\n\n**External resources**:\n- https://hex-rays.com/blog/hex-rays-decompiler-primer\n- https://hex-rays.com/blog/microcode-in-pictures\n","isInternal":false,"tokens":1696,"sizeBytes":5605},{"name":"ida_ida.md","path":"skills/idapython/docs/ida_ida.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_ida.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_ida\n\nDatabase-wide configuration via the `inf` structure - processor info, file type, address ranges, and analysis flags.\n\n## Key Functions\n\n### Database Properties\n- `inf_get_min_ea()`, `inf_set_min_ea(ea)` - Database address range start\n- `inf_get_max_ea()`, `inf_set_max_ea(ea)` - Database address range end\n- `inf_get_start_ea()`, `inf_set_start_ea(ea)` - Entry point address\n- `inf_get_baseaddr()`, `inf_set_baseaddr(ea)` - Image base address\n- `inf_get_main()`, `inf_set_main(ea)` - Main function address\n\n### Architecture Info\n- `inf_is_16bit()`, `inf_is_32bit_exactly()`, `inf_is_64bit()` - Architecture bit width\n- `inf_set_32bit(v)`, `inf_set_64bit(v)` - Set architecture\n- `inf_is_be()`, `inf_set_be(v)` - Big-endian check/set\n- `inf_is_dll()`, `inf_set_dll(v)` - DLL vs executable\n\n### File Information\n- `inf_get_procname()`, `inf_set_procname(name)` - Processor name (x86, ARM, etc.)\n- `inf_get_filetype()`, `inf_set_filetype(ft)` - File type (f_PE, f_ELF, f_MACHO, etc.)\n- `inf_get_md5()`, `inf_get_sha256()` - File hashes\n- `inf_get_input_file_path()` - Original input file path\n- `inf_get_imagebase()` - PE/ELF image base\n\n### Analysis Flags\n- `inf_get_af()`, `inf_set_af(flags)` - Get/set all analysis flags\n- `inf_get_af2()`, `inf_set_af2(flags)` - Secondary analysis flags\n- Analysis flag constants: AF_CODE, AF_JUMPTBL, AF_PROC, AF_LVAR, AF_TRACE, AF_FLIRT, etc.\n\n### Display Options\n- `inf_is_graph_view()`, `inf_set_graph_view(v)` - Default to graph vs text view\n- `inf_get_indent()`, `inf_set_indent(n)` - Disassembly indentation\n- `inf_get_margin()`, `inf_set_margin(n)` - Right margin\n\n### Database State\n- `inf_is_auto_enabled()`, `inf_set_auto_enabled(v)` - Auto-analysis state\n- `inf_readonly_idb()`, `inf_set_readonly_idb(v)` - Read-only mode\n- `inf_get_database_change_count()` - Change counter (for caching)\n\n### Compiler Info\n- `inf_get_cc_id()`, `inf_set_cc_id(id)` - Calling convention ID\n- `inf_get_cc_size_i()`, `inf_get_cc_size_l()` - sizeof(int), sizeof(long)\n- `inf_get_abibits()`, `inf_set_abibits(bits)` - ABI flags\n\n## Key Constants\n\n**File types**: f_PE, f_ELF, f_MACHO, f_BIN, f_COFF, f_OMF, f_AOUT, f_HEX\n\n**Analysis flags**: AF_CODE (create instructions), AF_JUMPTBL (analyze jump tables), AF_PROC (create functions), AF_LVAR (local variables), AF_FLIRT (apply FLIRT signatures)\n\n**Loader flags**: LFLG_64BIT, LFLG_IS_DLL, LFLG_PC_FLAT (flat memory model)\n\n**Name display**: NM_REL_OFF (show offsets), NM_EA (show addresses), NM_SHORT (short names)\n\n**Demangling**: DEMNAM_GCC3 (GCC v3 ABI), DEMNAM_CMNT (show in comments), DEMNAM_NAME (show as name)\n\n## See Also\nFull docs: skill/docs/ida_ida.rst\n","isInternal":false,"tokens":802,"sizeBytes":2651},{"name":"ida_idaapi.md","path":"skills/idapython/docs/ida_idaapi.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_idaapi.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_idaapi\n\nCore IDAPython infrastructure - plugin system, type definitions, and Python integration utilities.\n\n## Key Constants\n\n### Address Types\n- `ea_t` - Effective address type (int)\n- `BADADDR` - Invalid address sentinel\n- `BADADDR32` - 32-bit invalid address (0xFFFFFFFF)\n- `BADADDR64` - 64-bit invalid address (0xFFFFFFFFFFFFFFFF)\n\n### Plugin Return Codes\n- `PLUGIN_SKIP` - Plugin init failed, unload\n- `PLUGIN_OK` - Plugin loaded successfully\n- `PLUGIN_KEEP` - Keep plugin loaded\n\n## Key Functions\n\n- `require(modulename, package=None)` - Load or reload module (forces reload for development)\n- `notify_when(when, callback)` - Register event callbacks (NW_OPENIDB, NW_CLOSEIDB, etc.)\n- `as_cstr(s)` - Convert to C string\n- `as_uint32(v)`, `as_int32(v)`, `as_signed(v)` - Type conversions\n- `IDAPython_ExecScript(path)` - Execute Python script\n- `set_script_timeout(seconds)`, `disable_script_timeout()` - Script execution limits\n\n## Key Classes\n\n### plugin_t\nBase class for IDA plugins.\n- Override `init()`, `run()`, `term()` methods\n- Set `flags`, `comment`, `help`, `wanted_name`, `wanted_hotkey`\n\n### plugmod_t\nModern plugin module interface (IDA 7.2+).\n- Override `run(arg)` method\n- Supports multiple plugin instances\n\n## See Also\nFull docs: skill/docs/ida_idaapi.rst\n","isInternal":false,"tokens":343,"sizeBytes":1284},{"name":"ida_idc.md","path":"skills/idapython/docs/ida_idc.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_idc.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_idc\n\nMarked positions (bookmarks) in IDA database - low priority module with limited scope.\n\n## Key Functions\n\n- `mark_position(ea, lnnum, x, y, slot, comment)` - Create bookmark at address in slot (0-1023)\n- `get_marked_pos(slot)` - Get address of bookmark in slot\n- `get_mark_comment(slot)` - Get comment for bookmark in slot\n\n## See Also\nFull docs: skill/docs/ida_idc.rst\n","isInternal":false,"tokens":107,"sizeBytes":381},{"name":"ida_idd.md","path":"skills/idapython/docs/ida_idd.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_idd.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_idd\n\nInterface to debugger modules - defines structures for target processor debugging and API.\n\n## Key Classes/Functions\n\n### debug_event_t\nDebug event information container\n- `eid()` - get event type (PROCESS_STARTED, BREAKPOINT, EXCEPTION, etc.)\n- `modinfo()` - module info for PROCESS_STARTED/LIB_LOADED\n- `exc()` - exception details for EXCEPTION events\n- `bpt()` - breakpoint addresses\n\n### debugger_t\nDebugger module interface\n- `get_debug_event(event, timeout_ms)` - wait for debug event\n- `resume(event)` - continue execution\n- `read_registers(tid, clsmask, values)` - read thread registers\n- `write_register(tid, regidx, value)` - write thread register\n- `read_memory(nbytes, ea, buffer, size)` - read process memory\n- `write_memory(nbytes, ea, buffer, size)` - write process memory\n- `update_bpts(nbpts, bpts, nadd, ndel)` - add/delete breakpoints\n\n### regval_t\nRegister value container\n- `set_int(x)` - set integer value\n- `set_float(v)` - set floating point\n- `pyval(dtype)` - get Python value\n\n### Python Helpers\n- `dbg_read_memory(ea, sz)` - read debuggee memory, returns bytes or None\n- `dbg_write_memory(ea, buffer)` - write bytes to debuggee\n- `dbg_get_registers()` - get register definitions\n- `dbg_get_memory_info()` - get memory layout\n\n## Event Types\n- PROCESS_STARTED, PROCESS_EXITED, PROCESS_ATTACHED, PROCESS_DETACHED\n- THREAD_STARTED, THREAD_EXITED\n- BREAKPOINT, STEP, EXCEPTION\n- LIB_LOADED, LIB_UNLOADED\n\n## See Also\nFull docs: skill/docs/ida_idd.rst\n","isInternal":false,"tokens":382,"sizeBytes":1485},{"name":"ida_idp.md","path":"skills/idapython/docs/ida_idp.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_idp.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_idp\n\nInterface to processor modules - defines target assembler and processor features.\n\n## Key Classes/Functions\n\n### Instruction Analysis\n- `is_call_insn(insn)` - is instruction a call?\n- `is_ret_insn(insn, flags)` - is instruction a return?\n- `is_indirect_jump_insn(insn)` - is instruction an indirect jump?\n- `is_basic_block_end(insn, call_stops_block)` - does instruction end a basic block?\n- `has_cf_chg(feature, opnum)` - does instruction modify operand?\n- `has_cf_use(feature, opnum)` - does instruction use operand value?\n\n### Processor Info\n- `get_ph()` - get processor_t structure\n- `get_ash()` - get assembler asm_t structure\n- `set_processor_type(processor_name, level)` - change processor module\n- `get_idp_name()` - get current processor name\n- `str2reg(regname)` - convert register name to index\n- `get_reg_name(regidx, width)` - get register name\n\n### processor_t\nGlobal processor structure (accessed via `ph`)\n- `ph.id` - processor ID (PLFM_386, PLFM_ARM, PLFM_MIPS, etc.)\n- `ph.flag` - processor flags (PR_SEGS, PR_USE32, PR_USE64, etc.)\n- `ph.cnbits` / `ph.dnbits` - code/data address bits\n- `ph_get_instruc()` - get instruction names\n\n### Instruction Features (CF_*)\n- CF_STOP - doesn't continue execution\n- CF_CALL - call instruction\n- CF_CHG1..CF_CHG8 - modifies operand 1-8\n- CF_USE1..CF_USE8 - uses operand 1-8\n- CF_JUMP - indirect jump/call\n\n## See Also\nFull docs: skill/docs/ida_idp.rst\n","isInternal":false,"tokens":392,"sizeBytes":1419},{"name":"ida_ieee.md","path":"skills/idapython/docs/ida_ieee.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_ieee.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_ieee\n\nIEEE floating point conversion utilities.\n\n## Key Classes/Functions\n\n### fpvalue_t\nIEEE floating point value representation (internal format)\n- `from_str(p)` - parse from string\n- `to_str(buf, bufsize, mode)` - convert to string\n- `from_sval(x)` / `to_sval(round)` - convert to/from signed integer\n- `from_int64(x)` / `to_int64(round)` - convert to/from 64-bit int\n- `from_uint64(x)` / `to_uint64(round)` - convert to/from unsigned 64-bit\n- `from_10bytes(fpval)` / `to_10bytes(fpval)` - 10-byte float conversions\n- `from_12bytes(fpval)` / `to_12bytes(fpval)` - 12-byte float conversions\n- `fadd(y)`, `fsub(y)`, `fmul(y)`, `fdiv(y)` - arithmetic operations\n- `eabs()`, `negate()` - absolute value and negation\n- `is_negative()` - check sign\n- `get_kind()` - get value kind (FPV_NORM, FPV_NAN, FPV_PINF, FPV_NINF)\n\n## Error Codes\n- REAL_ERROR_OK, REAL_ERROR_FORMAT, REAL_ERROR_RANGE\n- REAL_ERROR_BADDATA, REAL_ERROR_FPOVER, REAL_ERROR_BADSTR\n- REAL_ERROR_ZERODIV, REAL_ERROR_INTOVER\n\n## See Also\nFull docs: skill/docs/ida_ieee.rst\n","isInternal":false,"tokens":324,"sizeBytes":1041},{"name":"ida_kernwin.md","path":"skills/idapython/docs/ida_kernwin.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_kernwin.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_kernwin\n\nInterface between kernel and UI - dialogs, menus, choosers, custom viewers, and UI utilities.\n\n## Key Functions\n\n### User Interaction\n- `msg(fmt, ...)` - print to output window\n- `warning(fmt, ...)` / `error(fmt, ...)` - show warning/error dialog\n- `ask_yn(defval, fmt, ...)` - yes/no question\n- `ask_str(defval, hist, fmt, ...)` - string input\n- `ask_long(defval, fmt, ...)` - integer input\n- `ask_addr(defval, fmt, ...)` - address input\n- `ask_file(forsave, defval, fmt, ...)` - file chooser\n\n### Navigation\n- `jumpto(ea, opnum=-1, uijmp_flags=0)` - jump to address\n- `get_screen_ea()` - current cursor address\n- `read_selection()` - get selected address range\n- `choose_func(title)` - let user choose a function\n- `choose_name(ea, title)` - let user choose a name\n\n### UI Elements\n- `find_widget(title)` - find widget by title\n- `activate_widget(widget, take_focus)` - activate widget\n- `close_widget(widget, flags)` - close widget\n- `open_*_window(ea)` - open disasm/hex/exports/imports/etc window\n\n### Actions\n- `register_action(desc)` - register menu action\n- `unregister_action(name)` - unregister action\n- `attach_action_to_menu(path, name, flags)` - add action to menu\n- `attach_action_to_toolbar(toolbar, name)` - add to toolbar\n- `update_action_*()` - update action state/label/icon/etc\n\n### Choosers (Lists)\n- `Choose` class - create custom list windows\n- `choose_refresh()` - refresh chooser\n- `get_chooser_obj(title)` - get chooser Python object\n\n### Custom Viewers\n- `create_empty_widget(title)` - empty widget\n- `create_code_viewer(widget, custviewer, flags)` - code viewer\n- `simplecustviewer_t` - simple text viewer\n\n### Misc\n- `execute_sync(func, reqf)` - execute in UI thread\n- `refresh_idaview()` / `refresh_idaview_anyway()` - refresh disassembly\n- `beep(type)` - system beep\n- `get_highlight(viewer)` - get highlighted identifier\n- `set_highlight(viewer, text, flags)` - set highlight\n\n## Widget Types (BWN_*)\nDISASM, HEXVIEW, OUTPUT, FUNCS, NAMES, STRINGS, SEGS, IMPORTS, EXPORTS, PSEUDOCODE, etc.\n\n## See Also\nFull docs: skill/docs/ida_kernwin.rst\n","isInternal":false,"tokens":587,"sizeBytes":2088},{"name":"ida_libfuncs.md","path":"skills/idapython/docs/ida_libfuncs.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_libfuncs.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_libfuncs\n\nFLIRT signature library metadata and access.\n\n## Key Functions\n\n- `get_idasgn_header_by_short_name(out_header, name)` - get signature header by short name\n- `get_idasgn_path_by_short_name(name)` - get full path to signature file\n\n## idasgn_header_t\n\nSignature file header structure\n- `processor_id` - target processor\n- `file_formats` - supported file formats\n- `ostype` - OS type (OSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_UNIX, etc.)\n- `apptype` - application type (APPT_CONSOLE, APPT_GRAPHIC, APPT_LIBRARY, APPT_DRIVER, etc.)\n- `libname_length` - library name length\n- `number_of_modules` - module count\n- `ctype_name` - compiler type name\n\n## Constants\n\n### OS Types\nOSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_OS2, OSTYPE_NETW, OSTYPE_UNIX, OSTYPE_OTHER\n\n### Application Types\n- APPT_CONSOLE, APPT_GRAPHIC, APPT_PROGRAM, APPT_LIBRARY, APPT_DRIVER\n- APPT_1THREAD, APPT_MTHREAD\n- APPT_16BIT, APPT_32BIT, APPT_64BIT\n\n## See Also\nFull docs: skill/docs/ida_libfuncs.rst\n","isInternal":false,"tokens":284,"sizeBytes":966},{"name":"ida_lines.md","path":"skills/idapython/docs/ida_lines.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_lines.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_lines\n\nLine rendering and text generation for disassembly output.\n\n## Key Functions\n\n### Line Generation\n- `generate_disasm_line(ea, flags)` - generate disassembly line at ea\n- `generate_many_lines(ea, flags)` - generate multiple lines (includes function header, etc.)\n- `tag_remove(tagged_line)` - remove color tags from line\n- `tag_skipcode(p)` - skip color tag at position\n- `tag_advance(p, cnt)` - advance by cnt printable characters\n\n### Color Tags\n- `SCOLOR_*` constants - color tag markers (instructions, registers, comments, etc.)\n- Lines contain embedded color codes (e.g., `\\x01` for instruction color)\n\n### Line Prefix/Suffix\n- `gl_comm` / `set_gl_comm(start, end)` - comment delimiters\n- `inf_get_indent()` - get indentation amount\n\n## Common Use Cases\n\nGenerate colored disassembly:\n```python\nline = ida_lines.generate_disasm_line(ea, 0)\nplain = ida_lines.tag_remove(line)\n```\n\n## Low Priority\n\nThis module is mostly for display formatting. Core analysis uses ida_ua (instruction decoding) and ida_bytes (data access) instead.\n\n## See Also\nFull docs: skill/docs/ida_lines.rst\n","isInternal":false,"tokens":272,"sizeBytes":1095},{"name":"ida_loader.md","path":"skills/idapython/docs/ida_loader.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_loader.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_loader\n\nLoader and file operations - loading binaries, database management, file I/O, and plugin loading.\n\n## Key Functions\n\n### Database Operations\n- `save_database(outfile=None, flags=-1, root=None, attr=None)` - Save database with optional new filename\n- `flush_buffers()` - Flush buffers to disk\n- `is_trusted_idb()` - Check if database is trusted\n- `get_path(pt)` / `set_path(pt, path)` - Get/set file paths (PATH_TYPE_CMD, PATH_TYPE_IDB, PATH_TYPE_ID0)\n\n### File Loading\n- `load_binary_file(filename, li, neflags, fileoff, basepara, binoff, nbytes)` - Load binary into database\n- `file2base(li, pos, ea1, ea2, patchable)` - Load file portion into address range\n- `mem2base(mem, ea, fpos)` - Load from memory buffer\n- `reload_file(file, is_remote)` - Reload input file bytes without losing analysis\n- `base2file(fp, pos, ea1, ea2)` - Unload database to binary file\n\n### File Type Detection\n- `get_basic_file_type(li)` - Recognize file type (libraries, zip, etc.)\n- `get_file_type_name()` - Get current file type name (from idainfo.filetype)\n\n### Output Generation\n- `gen_file(otype, fp, ea1, ea2, flags)` - Generate output files (MAP, EXE, IDC, LST, ASM, DIF)\n- `gen_exe_file(fp)` - Generate executable file from database\n\n### File/Memory Mapping\n- `get_fileregion_offset(ea)` - Get file offset for linear address (returns -1 if unmapped)\n- `get_fileregion_ea(offset)` - Get linear address for file offset (returns BADADDR if not found)\n\n### Plugin Management\n- `load_plugin(name)` - Load plugin by name or path\n- `run_plugin(plg, arg)` - Run loaded plugin with argument\n- `load_and_run_plugin(name, arg)` - Load and run plugin in one call\n- `find_plugin(name, load_if_needed=False)` - Find plugin, optionally loading it\n- `get_plugin_options(plugin)` - Get -Oplugin:options from command line\n\n### Import/IDS\n- `set_import_ordinal(modnode, ea, ord)` - Set ordinal import entry info\n- `set_import_name(modnode, ea, name)` - Set named import entry info\n- `load_ids_module(fname)` - Load and apply IDS file\n\n### Archives\n- `process_archive(temp_file, li, module_name, neflags, defmember, loader)` - Process archive file\n- `extract_module_from_archive(fname, is_remote=False)` - Extract module from archive interactively\n\n### Snapshots\n- `build_snapshot_tree(root)` - Build snapshot tree structure\n\n## Key Classes\n\n### snapshot_t\nDatabase snapshot representation.\n- `id` - Snapshot ID (qtime64_t timestamp)\n- `flags` - Snapshot flags (SSF_AUTOMATIC, etc.)\n- `desc` - Description string (max 128 chars)\n- `filename` - Snapshot filename\n- `children` - Child snapshots\n\n### plugin_info_t\nPlugin metadata.\n- `path` - Full plugin path\n- `name` - Short name (appears in menu)\n- `hotkey` - Current hotkey\n- `flags` - Plugin flags\n- `comment` - Plugin comment\n\n### loader_t\nLoader module interface (low-priority: advanced loader development only).\n\n### idp_desc_t / idp_name_t\nProcessor module metadata (low-priority: processor module development).\n\n## Key Flags\n\n### Load Flags (NEF_*)\n- `NEF_FIRST` - First file loaded into database\n- `NEF_SEGS` - Create segments\n- `NEF_CODE` - Load as code segment\n- `NEF_RELOAD` - Reload at same place (don't recreate segments/fixups)\n- `NEF_FLAT` - Autocreate FLAT group (PE)\n\n### Database Flags (DBFL_*)\n- `DBFL_KILL` - Delete unpacked database\n- `DBFL_COMP` - Collect garbage\n- `DBFL_BAK` - Create backup file\n- `DBFL_TEMP` - Temporary database\n\n### Output File Types (OFILE_*)\n- `OFILE_MAP` - MAP file\n- `OFILE_EXE` - Executable\n- `OFILE_IDC` - IDC script\n- `OFILE_LST` - Disassembly listing\n- `OFILE_ASM` - Assembly\n- `OFILE_DIF` - Difference\n\n## See Also\nFull docs: skill/docs/ida_loader.rst\n","isInternal":false,"tokens":996,"sizeBytes":3635},{"name":"ida_merge.md","path":"skills/idapython/docs/ida_merge.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_merge.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_merge\n\nIDA Teams merge functionality - 3-way merging of IDB files (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for IDA Teams only. Handles merging of base_idb, local_idb, and remote_idb databases with conflict resolution.\n\n## Key Concepts\n\n- **base_idb**: Common ancestor database (middle pane in UI)\n- **local_idb**: Local database receiving merge result (left pane)\n- **remote_idb**: Remote database merging into local (right pane)\n\n## Merge Phases\nMerges occur in phases: global settings, segmentation, bytes, names, functions, types, debugger settings, etc.\n\n## Key Functions\n\n- `is_diff_merge_mode()` - Check if in merge/diff mode\n- `create_nodeval_merge_handler()` / `create_nodeval_merge_handlers()` - Create merge handlers for custom data\n- `destroy_moddata_merge_handlers()` - Destroy module data merge handlers\n- `get_ea_diffpos_name()` - Get name of EA difference position\n\n## Key Classes\n\n### merge_data_t\nMerge operation data container.\n\n### merge_handler_params_t\nParameters for creating merge handlers.\n\n### merge_node_helper_t / merge_node_info_t\nHelpers for merging netnode data.\n\n## Merge Kinds (MERGE_KIND_*)\nExtensive list including: NETNODE, INF, SEGMENTS, FUNC, FRAME, EXPORTS, IMPORTS, ENUMS, STRUCTS, TILS, TINFO, BYTEVAL, FLAGS, CREFS, DREFS, BPTS, DEBUGGER, etc.\n\n## See Also\nFull docs: skill/docs/ida_merge.rst\n","isInternal":false,"tokens":340,"sizeBytes":1361},{"name":"ida_mergemod.md","path":"skills/idapython/docs/ida_mergemod.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_mergemod.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_mergemod\n\nHelper functions for plugin/processor module merging in IDA Teams (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for plugin/processor developers needing to merge custom module data. Used in response to `ev_create_merge_handlers` event.\n\n## Key Function\n\n- `create_std_modmerge_handlers(mhp, helper, merge_node_info=None)` - Create standard merge handlers for module data\n\n## Merge Sources Supported\n1. Data fields inside moddata (plugmod_t/procmod_t)\n2. Values in module netnode\n3. Values in arbitrary netnodes\n4. Data fields in auxiliary structures\n5. Indexed arrays in netnodes\n\n## See Also\nFull docs: skill/docs/ida_mergemod.rst\nExamples: plugins/mex1, plugins/mex2, plugins/mex3, plugins/ex_merge_ldrdata\n","isInternal":false,"tokens":184,"sizeBytes":740},{"name":"ida_moves.md","path":"skills/idapython/docs/ida_moves.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_moves.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_moves\n\nNavigation history, bookmarks, and location tracking in IDA views.\n\n## Key Classes\n\n### lochist_entry_t\nLocation history entry combining place and renderer info.\n- `rinfo` - Renderer information (renderer_info_t)\n- `plce` - Place pointer (place_t*)\n- `place()` / `set_place(p)` - Get/set place\n- `is_valid()` - Check if entry is valid\n- `renderer_info()` - Get renderer info reference\n\n### navstack_entry_t\nNavigation stack entry extending lochist_entry_t.\n- `widget_id` - Widget identifier\n- `ud_str` - User-defined string\n- Inherits all lochist_entry_t members\n\n### navstack_t\nNavigation history stack (back/forward navigation).\n- `init(defpos, stream_name, flags)` - Initialize stack\n- `set_current(e, in_charge)` / `get_current(out, widget_id)` - Set/get current position\n- `stack_jump(try_to_unhide, e)` - Jump to entry\n- `stack_back(out, cnt, try_to_unhide)` / `stack_forward(out, cnt, try_to_unhide)` - Navigate backward/forward\n- `stack_nav(out, forward, cnt, try_to_unhide)` - Generic navigation\n- `stack_index()` / `stack_size()` - Get current index/size\n- `stack_clear(new_tip)` - Clear stack with new tip\n- `get_stack_entry(out, index)` / `set_stack_entry(index, e)` - Get/set entry at index\n- `is_history_enabled()` - Check if history is enabled\n\n### bookmarks_t\nBookmark management (static methods).\n- `mark(e, index, title, desc, ud)` - Create/update bookmark\n- `get(out, index, ud)` - Get bookmark entry\n- `get_desc(e, index, ud)` - Get bookmark description\n- `find_index(e, ud)` - Find bookmark index\n- `size(e, ud)` - Get bookmark count\n- `erase(e, index, ud)` - Delete bookmark\n- `get_dirtree_id(e, ud)` - Get dirtree ID for bookmark\n\n### renderer_info_t\nView renderer state (graph position, zoom, cursor).\n- `rtype` - Renderer type (tcc_renderer_type_t)\n- `gli` - Graph location info (graph_location_info_t)\n- `pos` - Position info (renderer_info_pos_t)\n\n### graph_location_info_t\nGraph view location and zoom state.\n- `zoom` - Zoom level\n- `orgx` / `orgy` - Origin coordinates\n\n### segm_move_info_t / segm_move_infos_t\nSegment relocation tracking (for when segments move).\n- `to` - Target address\n- `size` - Size moved\n- `find(ea)` - Find move info for address\n\n## Constants\n\n### Location State Flags (LSEF_*)\n- `LSEF_PLACE` - Place component\n- `LSEF_RINFO` - Renderer info component\n- `LSEF_PTYPE` - Place type component\n- `LSEF_ALL` - All components\n\n### Unhide Flags (UNHID_*)\n- `UNHID_SEGM` - Unhid segment at target\n- `UNHID_FUNC` - Unhid function at target\n- `UNHID_RANGE` - Unhid range at target\n\n### Other Constants\n- `MAX_MARK_SLOT` - Maximum bookmark slot number\n- `LHF_HISTORY_DISABLED` - History disabled flag\n- `DEFAULT_CURSOR_Y` / `DEFAULT_LNNUM` - Default cursor position\n\n## See Also\nFull docs: skill/docs/ida_moves.rst\n","isInternal":false,"tokens":768,"sizeBytes":2770},{"name":"ida_nalt.md","path":"skills/idapython/docs/ida_nalt.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_nalt.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_nalt\n\nNetnode-based storage for various analysis information - switch tables, references, types, strings, imports, metadata.\n\n## Key Functions\n\n### Netnode Access\n- `ea2node(ea)` / `node2ea(node)` - Convert between addresses and netnodes\n- `end_ea2node(ea, size)` - Get netnode for address range end\n- `getnode(ea)` - Get netnode for address\n\n### Address Flags (AFL_*)\nExtensive flag system for tracking analysis state at addresses.\n\n#### Query Flags\n- `get_aflags(ea)` / `set_aflags(ea, flags)` / `del_aflags(ea)` - Get/set/delete flags\n- `upd_abits(ea, set, clr)` / `set_abits(ea, bits)` / `clr_abits(ea, bits)` - Update address bits\n- `is_hidden_item(ea)` / `hide_item(ea)` / `unhide_item(ea)` - Item visibility\n- `is_hidden_border(ea)` / `hide_border(ea)` / `unhide_border(ea)` - Border visibility\n- `is_colored_item(ea)` / `set_colored_item(ea)` / `clr_colored_item(ea)` - Colored items\n- `is_usersp(ea)` / `set_usersp(ea)` / `clr_usersp(ea)` - User stack pointer\n- `uses_modsp(ea)` / `set_usemodsp(ea)` / `clr_usemodsp(ea)` - Modified stack pointer\n- `is_libitem(ea)` / `set_libitem(ea)` / `clr_libitem(ea)` - Library item\n- `is_noret(ea)` / `set_noret(ea)` / `clr_noret(ea)` - No-return function\n- `is_notcode(ea)` / `set_notcode(ea)` / `clr_notcode(ea)` - Not code\n- `is_notproc(ea)` / `set_notproc(ea)` / `clr_notproc(ea)` - Not procedure\n- `is_type_guessed_by_ida(ea)` / `set_type_guessed_by_ida(ea)` - IDA type guess\n- `is_func_guessed_by_hexrays(ea)` / `set_func_guessed_by_hexrays(ea)` - Hex-Rays function guess\n- `is_data_guessed_by_hexrays(ea)` / `set_data_guessed_by_hexrays(ea)` - Hex-Rays data guess\n- `is_type_determined_by_hexrays(ea)` / `set_type_determined_by_hexrays(ea)` - Hex-Rays type determination\n\n### Type Information\n- `get_tinfo(tif, ea)` / `set_tinfo(ea, tif)` / `del_tinfo(ea)` - Address type info\n- `get_op_tinfo(tif, ea, opnum)` / `set_op_tinfo(ea, opnum, tif)` / `del_op_tinfo(ea, opnum)` - Operand type info\n- `has_ti(ea)` / `has_ti0(ea)` / `has_ti1(ea)` - Check if type info exists\n\n### String Types\n- `get_str_type(ea)` / `set_str_type(ea, strtype)` / `del_str_type(ea)` - String type at address\n- `get_str_type_code(strtype)` - Get string type code\n- `get_str_term1(strtype)` / `get_str_term2(strtype)` - String terminators\n- `get_str_encoding_idx(ea)` / `set_str_encoding_idx(ea, idx)` - String encoding\n- `make_str_type(base, lyt)` - Construct string type code\n- `is_pascal(strtype)` - Check if Pascal string\n- `get_str_type_prefix_length(strtype)` - Get prefix length\n\n### References and Offsets\n- `get_refinfo(ri, ea, opnum)` / `set_refinfo(ea, opnum, type, target, base, tdelta)` / `del_refinfo(ea, opnum)` - Reference info\n- `set_refinfo_ex(ea, opnum, ri)` - Set reference info with refinfo_t\n- `get_custom_refinfo(out, cfmt)` / `find_custom_refinfo(cfmt)` - Custom reference formats\n- `get_reftype_by_size(size)` - Get reference type by size\n- `is_reftype_target_optional(rt)` - Check if target is optional\n\n### Switch Tables\n- `get_switch_info(si, ea)` / `set_switch_info(ea, si)` / `del_switch_info(ea)` - Switch info\n- `get_switch_parent(ea)` / `set_switch_parent(ea, parent)` / `del_switch_parent(ea)` - Switch parent\n\n### Arrays\n- `get_array_parameters(out, ea)` / `set_array_parameters(ea, params)` / `del_array_parameters(ea)` - Array display parameters\n\n### Custom Data Types\n- `get_custom_data_type_ids(out, ea)` / `set_custom_data_type_ids(ea, ids)` / `del_custom_data_type_ids(ea)` - Custom data types\n\n### Colors and Alignment\n- `get_item_color(ea)` / `set_item_color(ea, color)` / `del_item_color(ea)` - Item color\n- `get_alignment(ea)` / `set_alignment(ea, align)` / `del_alignment(ea)` - Alignment\n\n### Source Line Numbers\n- `get_source_linnum(ea)` / `set_source_linnum(ea, lnnum)` / `del_source_linnum(ea)` - Source line mapping\n\n### Absolute Base\n- `get_absbase(ea)` / `set_absbase(ea, base)` / `del_absbase(ea)` - Absolute segment base\n\n### File Metadata\n- `get_root_filename()` / `set_root_filename(path)` - Input file root name\n- `get_input_file_path()` - Input file full path\n- `dbg_get_input_path()` - Debugger input path\n- `retrieve_input_file_size()` - File size\n- `retrieve_input_file_crc32()` / `retrieve_input_file_md5()` / `retrieve_input_file_sha256()` - File hashes\n- `get_archive_path()` / `set_archive_path(path)` - Archive path\n- `get_loader_format_name()` / `set_loader_format_name(name)` - Loader format\n\n### IDB Version and Timing\n- `get_initial_ida_version()` / `get_initial_idb_version()` - IDA/IDB versions\n- `get_idb_ctime()` - IDB creation time\n- `get_elapsed_secs()` - Analysis elapsed time\n- `get_idb_nopens()` - IDB open count\n\n### Image Base\n- `get_imagebase()` / `set_imagebase(base)` - Image base address\n\n### String Encodings\n- `get_encoding_qty()` - Number of encodings\n- `get_encoding_name(idx)` - Encoding name\n- `add_encoding(name, bpu)` / `del_encoding(idx)` / `rename_encoding(idx, name)` - Manage encodings\n- `get_encoding_bpu(idx)` / `get_encoding_bpu_by_name(name)` - Bytes per unit\n- `get_strtype_bpu(strtype)` - String type bytes per unit\n- `get_default_encoding_idx()` / `set_default_encoding_idx(idx)` - Default encoding\n- `get_outfile_encoding_idx()` / `set_outfile_encoding_idx(idx)` - Output file encoding\n- `encoding_from_strtype(strtype)` - Get encoding from string type\n\n### Imports\n- `get_import_module_qty()` - Number of import modules\n- `get_import_module_name(idx)` - Import module name\n- `enum_import_names(idx, callback)` - Enumerate imports\n- `delete_imports()` - Delete all imports\n\n### GOT/PLT\n- `get_gotea()` / `set_gotea(ea)` - Global Offset Table address\n\n### Notepad\n- `get_ida_notepad_text()` / `set_ida_notepad_text(text)` - IDA notepad text\n\n### Source Debug Paths\n- `get_srcdbg_paths()` / `set_srcdbg_paths(paths)` - Source debug paths\n- `get_srcdbg_undesired_paths()` / `set_srcdbg_undesired_paths(paths)` - Undesired debug paths\n\n### Assembly Include\n- `get_asm_inc_file()` / `set_asm_inc_file(file)` - Assembly include file\n\n### IDS Modules\n- `get_ids_modnode()` / `set_ids_modnode(node)` - IDS module netnode\n\n### ABI\n- `get_abi_name()` - ABI name\n\n## Key Classes\n\n### switch_info_t\nSwitch statement information.\n- `flags` - Switch flags (SWI_*)\n- `ncases` - Number of cases (excluding default)\n- `jumps` - Jump table start address\n- `values` - Values table address (if SWI_SPARSE)\n- `lowcase` - Lowest case value\n- `defjump` - Default jump address (BADADDR if none)\n- `startea` - Start of switch idiom\n- `jcases` - Jump table entries (if SWI_INDIRECT)\n- `elbase` - Element base\n- `regnum` / `regdtype` - Switch expression register\n- `get_jtable_size()` / `set_jtable_size(size)` - Jump table size\n- `get_jtable_element_size()` / `set_jtable_element_size(size)` - Element size\n- `has_default()` / `is_sparse()` / `is_custom()` / `is_indirect()` / `is_subtract()` - Query flags\n\n### refinfo_t\nReference/offset information.\n- `target` - Reference target (BADADDR if none)\n- `base` - Base of reference (may be BADADDR)\n- `tdelta` - Offset from target\n- `flags` - Reference flags (REFINFO_*)\n- `type()` / `set_type(rt)` - Reference type (REF_OFF16, REF_OFF32, REF_OFF64, etc.)\n- `is_target_optional()` / `no_base_xref()` / `is_pastend()` / `is_rvaoff()` / `is_custom()` / `is_subtract()` / `is_signed()` - Query flags\n- `init()` - Initialize\n\n### array_parameters_t\nArray display parameters.\n- `flags` - Array flags (AP_*)\n- `lineitems` - Items per line\n- `alignment` - Item alignment (-1=don't align, 0=auto, else width)\n- `is_default()` - Check if default\n\n### opinfo_t\nOperand type information union (structure/enum/strpath/custom).\n\n### strpath_t\nStructure path for nested structure member offsets.\n\n### enum_const_t\nEnumeration constant reference.\n\n## Key Constants\n\n### String Types (STRTYPE_*)\n- `STRTYPE_TERMCHR` / `STRTYPE_C` / `STRTYPE_C_16` / `STRTYPE_C_32` - C strings\n- `STRTYPE_PASCAL` / `STRTYPE_PASCAL_16` / `STRTYPE_PASCAL_32` - Pascal strings\n- `STRTYPE_LEN2` / `STRTYPE_LEN2_16` / `STRTYPE_LEN2_32` - 2-byte length prefix\n- `STRTYPE_LEN4` / `STRTYPE_LEN4_16` / `STRTYPE_LEN4_32` - 4-byte length prefix\n\n### String Layout (STRLYT_*)\n- `STRLYT_TERMCHR` / `STRLYT_PASCAL1` / `STRLYT_PASCAL2` / `STRLYT_PASCAL4` - Layout types\n\n### String Width (STRWIDTH_*)\n- `STRWIDTH_1B` / `STRWIDTH_2B` / `STRWIDTH_4B` - Character width\n\n### Reference Types (REF_*)\n- `REF_OFF16` / `REF_OFF32` / `REF_OFF64` - Full offsets\n- `REF_LOW8` / `REF_LOW16` / `REF_HIGH8` / `REF_HIGH16` - Partial offsets\n\n### Reference Info Flags (REFINFO_*)\n- `REFINFO_RVAOFF` - RVA offset\n- `REFINFO_PASTEND` - Past end of segment\n- `REFINFO_CUSTOM` - Custom format\n- `REFINFO_NOBASE` - No base\n- `REFINFO_SUBTRACT` - Subtract instead of add\n- `REFINFO_SIGNEDOP` - Signed operand\n\n### Switch Info Flags (SWI_*)\n- `SWI_SPARSE` - Sparse switch (has values table)\n- `SWI_V32` / `SWI_J32` - 32-bit values/jumps\n- `SWI_USER` - User-defined\n- `SWI_CUSTOM` - Custom switch\n- `SWI_INDIRECT` - Indirect jump table\n\n### Address Flags (AFL_*)\nExtensive flag set including: AFL_LINNUM, AFL_USERSP, AFL_PUBNAM, AFL_WEAKNAM, AFL_HIDDEN, AFL_MANUAL, AFL_NOBRD, AFL_ZSTROFF, AFL_LIB, AFL_TI, AFL_COLORED, AFL_NORET, AFL_FIXEDSPD, AFL_ALIGNFLOW, AFL_USERTI, AFL_RETFP, AFL_USEMODSP, AFL_NOTCODE, AFL_NOTPROC, and type guessing flags.\n\n### Root Info Indices (RIDX_*)\nDatabase-level metadata keys: RIDX_FILE_FORMAT_NAME, RIDX_MD5, RIDX_SHA256, RIDX_IDA_VERSION, RIDX_STR_ENCODINGS, RIDX_SRCDBG_PATHS, RIDX_DBG_BINPATHS, RIDX_ABINAME, RIDX_ARCHIVE_PATH, RIDX_PROBLEMS, etc.\n\n## See Also\nFull docs: skill/docs/ida_nalt.rst\n","isInternal":false,"tokens":2955,"sizeBytes":9519},{"name":"ida_name.md","path":"skills/idapython/docs/ida_name.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_name.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_name\n\nName management - getting, setting, validating, and demangling names at addresses.\n\n## Key Functions\n\n### Getting Names\n- `get_name(ea)` - Get name at address (simple form)\n- `get_colored_name(ea)` - Get name with color tags\n- `get_ea_name(ea, gtn_flags=0)` - Get name with flags (alias for get_name with flags)\n- `get_visible_name(ea, gtn_flags=0)` - Get visible name (respects hidden status)\n- `get_short_name(ea, gtn_flags=0)` - Get short form name\n- `get_long_name(ea, gtn_flags=0)` - Get long form name\n- `get_colored_short_name(ea, gtn_flags=0)` - Colored short name\n- `get_colored_long_name(ea, gtn_flags=0)` - Colored long name\n\n### Setting Names\n- `set_name(ea, name, flags=0)` - Set or delete name at address\n- `force_name(ea, name, flags=0)` - Force name (add suffix if needed)\n- `del_global_name(ea)` - Delete global name\n- `del_local_name(ea)` - Delete local name\n- `set_dummy_name(from_ea, ea)` - Generate autogenerated dummy name (loc_, sub_, etc.)\n- `make_name_auto(ea)` - Mark name as autogenerated\n- `make_name_user(ea)` - Mark name as user-defined\n- `make_name_public(ea)` - Make name public\n- `make_name_non_public(ea)` - Make name non-public\n- `make_name_weak(ea)` - Make name weak\n- `make_name_non_weak(ea)` - Make name non-weak\n\n### Name Lookup\n- `get_name_ea(from_ea, name)` - Get address for name (search from address)\n- `get_name_base_ea(from_ea, to_ea)` - Get base address for name\n- `get_name_value(from_ea, name)` - Get name value\n\n### Name Visibility\n- `hide_name(ea)` - Hide name from display\n- `show_name(ea)` - Show previously hidden name\n\n### Name Validation\n- `is_valid_cp(cp, kind, data=None)` - Check if codepoint is valid for name type\n- `is_ident_cp(cp)` - Check if codepoint is valid identifier character\n- `is_strlit_cp(cp, ranges=None)` - Check if valid in string literal\n- `is_visible_cp(cp)` - Check if codepoint is visible\n- `is_ident(name)` - Check if valid identifier\n- `is_uname(name)` - Check if valid user name\n- `is_valid_typename(name)` - Check if valid type name\n- `validate_name(name, type, flags=1)` - Validate name for type with flags\n- `cleanup_name(ea, name, flags=0)` - Clean up name (remove invalid chars)\n- `extract_name(line, x)` - Extract name from line at position\n\n### Name List\n- `get_nlist_size()` - Get name list size\n- `get_nlist_idx(ea)` - Get index in name list\n- `is_in_nlist(ea)` - Check if address is in name list\n- `get_nlist_ea(idx)` - Get address at name list index\n- `get_nlist_name(idx)` - Get name at name list index\n- `rebuild_nlist()` - Rebuild name list\n- `reorder_dummy_names()` - Reorder dummy names\n\n### Debug Names\n- `set_debug_name(ea, name)` - Set debug name (from debug info)\n- `get_debug_name(ea_ptr, how)` - Get debug name with transform\n- `del_debug_names(ea1, ea2)` - Delete debug names in range\n- `get_debug_name_ea(name)` - Get address for debug name\n- `get_debug_names(...)` - Get all debug names\n- `is_name_defined_locally(...)` - Check if name is locally defined\n\n### Name Demangling\n- `demangle_name(name, disable_mask, demreq=DQT_FULL)` - Demangle C++ name\n- `get_demangled_name(ea, inhibitor, demform, gtn_flags=0)` - Get demangled name at address\n- `get_mangled_name_type(name)` - Get mangled name type (CODE, DATA, UNKNOWN)\n\n### Utility\n- `calc_gtn_flags(fromaddr, ea)` - Calculate get name flags\n- `set_cp_validity(...)` / `get_cp_validity(...)` - Set/get codepoint validity\n\n## Key Flags\n\n### Set Name Flags (SN_*)\n- `SN_CHECK` - Fail if name contains invalid characters\n- `SN_NOCHECK` - Replace invalid characters silently with '_'\n- `SN_PUBLIC` / `SN_NON_PUBLIC` - Make public/non-public\n- `SN_WEAK` / `SN_NON_WEAK` - Make weak/non-weak\n- `SN_AUTO` / `SN_NON_AUTO` - Make autogenerated/non-autogenerated\n- `SN_NOLIST` - Exclude from name list\n- `SN_NOWARN` - Don't display warning if failed\n- `SN_LOCAL` - Create local name (requires function context)\n- `SN_IDBENC` - Name is in IDB encoding\n- `SN_FORCE` - Add numerical suffix if name exists (_123)\n- `SN_NODUMMY` - Prepend '_' if name begins with dummy suffix\n- `SN_DELTAIL` - Delete hindering item if tail byte conflicts\n- `SN_MULTI` - Add as alternative name comment if name exists\n- `SN_MULTI_FORCE` - Replace name, move old to comment\n\n### Get Name Flags (GN_*)\n- `GN_VISIBLE` - Get visible name\n- `GN_COLORED` - Include color tags\n- `GN_DEMANGLED` - Get demangled name\n- `GN_STRICT` - Strict name lookup\n- `GN_SHORT` - Short form\n- `GN_LONG` - Long form\n- `GN_LOCAL` - Include local names\n- `GN_ISRET` / `GN_NOT_ISRET` - Is/isn't return value\n- `GN_NOT_DUMMY` - Exclude dummy names\n\n### Get Name Ex Flags (GETN_*)\n- `GETN_APPZERO` - Append zero to result\n- `GETN_NOFIXUP` - Don't apply fixups\n- `GETN_NODUMMY` - Don't return dummy names\n\n### Get Near Comment Flags (GNCN_*)\n- `GNCN_NOSEG` - Don't include segment name\n- `GNCN_NOCOLOR` - No color tags\n- `GNCN_NOLABEL` - Don't include label\n- `GNCN_NOFUNC` - Don't include function name\n- `GNCN_SEG_FUNC` - Include segment and function\n- `GNCN_SEGNUM` - Include segment number\n- `GNCN_REQFUNC` - Require function\n- `GNCN_REQNAME` - Require name\n- `GNCN_NODBGNM` - No debug names\n- `GNCN_PREFDBG` - Prefer debug names\n\n### Debug Name Flags (DEBNAME_*)\n- `DEBNAME_EXACT` - Exact match\n- `DEBNAME_LOWER` - Convert to lowercase\n- `DEBNAME_UPPER` - Convert to uppercase\n- `DEBNAME_NICE` - Nice formatting\n\n### Demangling Flags (DQT_*)\n- `DQT_FULL` - Full demangling\n- `DQT_NAME_TYPE` - Name and type only\n- `DQT_COMPILER` - Compiler-specific\n- `DQT_NPURGED_2` / `DQT_NPURGED_4` / `DQT_NPURGED_8` - Number of purged bytes\n\n### Name Types (NT_*)\n- `NT_NONE` - No name\n- `NT_BYTE` - Byte name\n- `NT_LOCAL` - Local name\n- `NT_STKVAR` - Stack variable\n- `NT_ENUM` - Enum member\n- `NT_ABS` - Absolute symbol\n- `NT_SEG` - Segment\n- `NT_STROFF` - Structure offset\n- `NT_BMASK` - Bitmask\n- `NT_REGVAR` - Register variable\n\n### Validate Name Types (VNT_*)\n- `VNT_IDENT` - Identifier\n- `VNT_TYPE` - Type name\n- `VNT_UDTMEM` - User-defined type member\n- `VNT_STRLIT` - String literal\n- `VNT_VISIBLE` - Visible name\n\n### Cleanup Name Flags (CN_*)\n- `CN_KEEP_TRAILING_DIGITS` - Keep trailing digits\n- `CN_KEEP_UNDERSCORES` - Keep underscores\n\n### Mangling Flags (MNG_*)\nExtensive demangling control: MNG_NOTYPE, MNG_NORETTYPE, MNG_NOBASEDT, MNG_NOCALLC, MNG_NOTHROW, MNG_SHORT_FORM, MNG_LONG_FORM, etc.\n\n### Calling Conventions (MT_*)\n- `MT_CDECL` / `MT_PASCAL` / `MT_STDCALL` / `MT_FASTCALL` / `MT_THISCALL` / `MT_VECTORCALL` / `MT_REGCALL` - Calling conventions\n- `MT_SYSCALL` / `MT_INTERRUPT` - Special conventions\n\n### Compilers (MT_*)\n- `MT_MSCOMP` - Microsoft compiler\n- `MT_BORLAN` - Borland compiler\n- `MT_WATCOM` - Watcom compiler\n- `MT_GNU` / `MT_GCC3` - GNU/GCC compilers\n- `MT_OTHER` - Other compiler\n\n## Classes\n\n### ea_name_t\nAddress-name pair.\n\n### ea_name_vec_t\nVector of ea_name_t.\n\n### NearestName\nNearest name helper class.\n\n## Constants\n\n- `MAXNAMELEN` - Maximum name length (including terminator)\n- `FUNC_IMPORT_PREFIX` - Import function prefix\n- `MANGLED_CODE` / `MANGLED_DATA` / `MANGLED_UNKNOWN` - Mangled name types\n- Various ignore flags: `ignore_none`, `ignore_regvar`, `ignore_llabel`, `ignore_stkvar`, `ignore_glabel`\n\n## See Also\nFull docs: skill/docs/ida_name.rst\n","isInternal":false,"tokens":2206,"sizeBytes":7202},{"name":"ida_netnode.md","path":"skills/idapython/docs/ida_netnode.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_netnode.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_netnode\n\nLow-priority: Low-level database storage using B-tree structures. Most reverse engineering tasks use higher-level abstractions instead.\n\n## Key Classes/Functions\n\n### netnode\nPersistent storage object in IDA database. Each netnode has unique ID and may have name, value, and multiple sparse arrays.\n\n- `exist(name)` - check if named netnode exists\n- `create()` - create new netnode\n- `kill()` - delete netnode\n- `get_name()` - retrieve netnode name\n- `rename(newname)` - change netnode name\n- `altval(idx, tag)` - read 32-bit value from altvals array\n- `altset(idx, val, tag)` - write 32-bit value to altvals array\n- `supval(idx, tag)` - read arbitrary-sized object from supvals array\n- `supset(idx, value, tag)` - write arbitrary-sized object to supvals array\n- `hashval(key, tag)` - read value from hash by string key\n- `hashset(key, value, tag)` - write value to hash by string key\n- `getblob(start, tag)` - read large object spanning multiple indexes\n- `setblob(buf, start, tag)` - write large object\n\nArrays use tags to organize data: 'A' for altvals, 'S' for supvals, 'H' for hashvals.\n\n## See Also\nFull docs: skill/docs/ida_netnode.rst\n","isInternal":false,"tokens":310,"sizeBytes":1158},{"name":"ida_offset.md","path":"skills/idapython/docs/ida_offset.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_offset.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_offset\n\nMedium-priority: Convert operands to offset references and calculate target addresses. Useful when analyzing code that references data structures or global variables.\n\n## Key Functions\n\n- `op_offset_ex(ea, n, ri)` - convert operand to reference using refinfo_t\n- `op_offset(ea, n, ri)` - alias for op_offset_ex\n- `op_plain_offset(ea, n, base)` - convert operand to reference with default type\n- `get_offbase(ea, n)` - get offset base value for operand\n- `get_offset_expression(ea, n, from, offset, flags)` - format offset as \"name+displ\" string\n- `calc_offset_base(ea, n)` - calculate offset base from fixup/segment info\n- `calc_target(from, ea, n, opval)` - calculate target address from offset reference\n- `calc_basevalue(target, base)` - calculate reference base value\n- `can_be_off32(ea)` - check if address contains valid OFF32, return target or BADADDR\n\nOperand numbers may be ORed with OPND_OUTER for Motorola outer offsets.\n\n## See Also\nFull docs: skill/docs/ida_offset.rst\n","isInternal":false,"tokens":254,"sizeBytes":996},{"name":"ida_pro.md","path":"skills/idapython/docs/ida_pro.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_pro.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_pro\n\nMedium-priority: Core types, constants, and utility functions. Foundation module for platform detection and common operations.\n\n## Key Constants\n\n- `IDA_SDK_VERSION` - SDK version (9.2)\n- `MAXSTR` - maximum string size\n- `BADDIFF` - invalid diff value\n- `FMT_EA` / `FMT_64` / `FMT_Z` - format string macros\n- `CP_UTF8` / `CP_UTF16` - codepage constants\n- `ENC_UTF8` / `ENC_UTF16LE` / `ENC_WIN1252` - encoding constants\n\n## Key Vector Types\n\n- `intvec_t` / `uintvec_t` - int/uint vectors\n- `int64vec_t` / `uint64vec_t` - 64-bit int vectors\n- `boolvec_t` - boolean vector\n- `strvec_t` - string vector\n- `eavec_t` - ea_t vector\n- Standard methods: `push_back()`, `pop_back()`, `size()`, `at()`, `clear()`, `reserve()`, `find()`, `has()`, `add_unique()`\n\n## Key Functions\n\n- `qexit(code)` - shutdown IDA and exit\n- `extend_sign(v, nbytes, sign_extend)` - sign/zero extend value to 64 bits\n- `log2ceil(d64)` / `log2floor(d64)` - log2 calculations\n- `bitcountr_zero(x)` - count trailing zero bits\n- `is_main_thread()` - check if running on main thread\n- `get_physical_core_count()` / `get_logical_core_count()` - CPU core info\n\n## Platform Macros\n\nPreprocessor defines: `__NT__` (Windows), `__LINUX__`, `__MAC__`, `__EA64__` (64-bit addresses), `__X64__` / `__X86__`, `__ARM__`, `__PPC__`\n\n## See Also\nFull docs: skill/docs/ida_pro.rst\n","isInternal":false,"tokens":435,"sizeBytes":1341},{"name":"ida_problems.md","path":"skills/idapython/docs/ida_problems.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_problems.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_problems\n\nLow-priority: Manage problem lists for tracking analysis issues. IDA maintains these lists automatically; mainly used for debugging analysis failures.\n\n## Key Functions\n\n- `remember_problem(type, ea, msg)` - add address to problem list with optional message\n- `get_problem(type, lowea)` - get next problem address >= lowea\n- `forget_problem(type, ea)` - remove address from problem list\n- `is_problem_present(type, ea)` - check if address is in problem list\n- `get_problem_desc(type, ea)` - get human-readable problem description\n- `get_problem_name(type, longname)` - get problem list name\n\n## Problem List Types\n\n- `PR_DISASM` - can't disassemble\n- `PR_HEAD` - already head\n- `PR_ILLADDR` - execution flows beyond limits\n- `PR_BADSTACK` - failed to trace stack pointer\n- `PR_NOXREFS` - can't find references\n- `PR_NOBASE` - can't find offset base\n- `PR_ATTN` - attention, probably erroneous\n- `PR_FINAL` - IDA decision to convert to instruction/data\n- `PR_ROLLED` - IDA decision was wrong and rolled back\n- `PR_COLLISION` - FLAIR collision\n- `PR_DECIMP` - FLAIR match indecision\n\nView problems from View → Subviews → Problems menu.\n\n## See Also\nFull docs: skill/docs/ida_problems.rst\n","isInternal":false,"tokens":313,"sizeBytes":1206},{"name":"ida_range.md","path":"skills/idapython/docs/ida_range.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_range.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_range\n\nMedium-priority: Manage continuous address ranges and sets of ranges. Commonly used for working with functions, segments, and custom address groups.\n\n## Key Classes\n\n### range_t\nContinuous address range [start_ea, end_ea), end excluded.\n\n- `range_t(ea1, ea2)` - constructor\n- `start_ea` / `end_ea` - range boundaries (end_ea excluded)\n- `contains(ea)` / `contains(range)` - check if address/range is inside\n- `overlaps(range)` - check if ranges have common addresses\n- `size()` - return end_ea - start_ea\n- `empty()` - check if size <= 0\n- `intersect(range)` - set to intersection with another range\n- `extend(ea)` - extend range to include address\n- `clear()` - set both start_ea and end_ea to 0\n- `compare(range)` - compare based on start_ea\n\n### rangeset_t\nSet of non-overlapping ranges, stored sorted.\n\n- `add(range)` / `add(start, end)` / `add(rangeset)` - add range(s), merging overlaps\n- `sub(range)` / `sub(ea)` / `sub(rangeset)` - subtract range(s), splitting as needed\n- `contains(ea)` / `contains(rangeset)` - check membership\n- `includes(range)` - check if every ea in range is in set\n- `has_common(range)` / `has_common(rangeset)` - check overlap\n- `intersect(rangeset)` - set to intersection\n- `find_range(ea)` - get range containing ea, or nullptr\n- `nranges()` - number of ranges in set\n- `getrange(idx)` - get range by index\n- `next_addr(ea)` / `prev_addr(ea)` - navigate within ranges\n- `next_range(ea)` / `prev_range(ea)` - navigate between ranges\n- `is_equal(rangeset)` / `is_subset_of(rangeset)` - set comparisons\n- `clear()` / `empty()` - management\n\n### rangevec_t\nVector of range_t (standard vector methods).\n\n## Range Kind Constants\n\n- `RANGE_KIND_FUNC` - function ranges\n- `RANGE_KIND_SEGMENT` - segment ranges\n- `RANGE_KIND_HIDDEN_RANGE` - hidden ranges\n- `RANGE_KIND_UNKNOWN` - unknown type\n\n## See Also\nFull docs: skill/docs/ida_range.rst\n","isInternal":false,"tokens":529,"sizeBytes":1881},{"name":"ida_regfinder.md","path":"skills/idapython/docs/ida_regfinder.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_regfinder.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_regfinder\n\nHigh-priority: Track register values backwards through code execution. Critical for understanding function arguments, constants loaded into registers, and stack pointer calculations.\n\n## Key Functions\n\n- `find_reg_value(ea, reg)` - find constant value in register at address\n- `find_sp_value(ea, reg)` - find stack pointer delta at address\n- `find_reg_value_info(rvi, ea, reg, max_depth)` - find register value with detailed tracking info\n- `find_nearest_rvi(rvi, ea, regs)` - find value of either of two registers\n- `invalidate_regfinder_cache(from, to, cref)` - update cache after control flow change\n- `invalidate_regfinder_xrefs_cache(to, dref)` - update cache after data reference change\n\nReturns: 1 if value found, 0 if varying/insufficient depth, -1 if not supported.\n\n## Key Classes\n\n### reg_value_info_t\nDetailed register value tracking result.\n\n**State checks:**\n- `is_num()` / `is_spd()` - value is constant / stack-pointer-relative\n- `is_known()` - value is num or spd\n- `is_unknown()` - value could not be determined\n- `is_dead_end()` / `aborted()` - tracking stopped\n- `is_unkloop()` / `is_unkxref()` / `is_unkvals()` / `is_unkmult()` - specific failure reasons\n- `is_value_unique()` - single value vs multiple possibilities\n\n**Value extraction:**\n- `get_num()` - get constant value\n- `get_spd()` - get SP delta\n- `get_def_ea()` - where value was defined\n- `get_def_itype()` - instruction type that defined value\n\n**Arithmetic operations (all take insn parameter):**\n- `add(r, insn)` / `sub(r, insn)` - arithmetic\n- `bor(r, insn)` / `band(r, insn)` / `bxor(r, insn)` / `bandnot(r, insn)` - bitwise\n- `sll(r, insn)` / `slr(r, insn)` / `sar(r, insn)` - shifts\n- `neg(insn)` / `bnot(insn)` - unary\n- `add_num(r)` / `shift_left(r)` / `shift_right(r)` - without changing def_ea\n\n**Factory methods:**\n- `make_num(val, insn/ea, flags)` - create constant value\n- `make_initial_sp(func_ea)` - create initial stack pointer\n- `make_unkloop(ea)` / `make_unkmult(ea)` / etc - create failure states\n\n**Flags (for PC_BASED / LIKE_GOT annotations):**\n- `is_all_vals_pc_based()` / `is_any_vals_pc_based()`\n- `is_all_vals_like_got()` / `is_any_vals_like_got()`\n- `set_all_vals_pc_based()` / `set_all_vals_got_based()`\n\n### reg_value_def_t\nSingle value definition.\n\n- `val` - the value (uint64)\n- `def_ea` - instruction address where defined\n- `def_itype` - instruction code (processor-specific)\n- `flags` - SHORT_INSN, PC_BASED, LIKE_GOT\n- `is_short_insn()` / `is_pc_based()` / `is_like_got()` - flag checks\n- `dstr(how, pm)` - format as string (NOVAL/UVAL/SPVAL/ABORTED)\n\n## Configuration\n\nUses ida.cfg values: `REGTRACK_MAX_DEPTH`, `REGTRACK_FUNC_MAX_DEPTH` for search limits.\n\n## See Also\nFull docs: skill/docs/ida_regfinder.rst\n","isInternal":false,"tokens":781,"sizeBytes":2745},{"name":"ida_registry.md","path":"skills/idapython/docs/ida_registry.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_registry.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_registry\n\nRegistry-based persistent configuration storage (Windows registry or ~/.idapro/ida.reg on Unix).\n\n## Key Functions\n\n### Configuration Storage\n- `reg_read_string(name, subkey=None, _def=None)` - Read string value\n- `reg_write_string(name, utf8, subkey=None)` - Write string value\n- `reg_read_int(name, defval, subkey=None)` - Read integer value\n- `reg_write_int(name, value, subkey=None)` - Write integer value\n- `reg_read_bool(name, defval, subkey=None)` - Read boolean value\n- `reg_write_bool(name, value, subkey=None)` - Write boolean value\n- `reg_read_binary(name, subkey=None)` - Read binary data\n- `reg_write_binary(name, py_bytes, subkey=None)` - Write binary data\n\n### List Operations\n- `reg_read_strlist(subkey)` - Get all string values under key\n- `reg_write_strlist(items, subkey)` - Write list of strings\n- `reg_update_strlist(subkey, add, maxrecs, rem=None, ignorecase=False)` - Add/remove items with trimming\n- `reg_update_filestrlist(subkey, add, maxrecs, rem=None)` - Update file list (OS-specific case sensitivity)\n\n### Key/Value Management\n- `reg_exists(name, subkey=None)` - Check if value exists\n- `reg_subkey_exists(name)` - Check if key exists\n- `reg_delete(name, subkey=None)` - Delete value\n- `reg_delete_subkey(name)` - Delete key\n- `reg_delete_tree(name)` - Delete subtree recursively\n- `reg_subkey_subkeys(name)` - Get all subkey names\n- `reg_subkey_values(name)` - Get all value names\n- `reg_data_type(name, subkey=None)` - Get value type (reg_unknown/reg_sz/reg_binary/reg_dword)\n\n## Constants\n\n- `ROOT_KEY_NAME` - Default key for IDA settings\n- `reg_sz` - UTF-8 string type\n- `reg_binary` - Binary data type\n- `reg_dword` - 32-bit number type\n\n## See Also\nFull docs: skill/docs/ida_registry.rst\n","isInternal":false,"tokens":472,"sizeBytes":1740},{"name":"ida_search.md","path":"skills/idapython/docs/ida_search.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_search.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_search\n\nMiddle-level search functions for finding specific byte patterns, instructions, and code/data.\n\n## Key Functions\n\n### Search Functions\n- `find_unknown(ea, sflag)` - Find undefined bytes\n- `find_defined(ea, sflag)` - Find defined bytes (code/data)\n- `find_code(ea, sflag)` - Find code (instructions)\n- `find_data(ea, sflag)` - Find data items\n- `find_not_func(ea, sflag)` - Find bytes outside functions\n- `find_imm(ea, sflag, search_value)` - Find immediate value in instructions\n- `find_text(start_ea, y, x, ustr, sflag)` - Text search in disassembly/decompilation\n- `find_reg_access(out, start_ea, end_ea, regname, sflag)` - Find register read/write\n\n### Helper\n- `search_down(sflag)` - Check if SEARCH_DOWN bit is set\n\n## Search Flags\n\n### Direction\n- `SEARCH_UP` - Search towards lower addresses\n- `SEARCH_DOWN` - Search towards higher addresses\n- `SEARCH_NEXT` - Skip starting address\n\n### Options\n- `SEARCH_CASE` - Case-sensitive search\n- `SEARCH_REGEX` - Regular expressions (text search only)\n- `SEARCH_IDENT` - Search for identifier (bounded by non-visible chars)\n- `SEARCH_NOBRK` - Don't test for user cancellation\n- `SEARCH_NOSHOW` - Don't display progress\n- `SEARCH_BRK` - Return BADADDR if cancelled\n- `SEARCH_USESEL` - Limit search to UI selection\n\n### Register Access\n- `SEARCH_USE` - Find register reads\n- `SEARCH_DEF` - Find register writes\n\n## See Also\nFull docs: skill/docs/ida_search.rst\n","isInternal":false,"tokens":378,"sizeBytes":1421},{"name":"ida_segment.md","path":"skills/idapython/docs/ida_segment.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_segment.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_segment\n\nSegment management (memory regions with addressing modes, permissions, and types).\n\n## Key Classes\n\n### segment_t\nCore segment structure (inherits from range_t).\n\n**Address Range:**\n- `start_ea` - Start address (included)\n- `end_ea` - End address (excluded)\n\n**Addressing:**\n- `bitness` - 0=16-bit, 1=32-bit, 2=64-bit\n- `is_16bit()`, `is_32bit()`, `is_64bit()` - Check addressing mode\n- `abits()`, `abytes()` - Get address bits/bytes\n- `set_segm_addressing(s, bitness)` - Change addressing (deletes instructions/data)\n\n**Attributes:**\n- `sel` - Segment selector (must be unique)\n- `type` - Segment type (SEG_CODE/SEG_DATA/SEG_BSS/SEG_XTRN/etc)\n- `perm` - Permissions (SEGPERM_READ/WRITE/EXEC)\n- `align` - Alignment (saRelByte/saRelWord/saRelPara/etc)\n- `comb` - Combination (scPriv/scPub/scStack/scCommon)\n- `color` - Segment color\n- `defsr[16]` - Default segment register values\n\n**Methods:**\n- `update()` - Commit segment changes to database\n\n## Key Functions\n\n### Segment Lookup\n- `get_segm_qty()` - Get number of segments\n- `getseg(ea)` - Get segment containing address\n- `getnseg(n)` - Get segment by index (0..qty-1)\n- `get_segm_num(ea)` - Get segment index by address\n- `get_segm_by_name(name)` - Get segment by name\n- `get_segm_by_sel(selector)` - Get segment by selector\n- `get_first_seg()`, `get_last_seg()` - Get first/last segment\n- `get_next_seg(ea)`, `get_prev_seg(ea)` - Get adjacent segments\n\n### Creating/Deleting\n- `add_segm(para, start, end, name, sclass, flags=0)` - Add segment (allocates selector)\n- `add_segm_ex(s, name, sclass, flags)` - Add segment (selector pre-allocated)\n- `del_segm(ea, flags)` - Delete segment\n\n### Modifying Bounds\n- `set_segm_start(ea, newstart, flags)` - Change start (trims previous)\n- `set_segm_end(ea, newend, flags)` - Change end (trims next)\n- `move_segm_start(ea, newstart, mode)` - Change start (may expand previous)\n- `move_segm(s, to, flags=0)` - Move entire segment (fixes relocations)\n- `rebase_program(delta, flags)` - Rebase all segments\n\n### Properties\n- `get_segm_name(s, flags=0)` - Get name\n- `set_segm_name(s, name, flags=0)` - Set name\n- `get_segm_class(s)`, `set_segm_class(s, sclass, flags=0)` - Get/set class\n- `get_segment_cmt(s, repeatable)`, `set_segment_cmt(s, cmt, repeatable)` - Get/set comment\n- `segtype(ea)` - Get segment type at address\n- `get_segm_base(s)` - Get base linear address\n- `get_segm_para(s)` - Get base paragraph\n- `set_segm_base(s, newbase)` - Set base (internal)\n\n### Selectors\n- `setup_selector(segbase)` - Allocate selector if needed\n- `allocate_selector(segbase)` - Unconditionally allocate selector\n- `find_free_selector()` - Find unused selector (>=1)\n- `set_selector(selector, paragraph)` - Map selector to paragraph\n- `del_selector(selector)` - Delete selector mapping\n- `sel2para(selector)`, `sel2ea(selector)` - Get selector mapping\n- `find_selector(base)` - Find selector by paragraph\n\n### Visibility/Locking\n- `is_visible_segm(s)`, `set_visible_segm(s, visible)` - Hide/show segment\n- `is_spec_segm(seg_type)`, `is_spec_ea(ea)` - Check special types\n- `lock_segm(segm, lock)`, `is_segm_locked(segm)` - Lock pointer (prevents deletion/move)\n\n### Debugger Integration\n- `change_segment_status(s, is_deb_segm)` - Convert debugger/regular segment\n- `take_memory_snapshot(type)` - Snapshot running process (SNAP_ALL_SEG/SNAP_LOAD_SEG/SNAP_CUR_SEG)\n- `is_miniidb()` - Check if IDB is debugger-created\n\n### Segment Groups (OMF)\n- `set_group_selector(grp, sel)` - Create segment group\n- `get_group_selector(grpsel)` - Get group's common selector\n\n### Segment Translations\n- `add_segment_translation(segstart, mappedseg)` - Add overlay mapping\n- `del_segment_translations(segstart)` - Delete translation list\n- `get_segment_translations(transmap, segstart)` - Get translation list\n- `set_segment_translations(segstart, transmap)` - Set translation list\n\n## Segment Types\n\n- `SEG_NORM` - Normal segment (no assumptions)\n- `SEG_CODE` - Code segment\n- `SEG_DATA` - Data segment\n- `SEG_BSS` - Uninitialized data\n- `SEG_XTRN` - External definitions (no instructions)\n- `SEG_GRP` - Segment group\n- `SEG_NULL` - Zero-length segment\n- `SEG_ABSSYM` - Absolute symbols\n- `SEG_COMM` - Communal definitions\n- `SEG_IMEM` - Internal processor memory/SFRs\n\n## Add Segment Flags\n\n- `ADDSEG_NOSREG` - Set default sregs to BADSEL\n- `ADDSEG_OR_DIE` - qexit() on failure\n- `ADDSEG_NOTRUNC` - Destroy/truncate old segments instead\n- `ADDSEG_QUIET` - Silent mode\n- `ADDSEG_FILLGAP` - Fill gap with previous segment\n- `ADDSEG_SPARSE` - Use sparse storage\n- `ADDSEG_NOAA` - Don't mark for auto-analysis\n- `ADDSEG_IDBENC` - Name/class in IDB encoding\n\n## Segment Modification Flags\n\n- `SEGMOD_KILL` - Disable addresses when shrinking\n- `SEGMOD_KEEP` - Keep code/data\n- `SEGMOD_SILENT` - Silent mode\n- `SEGMOD_KEEPSEL` - Don't delete unused selector\n- `SEGMOD_NOMOVE` - Don't move info when changing start\n- `SEGMOD_SPARSE` - Use sparse storage when extending\n\n## See Also\nFull docs: skill/docs/ida_segment.rst\n","isInternal":false,"tokens":1457,"sizeBytes":4998},{"name":"ida_segregs.md","path":"skills/idapython/docs/ida_segregs.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_segregs.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_segregs\n\nSegment register management for architectures with segmented memory (x86/x86-64).\n\n## Key Classes\n\n### sreg_range_t\nSegment register value range (inherits from range_t).\n- `val` - Segment register value (sel_t)\n- `tag` - Range tag (SR_inherit/SR_user/SR_auto/SR_autostart)\n\n## Key Functions\n\n### Reading Values\n- `get_sreg(ea, rg)` - Get segment register value at address (uses ranges + segment defaults)\n\n### Setting Values\n- `split_sreg_range(ea, rg, v, tag, silent=False)` - Create new range at address\n- `set_default_sreg_value(sg, rg, value)` - Set default for segment (or all segments if sg=None)\n- `set_default_dataseg(ds_sel)` - Set DS default for all segments\n- `set_sreg_at_next_code(ea1, ea2, rg, value)` - Set value at next instruction only\n\n### Range Queries\n- `get_sreg_range(out, ea, rg)` - Get range containing address\n- `get_prev_sreg_range(out, ea, rg)` - Get previous range\n- `get_sreg_ranges_qty(rg)` - Get number of ranges\n- `getn_sreg_range(out, rg, n)` - Get range by index\n- `get_sreg_range_num(ea, rg)` - Get range index by address\n\n### Range Management\n- `del_sreg_range(ea, rg)` - Delete range (extends previous, can't delete segment start)\n- `copy_sreg_ranges(dst_rg, src_rg, map_selector=False)` - Duplicate ranges\n\n## Segment Register Constants\n\n### x86/x86-64 Registers\n- `R_es` - Extra segment\n- `R_cs` - Code segment\n- `R_ss` - Stack segment\n- `R_ds` - Data segment\n- `R_fs` - FS segment\n- `R_gs` - GS segment\n\n### Range Tags\n- `SR_inherit` - Value inherited from previous range\n- `SR_user` - User-specified value\n- `SR_auto` - IDA-determined value\n- `SR_autostart` - Used as SR_auto at segment start\n\n## Usage Notes\n\nFor non-segmented architectures, define two virtual segment registers (CS/DS) and set processor_t::reg_code_sreg and processor_t::reg_data_sreg.\n\n## See Also\nFull docs: skill/docs/ida_segregs.rst\n","isInternal":false,"tokens":533,"sizeBytes":1862},{"name":"ida_srclang.md","path":"skills/idapython/docs/ida_srclang.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_srclang.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_srclang\n\nThird-party compiler support for parsing type declarations from C/C++/Objective-C source.\n\n## Key Functions\n\n### Parser Selection\n- `select_parser_by_name(name)` - Set parser by name (None/\"\" for default)\n- `select_parser_by_srclang(lang)` - Set parser supporting language(s)\n- `get_selected_parser_name()` - Get current parser name\n\n### Type Declaration Parsing\n- `parse_decls_for_srclang(lang, til, input, is_path)` - Parse with language auto-detection\n- `parse_decls_with_parser(parser_name, til, input, is_path)` - Parse with specific parser\n- `parse_decls_with_parser_ext(parser_name, til, input, hti_flags)` - Parse with formatting flags\n\n**Parameters:**\n- `lang/parser_name` - Source language or parser name\n- `til` - Type library to store parsed types\n- `input` - File path or declaration string\n- `is_path` - True if input is path, False if in-memory snippet\n\n**Returns:**\n- -1: No parser found\n- -2: Operation not supported (set_parser_argv)\n- >=0: Number of parse errors\n\n### Parser Configuration\n- `set_parser_argv(parser_name, argv)` - Set command-line arguments\n- `get_parser_option(parser_name, option_name)` - Get parser option\n- `set_parser_option(parser_name, option_name, option_value)` - Set parser option\n\n## Source Languages\n\n- `SRCLANG_C` - C\n- `SRCLANG_CPP` - C++\n- `SRCLANG_OBJC` - Objective-C\n- `SRCLANG_SWIFT` - Swift (not supported yet)\n- `SRCLANG_GO` - Golang (not supported yet)\n\n## See Also\nFull docs: skill/docs/ida_srclang.rst\n","isInternal":false,"tokens":385,"sizeBytes":1475},{"name":"ida_strlist.md","path":"skills/idapython/docs/ida_strlist.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_strlist.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_strlist\n\nString list management (cached view of all strings in the database).\n\n## Key Classes\n\n### string_info_t\nString list entry.\n- `ea` - String address\n- `length` - String length\n- `type` - String type\n\n### strwinsetup_t\nString list configuration.\n- `minlen` - Minimum string length\n- `display_only_existing_strings` - Only show defined strings\n- `only_7bit` - ASCII-only strings\n- `ignore_heads` - Include strings at non-head addresses\n- `strtypes` - Enabled string types\n\n## Key Functions\n\n- `build_strlist()` - Rebuild string list (expensive, call when needed)\n- `clear_strlist()` - Clear string list\n- `get_strlist_qty()` - Get number of strings (loads from DB or builds)\n- `get_strlist_item(si, n)` - Get nth string (0..qty-1)\n- `get_strlist_options()` - Get static configuration\n\n## Usage Notes\n\nThe kernel does NOT auto-update the string list (performance). Users must call build_strlist() for up-to-date results. If not cleared, the list persists in the database across sessions.\n\n## See Also\nFull docs: skill/docs/ida_strlist.rst\n","isInternal":false,"tokens":268,"sizeBytes":1049},{"name":"ida_tryblks.md","path":"skills/idapython/docs/ida_tryblks.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_tryblks.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_tryblks\n\nException handling (try/catch/SEH) information for binary code analysis.\n\n## Key Classes\n\n### tryblk_t\nRepresents an exception try block with associated catch/finally handlers.\n- `get_kind()` - Check if SEH or C++ try block\n- `is_seh()` / `is_cpp()` - Identify exception handling type\n- `seh()` - Get SEH handler info (filter + landing pad)\n- `cpp()` - Get C++ catch handlers vector\n- `level` - Nesting level (auto-calculated)\n\n### catch_t / seh_t\nHandler information for C++ catch blocks and SEH (Structured Exception Handling).\n- `obj` - Exception object offset (C++)\n- `type_id` - Caught exception type ID\n- `filter` - SEH filter function range\n- `seh_code` - SEH exception code address\n\n## Key Functions\n\n### get_tryblks(tbv, range)\nRetrieve all try blocks in address range, sorted and with nesting calculated.\n\n### add_tryblk(tb)\nAdd try block information. Returns error code (TBERR_OK = success).\n\n### del_tryblks(range)\nDelete all try block information in range.\n\n### find_syseh(ea)\nFind start address of system exception handler region containing address.\n\n### is_ea_tryblks(ea, flags)\nCheck if address is part of try/catch/filter (use TBEA_TRY, TBEA_CATCH, TBEA_SEHTRY, etc flags).\n\n## Error Codes\n\n- `TBERR_OK` - Success\n- `TBERR_START/END/ORDER` - Invalid address bounds\n- `TBERR_INTERSECT` - Try block would intersect inner block\n- `TBERR_NO_CATCHES` - No catch handlers defined\n\n## See Also\nFull docs: skill/docs/ida_tryblks.rst\n","isInternal":false,"tokens":392,"sizeBytes":1457},{"name":"ida_typeinf.md","path":"skills/idapython/docs/ida_typeinf.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_typeinf.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_typeinf\n\nType information manipulation in IDA - the foundation for working with structures, enums, function prototypes, and all type data.\n\n## Core Concepts\n\n**tinfo_t** objects represent types. They can be:\n- **Detached**: Created without a type library, temporary\n- **Attached**: Stored in a til_t (type info library), persistent\n\n**Key terms**:\n- **udt**: User-defined type (struct/union, not enum)\n- **udm**: UDT member (struct/union field)\n- **edm**: Enum member (enumerator)\n- **til_t**: Type info library (serialized type storage)\n\n## Essential Classes\n\n### tinfo_t\nThe fundamental type representation object.\n\n#### Creation\n- `tinfo_t()` - Empty type\n- `tinfo_t(BT_INT)` - Simple type from base type\n- `tinfo_t(\"const char **\")` - Parse C declaration\n- `get_named_type(til, \"struct_name\")` - Load from library\n- `create_func(func_type_data_t)` - Build function prototype\n- `create_ptr(target_type)` - Build pointer type\n\n#### Inspection\n- `get_size()` - Type size in bytes\n- `is_ptr()` / `is_func()` / `is_struct()` / `is_array()` - Type checks\n- `is_const()` / `is_volatile()` - Qualifier checks\n- `get_pointed_object()` - Dereference pointer\n- `get_realtype()` - Resolve typedefs\n- `print_tinfo(prefix, indent, flags)` - Format as C code\n\n#### Decomposition\n- `get_func_details(ftd)` - Extract function prototype to func_type_data_t\n- `get_udt_details(udt)` - Extract struct/union to udt_type_data_t\n- `get_enum_details(etd)` - Extract enum to enum_type_data_t\n- `get_array_details(arr)` - Extract array to array_type_data_t\n- `get_ptr_details(ptr)` - Extract pointer to ptr_type_data_t\n\n#### Modification\n- `create_typedef(til, name)` - Create typedef alias\n- `add_udm(name, type_str)` - Add field to attached struct\n- `set_numbered_type(til, ordinal, flags, name)` - Store in library\n\n### func_type_data_t\nFunction prototype representation (return type + arguments).\n- `rettype` - tinfo_t of return value\n- `[i]` / `size()` - Access funcarg_t arguments by index\n- `push_back(funcarg)` - Add parameter\n- `cc` - Calling convention (CM_CC_CDECL, CM_CC_STDCALL, etc)\n- `flags` - Function attributes (FTI_NORET, FTI_PURE, FTI_VIRTUAL, etc)\n\n### funcarg_t\nFunction parameter representation.\n- `name` - Parameter name\n- `type` - tinfo_t of parameter type\n- `argloc` - Physical location (register/stack)\n\n### udt_type_data_t\nStruct/union field collection (vector of udm_t).\n- `[i]` / `size()` - Access udm_t members by index\n- `push_back(udm)` - Add field\n- `find_member(name)` - Locate field by name\n- `get_best_fit_member(offset)` - Find field at offset\n- `total_size` - Struct size in bytes\n- `is_union` - True if union, false if struct\n- `taudt_bits` - Alignment flags\n\n### udm_t\nSingle struct/union field.\n- `name` - Field name\n- `type` - tinfo_t of field type\n- `offset` - Byte offset (0 for unions)\n- `size` - Field size in bytes\n- `cmt` / `rptcmt` - Comments\n\n### enum_type_data_t\nEnumeration representation (vector of edm_t).\n- `[i]` / `size()` - Access edm_t members by index\n- `push_back(edm)` - Add enumerator\n- `bte` - Storage size flags\n- `taenum_bits` - Display format (hex/dec/oct/bin)\n\n### edm_t\nSingle enum member.\n- `name` - Enumerator name\n- `value` - Numeric value\n\n### til_t\nType info library (persistent storage).\n- `get_named_type(name)` - Load type by name\n- `get_numbered_type(ordinal)` - Load type by ordinal number\n- `import_type(src)` - Import type from another til\n- `named_types()` / `numbered_types()` - Iterate all types\n- `cc` - Compiler info (calling conventions, sizes)\n\n## Key Functions\n\n### Type Library Management\n\n#### get_idati()\nGet the local type library (IDB's \"Local Types\").\n\n#### add_til(name, flags)\nAdd base type library (e.g., \"mssdk64_win7\" for Windows types).\n\n#### load_til(name, tildir)\nLoad til file without adding to IDB.\n\n### Type Application\n\n#### apply_tinfo(ea, tinfo, flags)\nApply type to address (function/data). Flags: TINFO_DEFINITE (override), TINFO_GUESSED (suggestion).\n\n#### apply_cdecl(til, ea, decl)\nParse C declaration and apply to address.\n\n#### guess_tinfo(ea)\nAuto-analyze and infer type at address.\n\n### Type Creation\n\n#### parse_decl(til, decl, flags)\nParse C declaration string into tinfo_t. Returns (tinfo, name) tuple.\n\n#### create_typedef(til, name)\nCreate typedef for existing type.\n\n### Type Queries\n\n#### get_tinfo(ea)\nRetrieve type applied to address.\n\n#### print_type(ea, flags)\nFormat type as C declaration string.\n\n#### get_named_type(til, name)\nLoad type from library by name.\n\n### Type Comparison\n\n#### compare_tinfo(t1, t2, flags)\nCheck type compatibility. Flags: TCMP_EQUAL (exact), TCMP_MANCAST (manual cast allowed), etc.\n\n## Base Type Constants\n\n### Integers\n- `BT_INT8` / `BT_INT16` / `BT_INT32` / `BT_INT64` / `BT_INT128`\n- Combined with: `BTMT_SIGNED`, `BTMT_UNSIGNED`, `BTMT_CHAR`\n- Shortcuts: `BTF_INT8`, `BTF_UINT8`, `BTF_CHAR`, `BTF_UCHAR`, etc.\n\n### Floating Point\n- `BT_FLOAT` - 4/8/10 byte float (use with BTMT_FLOAT/DOUBLE/LNGDBL)\n- Shortcuts: `BTF_FLOAT`, `BTF_DOUBLE`, `BTF_LDOUBLE`, `BTF_TBYTE`\n\n### Complex Types\n- `BT_PTR` - Pointer (use with BTMT_NEAR/FAR/CLOSURE)\n- `BT_ARRAY` - Array\n- `BT_FUNC` - Function\n- `BT_COMPLEX` - Struct/union/enum/typedef (use with BTMT_STRUCT/UNION/ENUM/TYPEDEF)\n- `BT_BITFIELD` - Bitfield (struct member only)\n\n### Special\n- `BT_VOID` - void type\n- `BT_BOOL` - bool type\n- `BT_UNK` - Unknown type\n\n## Type Modifiers\n\n- `BTM_CONST` - const qualifier\n- `BTM_VOLATILE` - volatile qualifier\n\n## Calling Conventions\n\n- `CM_CC_INVALID` / `CM_CC_UNKNOWN`\n- `CM_CC_CDECL` - C declaration (caller cleans stack)\n- `CM_CC_STDCALL` - Standard call (callee cleans)\n- `CM_CC_FASTCALL` - Fast call (register args)\n- `CM_CC_THISCALL` - C++ member (ecx/rcx = this)\n- `CM_CC_PASCAL` - Pascal (right-to-left)\n- `CM_CC_SWIFT` - Swift ABI\n- `CM_CC_GOLANG` - Go ABI\n\n## Flags\n\n### Type Application (apply_tinfo)\n- `TINFO_GUESSED` - Suggested type (user can override)\n- `TINFO_DEFINITE` - Force type (overwrite existing)\n- `TINFO_DELAYFUNC` - Delay function analysis\n\n### Parsing (parse_decl)\n- `PT_SIL` - Silent (no error messages)\n- `PT_TYP` - Parse type only (no name)\n- `PT_VAR` - Parse variable (type + name)\n- `PT_REPLACE` - Replace existing type\n\n### Printing (print_tinfo)\n- `PRTYPE_1LINE` - Single line output\n- `PRTYPE_MULTI` - Multiple lines\n- `PRTYPE_TYPE` - Type only (no name)\n- `PRTYPE_DEF` - Include typedef keyword\n\n## Common Patterns\n\n### Create Function Prototype\n```python\n# int func(const char *str, int count)\nftd = ida_typeinf.func_type_data_t()\nftd.rettype = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\n\narg1 = ida_typeinf.funcarg_t()\narg1.name = \"str\"\narg1.type = ida_typeinf.tinfo_t(\"const char *\")\nftd.push_back(arg1)\n\narg2 = ida_typeinf.funcarg_t()\narg2.name = \"count\"\narg2.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\nftd.push_back(arg2)\n\ntif = ida_typeinf.tinfo_t()\ntif.create_func(ftd)\nida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)\n```\n\n### Create Structure\n```python\nudt = ida_typeinf.udt_type_data_t()\nudt.is_union = False\n\n# Add field: int x\nm1 = ida_typeinf.udm_t()\nm1.name = \"x\"\nm1.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)\nm1.offset = 0\nm1.size = 4\nudt.push_back(m1)\n\ntif = ida_typeinf.tinfo_t()\ntif.create_udt(udt, ida_typeinf.BTF_STRUCT)\ntif.set_numbered_type(ida_typeinf.get_idati(), 0,\n    ida_typeinf.NTF_REPLACE, \"MyStruct\")\n```\n\n### Inspect Function Type\n```python\ntif = ida_typeinf.tinfo_t()\nif ida_typeinf.get_tinfo(tif, ea):\n    if tif.is_func():\n        ftd = ida_typeinf.func_type_data_t()\n        tif.get_func_details(ftd)\n        print(f\"Return: {ftd.rettype}\")\n        for i in range(ftd.size()):\n            arg = ftd[i]\n            print(f\"Arg {i}: {arg.name} : {arg.type}\")\n```\n\n## See Also\nFull docs: skill/docs/ida_typeinf.rst\nIDA Domain API: https://ida-domain.docs.hex-rays.com/ (simplified type operations)\n","isInternal":false,"tokens":2302,"sizeBytes":7824},{"name":"ida_ua.md","path":"skills/idapython/docs/ida_ua.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_ua.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_ua\n\nInstruction disassembly, operand decoding, and instruction analysis.\n\n## Key Classes\n\n### insn_t\nDecoded instruction with full operand details.\n- Access via: `idaapi.insn_t()` or `idautils.DecodeInstruction(ea)`\n- Contains array of up to 8 `op_t` operands\n\n### op_t\nSingle instruction operand representation.\n- `type` - Operand type (o_reg, o_mem, o_imm, o_displ, etc)\n- `dtype` - Data type (dt_byte, dt_word, dt_dword, dt_qword, etc)\n- `reg` - Register number (for o_reg)\n- `addr` - Memory address (for o_mem, o_displ, o_near, o_far)\n- `value` - Immediate value (for o_imm) or displacement\n- `phrase` - Register phrase number (for o_phrase, o_displ)\n- `shown()` - Check if operand should be displayed\n- `is_reg(r)` / `is_imm(v)` - Type checks\n\n## Operand Types\n\n- `o_void` - No operand\n- `o_reg` - Register (al, rax, xmm0, etc)\n- `o_mem` - Direct memory `[0x401000]`\n- `o_phrase` - Register indirect `[rax]`, `[rsi+rdi*4]`\n- `o_displ` - Register + displacement `[rbp+var_10]`\n- `o_imm` - Immediate constant `42`, `0x1000`\n- `o_near` / `o_far` - Code reference (branch/call target)\n- `o_idpspec0-5` - Processor-specific types\n\n## Data Types (dtype)\n\n- `dt_byte` (8), `dt_word` (16), `dt_dword` (32), `dt_qword` (64)\n- `dt_byte16` (128), `dt_byte32` (256), `dt_byte64` (512)\n- `dt_float`, `dt_double`, `dt_ldbl`, `dt_tbyte`\n\n## Key Functions\n\n### create_insn(ea)\nAnalyze and create instruction at address (updates IDB).\n\n### decode_insn(insn, ea)\nDecode instruction into insn_t object (read-only, no IDB changes).\n\n### decode_prev_insn(insn, ea)\nDecode instruction before given address.\n\n### print_insn_mnem(ea)\nGet instruction mnemonic string.\n\n### print_operand(ea, n)\nGet operand text representation (operand index n).\n\n### get_dtype_size(dtype)\nGet size in bytes for data type.\n\n### get_dtype_by_size(size)\nGet appropriate dtype for byte size.\n\n## Usage Pattern\n\n```python\ninsn = idaapi.insn_t()\nif idaapi.decode_insn(insn, ea) > 0:\n    for op in insn.ops:\n        if op.type == idaapi.o_void:\n            break  # No more operands\n        if op.type == idaapi.o_reg:\n            print(f\"Register: {op.reg}\")\n        elif op.type == idaapi.o_imm:\n            print(f\"Immediate: {op.value:#x}\")\n```\n\n## See Also\nFull docs: skill/docs/ida_ua.rst\n","isInternal":false,"tokens":674,"sizeBytes":2257},{"name":"ida_undo.md","path":"skills/idapython/docs/ida_undo.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_undo.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_undo\n\nDatabase undo/redo operations for IDA changes.\n\n## Key Functions\n\n### create_undo_point(bytes, size)\nCreate restore point. User can undo to this point later. Returns False if undo disabled.\n\n### perform_undo()\nUndo last action. Returns True on success.\n\n### perform_redo()\nRedo previously undone action. Returns True on success.\n\n### get_undo_action_label()\nGet description of action that will be undone (for UI display).\n\n### get_redo_action_label()\nGet description of action that will be redone (for UI display).\n\n## Usage\n\nRarely needed in plugins - IDA automatically creates undo points for most operations. Use `create_undo_point()` only for custom atomic operations requiring explicit undo boundaries.\n\n## See Also\nFull docs: skill/docs/ida_undo.rst\n","isInternal":false,"tokens":164,"sizeBytes":768},{"name":"ida_xref.md","path":"skills/idapython/docs/ida_xref.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/ida_xref.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# ida_xref\n\nCross-reference (xref) tracking between code and data locations.\n\n## Key Classes\n\n### xrefblk_t\nIterator for traversing cross-references efficiently.\n- `first_from(ea, flags)` / `next_from()` - Iterate xrefs FROM address\n- `first_to(ea, flags)` / `next_to()` - Iterate xrefs TO address\n- `frm` / `to` - Source and target addresses\n- `type` - Reference type (cref_t or dref_t)\n- `iscode` - True if code reference, false if data\n- `user` - User-defined (won't be deleted by IDA)\n\nIterator helpers:\n- `crefs_from(ea)` / `crefs_to(ea)` - Code references including flow\n- `fcrefs_from(ea)` / `fcrefs_to(ea)` - Code references (no flow)\n- `drefs_from(ea)` / `drefs_to(ea)` - Data references\n\n## Key Functions\n\n### add_cref(frm, to, type) / add_dref(frm, to, type)\nCreate code or data cross-reference.\n\n### del_cref(frm, to, expand) / del_dref(frm, to)\nDelete cross-reference (expand=1 deletes target if no more refs).\n\n### get_first_cref_from(frm) / get_next_cref_from(frm, current)\nLegacy API for iterating code xrefs FROM address.\n\n### get_first_dref_to(to) / get_next_dref_to(to, current)\nLegacy API for iterating data xrefs TO address.\n\n### has_external_refs(pfn, ea)\nCheck if address has references from outside function.\n\n### create_switch_xrefs(ea, si)\nGenerate xrefs for switch jump table.\n\n## Reference Types\n\n### Code (cref_t)\n- `fl_CF` / `fl_CN` - Call Far/Near (creates function)\n- `fl_JF` / `fl_JN` - Jump Far/Near\n- `fl_F` - Ordinary flow to next instruction\n\n### Data (dref_t)\n- `dr_R` / `dr_W` - Read/Write access\n- `dr_O` - Offset reference\n- `dr_T` - Text reference (forced operand)\n\n## Flags\n\n- `XREF_USER` - User-defined (persistent)\n- `XREF_TAIL` - Reference to tail byte\n- `XREF_PASTEND` - Preserve alignment directives\n- `XREF_CODE` / `XREF_DATA` - Filter by type\n- `XREF_FLOW` / `XREF_NOFLOW` - Include/skip ordinary flow\n\n## See Also\nFull docs: skill/docs/ida_xref.rst\n","isInternal":false,"tokens":570,"sizeBytes":1900},{"name":"idaapi.md","path":"skills/idapython/docs/idaapi.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/idaapi.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# idaapi\n\nLow-level module exposing global C variables via `cvar` attribute.\n\n## Key Attributes\n\n### cvar\nGlobal variable container - provides access to IDA's C-level global variables (e.g., `idaapi.cvar.inf` for binary info, `idaapi.cvar.database_flags` for IDB state).\n\n## See Also\nFull docs: skill/docs/idaapi.rst\n","isInternal":false,"tokens":84,"sizeBytes":317},{"name":"idadex.md","path":"skills/idapython/docs/idadex.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/idadex.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# idadex\n\nDEX (Dalvik Executable) file parsing utilities for Android reverse engineering.\n\n## Key Classes\n\n### Dex\nPrimary DEX file parser exposing methods/fields/strings/types from Android binaries.\n\n**String Operations**:\n- `get_string(from_ea, string_idx)` - retrieve string by index\n- `as_string(s)` - convert DEX string to Python string\n\n**Method Operations**:\n- `get_method(from_ea, method_idx)` - retrieve method by index\n- `get_method_name(from_ea, method_idx)` - get method name\n- `get_short_method_name(method)` - short form (e.g., `onCreate`)\n- `get_full_method_name(method)` - fully qualified (e.g., `android.app.Activity.onCreate`)\n- `get_call_method_name(method)` - name for call sites\n\n**Type Operations**:\n- `get_type_string(from_ea, type_idx)` - get type descriptor\n- `decorate_java_typename(desc)` - convert type descriptor to Java notation\n- `is_wide_type(typechar)` - check if type is 64-bit\n\n**Field Operations**:\n- `get_field(from_ea, field_idx)` - retrieve field by index\n- `get_field_name(from_ea, field_idx)` - get field name\n- `get_full_field_name(field_idx, field, field_name)` - fully qualified field name\n\n**Utility**:\n- `access_string(flags)` - convert access flags to string (public/private/etc)\n- `idx_to_ea(from_ea, idx, tag)` - convert DEX index to IDA address\n\n### dex_method\n`ctypes.LittleEndianStructure` representing DEX method metadata.\n- `IS_LOCAL = 1` - flag for local method\n- `HAS_CODE = 2` - flag indicating method has code\n- `is_local()` - check if method is local\n\n### dex_field\n`ctypes.LittleEndianStructure` representing DEX field metadata.\n\n## Key Functions\n\n- `to_uint32(v)` - convert to unsigned 32-bit int\n- `unpack_db(buf, off)` - unpack byte from buffer\n- `unpack_dw(buf, off)` - unpack word from buffer\n- `unpack_dd(buf, off)` - unpack dword from buffer\n- `unpack_dq(buf, off)` - unpack qword from buffer\n- `unpack_ea(buf, off)` - unpack effective address from buffer\n\n## Global Object\n\n### dex\nGlobal `Dex` instance - use this to access DEX parsing functions.\n\n## See Also\nFull docs: skill/docs/idadex.rst\n","isInternal":false,"tokens":542,"sizeBytes":2062},{"name":"idautils.md","path":"skills/idapython/docs/idautils.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/idautils.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Fidautils.md -->","isInternal":false,"tokens":856,"sizeBytes":3227},{"name":"idc.md","path":"skills/idapython/docs/idc.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/idc.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Fidc.md -->","isInternal":false,"tokens":3323,"sizeBytes":11096},{"name":"init.md","path":"skills/idapython/docs/init.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/docs/init.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2Fdocs%2Finit.md -->","isInternal":false,"tokens":197,"sizeBytes":752},{"name":"SKILL.md","path":"skills/idapython/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/skills/idapython/SKILL.md","title":"idapython","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=skills%2Fidapython%2FSKILL.md -->","frontmatter":{"name":"idapython","description":"IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns."},"isInternal":false,"tokens":1546,"sizeBytes":5007},{"name":"plugin.json","path":".claude-plugin/plugin.json","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/.claude-plugin/plugin.json","title":"ida-pro-mcp","category":"plugin-manifest","format":"json","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.claude-plugin%2Fplugin.json -->","frontmatter":{"name":"ida-pro-mcp","version":"0.1.0","description":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","mcpServers":{"idalib":{"command":"uv","args":["run","--project","${CLAUDE_PLUGIN_ROOT}","idalib-mcp","--stdio"]}}},"isInternal":false,"tokens":102,"sizeBytes":367},{"name":"plugin.json","path":".codex-plugin/plugin.json","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/.codex-plugin/plugin.json","title":"ida-pro-mcp","category":"plugin-manifest","format":"json","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.codex-plugin%2Fplugin.json -->","frontmatter":{"name":"ida-pro-mcp","version":"0.1.0","description":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","author":{"name":"mrexodia","url":"https://github.com/mrexodia/ida-pro-mcp"},"homepage":"https://github.com/mrexodia/ida-pro-mcp","repository":"https://github.com/mrexodia/ida-pro-mcp.git","license":"MIT","keywords":["ida","ida-pro","reverse-engineering","mcp"],"interface":{"displayName":"IDA Pro MCP","shortDescription":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","longDescription":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","developerName":"mrexodia","category":"Developer Tools","capabilities":["Interactive","MCP"],"websiteURL":"https://github.com/mrexodia/ida-pro-mcp"},"mcpServers":"./.codex-plugin/mcp.json"},"isInternal":false,"tokens":277,"sizeBytes":1021},{"name":"plugin.json","path":".kimi-plugin/plugin.json","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/.kimi-plugin/plugin.json","title":"ida-pro-mcp","category":"plugin-manifest","format":"json","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=.kimi-plugin%2Fplugin.json -->","frontmatter":{"name":"ida-pro-mcp","version":"0.1.0","description":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","author":{"name":"mrexodia","url":"https://github.com/mrexodia/ida-pro-mcp"},"homepage":"https://github.com/mrexodia/ida-pro-mcp","license":"MIT","keywords":["ida","ida-pro","reverse-engineering","mcp"],"interface":{"displayName":"IDA Pro MCP","shortDescription":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","longDescription":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","developerName":"mrexodia","websiteURL":"https://github.com/mrexodia/ida-pro-mcp"},"skills":"./skills/","mcpServers":{"idalib":{"command":"uv","args":["run","idalib-mcp","--stdio"],"cwd":"./"}}},"isInternal":false,"tokens":278,"sizeBytes":1008},{"name":"ida-plugin.json","path":"ida-plugin.json","rawUrl":"https://raw.githubusercontent.com/mrexodia/ida-pro-mcp/HEAD/ida-plugin.json","title":"Plugin Plugin Manifest","category":"plugin-manifest","format":"json","content":"<!-- Skill available on-demand via /api/skills/mrexodia/ida-pro-mcp?path=ida-plugin.json -->","frontmatter":{"IDAMetadataDescriptorVersion":1,"plugin":{"name":"IDA Pro MCP","entryPoint":"src/ida_pro_mcp/ida_mcp.py","categories":["api-scripting-and-automation","debugging-and-tracing","malware-analysis"],"logoPath":".github/logo.png","description":"AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.","idaVersions":">=8.3","version":"2.0.0"}},"isInternal":false,"tokens":124,"sizeBytes":446}],"systemPromptSnippet":"<yakaai_skills repo=\"mrexodia/ida-pro-mcp\">\n<!-- File: CLAUDE.md (Tokens: ~1149 | Category: claude-rule) -->\n# CLAUDE.md\n\nGuidance for working in this repository.\n\n## What this project is\n\nIDA Pro MCP Server: exposes IDA Pro / idalib functionality to MCP clients.\n\nMain pieces:\n- `src/ida_pro_mcp/server.py`: MCP server entrypoint\n- `src/ida_pro_mcp/idalib_server.py`: headless idalib server\n- `src/ida_pro_mcp/ida_mcp/`: IDA/plugin-side APIs\n\nImportant API modules:\n- `api_core.py`: IDB metadata, functions, strings, imports\n- `api_analysis.py`: decompilation, disassembly, xrefs, paths, pattern search\n- `api_memory.py`: bytes/ints/strings, patching\n- `api_types.py`: structs, type inference, type application\n- `api_modify.py`: comments, renaming, asm patching\n- `api_stack.py`: stack frame operations\n- `api_sigmaker.py`: signature creation, scanning, xref signatures (uses sigmaker.py)\n- `api_debug.py`: debugger control, unsafe / low priority for tests\n- `api_python.py`: execute Python in IDA context\n- `api_resources.py`: `ida://` MCP resources\n\n## Core implementation rules\n\n### IDA thread safety\nAll IDA SDK calls must run on the main thread.\nUse:\n```python\nfrom .rpc import tool\nfrom .sync import idasync\n\n@tool\n@idasync\ndef my_tool(...):\n    ...\n```\n\n### API conventions\n- Prefer batch-first APIs.\n- Many functions accept either a comma-separated string or a list.\n- Use full type hints and `Annotated[...]` descriptions.\n- The function docstring becomes the MCP tool description.\n\nExample:\n```python\ndef my_api(addrs: Annotated[str, \"Addresses (0x401000, main) or list\"]) -> list[dict]:\n    ...\n```\n\n### Common helpers\n- Parse addresses with `parse_address()`\n- Normalize batch input with `normalize_list_input()` / `normalize_dict_list()`\n- Use shared pagination / filtering helpers from `utils.py`\n\n### Unsafe operations\nDebugger or destructive operations should be marked unsafe:\n```python\nfrom .rpc import tool, unsafe\n\n@unsafe\n@tool\n@idasync\ndef dangerous_op(...):\n    ...\n```\n\n## Development commands\n\n### Run\n```bash\nuv run ida-pro-mcp\nuv run ida-pro-mcp --transport http://127.0.0.1:8744/sse\nuv run idalib-mcp --stdio path/to/binary\nuv run idalib-mcp --host 127.0.0.1 --port 8745 path/to/binary\nuv run ida-pro-mcp --unsafe\n```\n\n### MCP inspector\n```bash\nuv run mcp dev src/ida_pro_mcp/server.py\n```\n\n### Install / uninstall\n```bash\nuv run ida-pro-mcp --install\nuv run ida-pro-mcp --uninstall\n```\n\n## Testing and coverage\n\n### Run tests\nUse the headless test runner:\n```bash\nuv run ida-mcp-test tests/crackme03.elf -q\nuv run ida-mcp-test tests/typed_fixture.elf -q\nuv run ida-mcp-test tests/crackme03.elf -c api_analysis\nuv run ida-mcp-test tests/typed_fixture.elf -p \"*stack*\"\n```\n\nNotes:\n- Use `uv run ...`\n- Non-interactive output should show failures only plus a summary\n- Binary-specific tests should use `@test(binary=\"...\")` with the executable basename\n\n### Coverage\nMeasure coverage across both maintained fixtures:\n```bash\nuv run coverage erase\nuv run coverage run -m ida_pro_mcp.test tests/crackme03.elf -q\nuv run coverage run --append -m ida_pro_mcp.test tests/typed_fixture.elf -q\nuv run coverage report --show-missing\n```\n\nCurrent fixture intent:\n- `tests/crackme03.elf`: compact general regression fixture\n- `tests/typed_fixture.elf`: typed globals / structs / locals / stack coverage fixture\n\n### Test expectations\n- Prefer semantic assertions, not weak \"field exists\" checks\n- Prefer round-trip tests for mutating APIs\n- If tests expose clearly wrong API behavior, fix the API instead of weakening the test\n- Focus on IDA-facing modules, not server/config plumbing\n- Expect some IDA / Hex-Rays variance; guarded assertions or runtime skips are acceptable when justified\n\n### Generic-test sanity check\nWhen adding generic tests, also try a non-fixture binary to avoid ELF-specific assumptions:\n```bash\nuv run ida-mcp-test \"C:\\CodeBlocks\\x64dbg\\bin\\x64\\x64dbg.dll\" -q\n```\n\n## Scope priorities\n\nHigh priority:\n- `api_analysis.py`\n- `api_types.py`\n- `api_modify.py`\n- `api_stack.py`\n- `api_memory.py`\n- `api_core.py`\n- `api_resources.py`\n- `utils.py`\n- `framework.py`\n\nLower priority:\n- `api_debug.py`\n- MCP transport / hosting details\n- install / config mutation logic\n\n## Practical notes\n\n- Server/plugin Python: 3.11+\n- IDA Pro 8.3+; 9.0 recommended\n- IDA Free is not supported\n- If IDA uses the wrong Python, use `idapyswitch`\n\n<!-- File: skills/idapython/docs/ida_auto.md (Tokens: ~508 | Category: anthropic-skill) -->\n# ida_auto\n\nAutoanalysis queue management and IDA status indicators.\n\n## Key Functions\n\n### Auto State Management\n- `get_auto_state()` - Get current autoanalyzer state (AU_NONE when idle)\n- `set_auto_state(new_state)` - Set autoanalyzer state\n- `auto_is_ok()` - Check if all queues empty (analysis finished)\n- `is_auto_enabled()` / `enable_auto(enable)` - Get/set autoanalyzer enabled state\n\n### Queue Operations\n- `auto_mark(ea, type)` - Add single address to queue (sorted)\n- `auto_mark_range(start, end, type)` - Add address range to queue\n- `auto_unmark(start, end, type)` - Remove range from queue\n- `auto_cancel(ea1, ea2)` - Remove range from AU_CODE/AU_PROC/AU_USED queues\n\n### Analysis Planning\n- `plan_ea(ea)` / `plan_range(sEA, eEA)` - Plan reanalysis\n- `auto_make_code(ea)` - Plan to make code\n- `auto_make_proc(ea)` - Plan to make code+function\n- `reanalyze_callers(ea, noret)` - Reanalyze all callers of address\n- `revert_ida_decisions(ea1, ea2)` - Delete IDA-generated analysis for range\n\n### Synchronous Analysis\n- `auto_wait()` - Process all queues and wait (returns false if cancelled)\n- `auto_wait_range(ea1, ea2)` - Process range and wait (returns step count or -1)\n- `plan_and_wait(ea1, ea2, final_pass=True)` - Analyze range synchronously\n- `auto_make_step(ea1, ea2)` - Analyze one address in range\n\n### Queue Types (atype_t)\n- `AU_CODE` (1) - Convert to instruction\n- `AU_PROC` (3) - Convert to procedure start\n- `AU_USED` (6) - Reanalyze\n- `AU_TYPE` (8) - Apply type information\n- `AU_FINAL` (13) - Final pass\n\n### IDA State (idastate_t)\n- `st_Ready` - IDA idle\n- `st_Think` - Autoanalysis on\n- `st_Waiting` - Waiting for input\n- `st_Work` - IDA busy\n\n## See Also\nFull docs: skill/docs/ida_auto.rst\n\n<!-- File: skills/idapython/docs/ida_bitrange.md (Tokens: ~181 | Category: anthropic-skill) -->\n# ida_bitrange\n\nBitfield and bit-level range operations (low-priority, specialized use).\n\n## Key Class\n\n### bitrange_t\nRepresents a range of bits within a larger value.\n\n- `init(bit_ofs, size_in_bits)` - Initialize offset and size\n- `reset()` - Make empty\n- `empty()` - Check if empty\n- `bitoff()` / `bitsize()` / `bytesize()` - Get offset/size\n- `mask64()` - Convert to 64-bit mask\n- `has_common(r)` - Check overlap with another bitrange\n- `intersect(r)` - Intersect two ranges\n- `create_union(r)` - Union including hole between ranges\n- `shift_down(cnt)` / `shift_up(cnt)` - Shift range left/right\n\n## See Also\nFull docs: skill/docs/ida_bitrange.rst\n\n<!-- File: skills/idapython/docs/ida_bytes.md (Tokens: ~1271 | Category: anthropic-skill) -->\n# ida_bytes\n\nByte-level operations: reading, writing, patching, flags, and data type creation.\n\n## Navigation\n\n### Head/Item Navigation\n- `next_head(ea, maxea)` / `prev_head(ea, minea)` - Next/prev item head\n- `get_item_head(ea)` - Get start of item containing ea\n- `get_item_end(ea)` - Get address after item\n- `get_item_size(ea)` - Get item size in bytes\n- `next_chunk(ea, maxea)` / `prev_chunk(ea, minea)` - Next/prev contiguous chunk\n- `next_unknown(ea, maxea)` / `prev_unknown(ea, minea)` - Next/prev undefined byte\n\n## Reading Bytes\n\n### Single Values\n- `get_byte(ea)` / `get_word(ea)` / `get_dword(ea)` / `get_qword(ea)` - Read values\n- `get_original_byte(ea)` - Read original file byte (before patches)\n- `get_wide_byte(ea)` / `get_wide_word(ea)` - Read with byte size from inf.cc.size_i/size_s\n- `get_data_value(ea, size)` - Read data item value (up to 64 bits)\n\n### Bulk Operations\n- `get_bytes(ea, size, gmb_flags=GMB_READALL)` - Read byte array\n- `get_bytes_and_mask(ea, size, gmb_flags)` - Read bytes + mask (for wildcards)\n- `get_strlit_contents(ea, length, strtype)` - Extract string literal\n\n## Writing/Patching Bytes\n\n### Patching (modifies IDB + file)\n- `patch_byte(ea, value)` / `patch_word(ea)` / `patch_dword(ea)` / `patch_qword(ea)` - Patch values\n- `patch_bytes(ea, buf)` - Patch byte array\n- `revert_byte(ea)` - Revert to original file byte\n\n### IDB Only (no file modification)\n- `put_byte(ea, value)` / `put_word(ea)` / `put_dword(ea)` / `put_qword(ea)` - Update IDB only\n- `put_bytes(ea, buf)` - Update byte array in IDB\n\n## Flags & Type Checking\n\n### Item Type\n- `is_code(flags)` / `is_data(flags)` / `is_unknown(flags)` - Check item type\n- `is_byte(ea)` / `is_word(ea)` / `is_dword(ea)` / `is_qword(ea)` - Check data size\n- `is_strlit(ea)` - Check if string literal\n- `is_struct(ea)` - Check if structure\n- `is_tail(ea)` - Check if tail byte (not item head)\n\n### Flag Operations\n- `get_flags(ea)` - Get flags for address\n- `get_full_flags(ea)` - Get full flags (includes hidden/extra data)\n\n## Creating Data Items\n\n### Basic Types\n- `create_byte(ea, length, force=False)` - Create byte array\n- `create_word(ea, length, force)` - Create word array\n- `create_dword(ea, length, force)` - Create dword array\n- `create_qword(ea, length, force)` - Create qword array\n- `create_float(ea)` / `create_double(ea)` / `create_packed_real(ea)` - Create floats\n\n### String & Struct\n- `create_strlit(ea, length, strtype)` - Create string literal\n- `create_struct(ea, size, tid)` - Apply structure at address\n- `del_items(ea, flags=0, nbytes=1)` - Undefine items in range\n\n## Searching\n\n### Pattern Search\n- `find_bytes(bs, range_start, range_size, mask, flags)` - Find byte pattern\n- `bin_search(start, end, pattern, flags)` - Binary pattern search\n- `parse_binpat_str(pattern, radix, strlits)` - Parse pattern string to compiled form\n\n### Simple Search\n- `find_byte(sEA, size, value, flags)` - Find single byte value\n- `find_byter(sEA, size, value, flags)` - Find byte (reverse direction)\n\n## Operand Representation\n\n### Number Display\n- `op_hex(ea, n)` / `op_dec(ea, n)` / `op_oct(ea, n)` / `op_bin(ea, n)` - Set operand radix\n- `op_chr(ea, n)` - Display as character\n- `op_num(ea, n)` - Display as number (default radix)\n- `toggle_sign(ea, n)` - Toggle sign display\n\n### Complex Types\n- `op_offset(ea, n, reftype, target, base, tdelta)` - Create offset reference\n- `op_enum(ea, n, enum_id, serial)` - Apply enum\n- `op_stroff(ea, n, path, path_len, delta)` - Create structure offset\n- `op_stkvar(ea, n)` - Reference stack variable\n\n## Comments\n- `get_cmt(ea, rptble)` / `set_cmt(ea, comm, rptble)` - Get/set comment\n- `append_cmt(ea, str, rptble)` - Append to comment\n\n## Constants\n\n### Item Type Flags\n- `FF_CODE` / `FF_DATA` / `FF_TAIL` / `FF_UNK` - Main type flags\n- `FF_BYTE` / `FF_WORD` / `FF_DWORD` / `FF_QWORD` - Data size flags\n\n### Search Flags\n- `BIN_SEARCH_FORWARD` / `BIN_SEARCH_BACKWARD` - Search direction\n- `BIN_SEARCH_CASE` / `BIN_SEARCH_NOCASE` - Case sensitivity\n- `BIN_SEARCH_NOSHOW` - Suppress progress dialog\n\n## See Also\nFull docs: skill/docs/ida_bytes.rst\n\n<!-- File: skills/idapython/docs/ida_dbg.md (Tokens: ~1094 | Category: anthropic-skill) -->\n# ida_dbg\n\nDebugger control and tracing (unsafe operations require --unsafe flag).\n\n## Process Control\n\n### Start/Stop\n- `start_process(path, args, sdir)` / `request_start_process(...)` - Start debugging\n- `attach_process(pid, event_id)` / `request_attach_process(...)` - Attach to process\n- `detach_process()` / `request_detach_process()` - Detach from process\n- `exit_process()` / `request_exit_process()` - Terminate debugged process\n- `get_process_state()` / `set_process_state(state)` - Get/set state (DSTATE_SUSP/RUN/NOTASK)\n\n### Execution\n- `suspend_process()` / `continue_process()` - Pause/resume execution\n- `step_into()` / `step_over()` - Single step (into/over calls)\n- `step_until_ret()` - Run until return\n- `run_to(ea)` - Run until address\n- `run_to_backwards(ea)` / `continue_backwards()` - Reverse execution (if debugger supports)\n\n### State\n- `is_debugger_busy()` - Check if debugger processing request\n- `get_running_request()` / `is_request_running()` - Query pending requests\n- `invalidate_dbg_state(what)` - Invalidate cached state (DBGINV_MEMORY/REGS/ALL)\n\n## Threads\n\n- `get_thread_qty()` - Get thread count\n- `getn_thread(idx)` - Get thread ID by index\n- `get_current_thread()` - Get current thread ID\n- `select_thread(tid)` - Switch to thread\n- `suspend_thread(tid)` / `resume_thread(tid)` - Pause/resume thread\n\n## Breakpoints\n\n### Management\n- `add_bpt(ea, size, bpt_type)` - Add breakpoint (BPT_BRK/BPT_TRACE)\n- `del_bpt(ea)` - Delete breakpoint\n- `enable_bpt(ea, enable)` - Enable/disable breakpoint\n- `update_bpt(bpt)` - Update breakpoint properties\n- `get_bpt_qty()` / `getn_bpt(idx)` / `get_bpt(ea)` - Query breakpoints\n\n### Breakpoint Types\n- `BPT_BRK` - Stop execution\n- `BPT_TRACE` - Log and continue\n- `BPT_ENABLED` - Breakpoint active\n- `BPT_LOWCND` - Has condition\n\n### Location Types\n- `BPLT_ABS` - Absolute address\n- `BPLT_REL` - Relative to module\n- `BPLT_SYM` - Symbol name\n- `BPLT_SRC` - Source file:line\n\n## Registers\n\n- `get_dbg_reg_info(reg_name)` - Get register info\n- `get_sp_val()` / `get_ip_val()` - Get stack/instruction pointer\n- `is_reg_integer(reg_name)` / `is_reg_float(reg_name)` - Check register type\n\n## Tracing\n\n### Step Trace\n- `enable_step_trace(enable)` / `is_step_trace_enabled()` - Enable/check step tracing\n- `set_step_trace_options(opts)` / `get_step_trace_options()` - Configure tracing\n- `ST_OVER_DEBUG_SEG` / `ST_OVER_LIB_FUNC` / `ST_SKIP_LOOPS` - Step options\n\n### Instruction/Function/Block Trace\n- `enable_insn_trace(enable)` / `enable_func_trace(enable)` / `enable_bblk_trace(enable)` - Enable tracing\n- `set_insn_trace_options(opts)` / `set_func_trace_options(opts)` - Configure\n- `IT_LOG_SAME_IP` / `FT_LOG_RET` / `BT_LOG_INSTS` - Trace options\n\n### Trace Events\n- `get_tev_qty()` - Get trace event count\n- `get_tev_info(tev)` - Get trace event details\n- `get_insn_tev_reg_val(tev, reg)` - Get register value at instruction event\n- `clear_trace()` - Clear trace buffer\n- `set_trace_size(size)` - Set trace buffer size\n\n## Event Types\n\n### Debug Events\n- `dbg_process_start` / `dbg_process_exit` - Process lifetime\n- `dbg_thread_start` / `dbg_thread_exit` - Thread lifetime\n- `dbg_library_load` / `dbg_library_unload` - Module events\n- `dbg_bpt` / `dbg_exception` - Exception events\n- `dbg_step_into` / `dbg_step_over` / `dbg_run_to` - Step events\n\n### Trace Event Types\n- `tev_insn` - Instruction execution\n- `tev_call` - Function call\n- `tev_ret` - Function return\n- `tev_bpt` - Breakpoint hit\n- `tev_mem` - Memory access\n\n## Debugger Options (DOPT_*)\n- `DOPT_START_BPT` - Break on process start\n- `DOPT_ENTRY_BPT` - Break on entry point\n- `DOPT_THREAD_BPT` - Break on new thread\n- `DOPT_LIB_BPT` - Break on library load\n- `DOPT_SUSPEND_ON_EXCEPTION` - Stop on exception\n\n## DBG_Hooks\nOverride methods to receive debugger events (use `ida_dbg.DBG_Hooks` base class).\n\n## See Also\nFull docs: skill/docs/ida_dbg.rst\n\n<!-- File: skills/idapython/docs/ida_dirtree.md (Tokens: ~540 | Category: anthropic-skill) -->\n# ida_dirtree\n\nDirectory tree organization for IDA items (types, functions, names, etc).\n\n## Overview\nProvides virtual directory structure over collections accessed by inode (ID). Used for organizing local types, structures, enums, functions, names, bookmarks, etc.\n\n## Standard Trees\n- `DIRTREE_LOCAL_TYPES` - Local type library\n- `DIRTREE_FUNCS` - Function list\n- `DIRTREE_NAMES` - Named locations\n- `DIRTREE_IMPORTS` - Imported functions\n- `DIRTREE_BPTS` - Breakpoints\n- `get_std_dirtree(id)` - Access standard tree\n\n## Key Classes\n\n### dirtree_t\nMain directory tree interface.\n\n- `chdir(path)` / `getcwd()` - Navigate directories\n- `mkdir(path)` / `rmdir(path)` - Create/delete directories\n- `link(path/inode)` / `unlink(path/inode)` - Add/remove items\n- `rename(from, to)` - Rename entry\n- `resolve_path(path)` - Convert path to direntry_t\n- `get_abspath(cursor/relpath)` - Get absolute path\n- `isdir(path/de)` / `isfile(path/de)` - Check entry type\n- `findfirst(ff, pattern)` / `findnext(ff)` - Iterate entries\n- `traverse(visitor)` - Depth-first traversal with callback\n\n### direntry_t\nRepresents a directory entry (inode or directory).\n\n- `idx` - inode_t or diridx_t\n- `isdir` - True if directory, false if file\n- `valid()` - Check if entry exists\n\n### dirtree_cursor_t\nCursor for navigating tree.\n\n- `parent` - Parent directory index\n- `rank` - Index within parent\n- `is_root_cursor()` / `set_root_cursor()` - Root operations\n\n### dirspec_t\nSpecialization interface (defines how inodes map to items).\n\n- `get_name(inode, name_flags)` - Get item name\n- `get_inode(dirpath, name)` - Lookup inode by name\n- `rename_inode(inode, newname)` - Rename item\n- `unlink_inode(inode)` - Notification when unlinked\n\n## Error Codes\n- `DTE_OK` - Success\n- `DTE_ALREADY_EXISTS` - Item exists\n- `DTE_NOT_FOUND` - Item not found\n- `DTE_NOT_DIRECTORY` - Not a directory\n- `DTE_NOT_EMPTY` - Directory not empty\n- `DTE_BAD_PATH` - Invalid path\n\n## See Also\nFull docs: skill/docs/ida_dirtree.rst\n\n<!-- File: skills/idapython/docs/ida_diskio.md (Tokens: ~661 | Category: anthropic-skill) -->\n# ida_diskio\n\nFile I/O and IDA directory/resource management.\n\n## IDA Directories\n\n### Path Queries\n- `idadir(subdir)` - Get IDA install directory or subdirectory\n- `get_user_idadir()` - Get user data directory ($IDAUSR or default)\n- `get_ida_subdirs(subdir, flags)` - List all search paths for resource\n- `getsysfile(filename, subdir)` - Search for file in IDA paths\n\n### Subdirectory Constants\n- `CFG_SUBDIR` - Configuration files\n- `IDC_SUBDIR` - IDC scripts\n- `IDS_SUBDIR` - IDS files (function signatures)\n- `IDP_SUBDIR` - Processor modules\n- `LDR_SUBDIR` - Loader modules\n- `SIG_SUBDIR` - FLIRT signatures\n- `TIL_SUBDIR` - Type libraries\n- `PLG_SUBDIR` - Plugins\n- `THM_SUBDIR` - Themes\n\n### Search Flags\n- `IDA_SUBDIR_IDP` - Append processor name\n- `IDA_SUBDIR_IDADIR_FIRST` - Search $IDADIR before $IDAUSR\n- `IDA_SUBDIR_ONLY_EXISTING` - Only return existing directories\n\n## File Operations\n\n### Standard I/O Wrappers (use instead of C stdio)\n- `fopenRT(file)` / `fopenWT(file)` - Open text read/write\n- `fopenRB(file)` / `fopenWB(file)` - Open binary read/write\n- `fopenM(file)` - Open for modification\n- `fopenA(file)` - Open for append\n\n## Linput (IDA Binary Input)\n\n### Creation\n- `open_linput(file, remote)` - Open file as linput\n- `create_memory_linput(start, size)` - Create from IDB memory range\n- `create_bytearray_linput(s)` - Create from Python bytes\n- `create_generic_linput(gl)` - Create from custom reader\n\n### Operations\n- `qlgetz(li, fpos)` - Read null-terminated string at position\n- `get_linput_type(li)` - Get linput type (LINPUT_LOCAL/RFILE/PROCMEM/GENERIC)\n- `close_linput(li)` - Close linput\n\n### Linput Types\n- `LINPUT_LOCAL` - Local file\n- `LINPUT_RFILE` - Remote file\n- `LINPUT_PROCMEM` - Process memory\n- `LINPUT_GENERIC` - Custom reader\n\n### generic_linput_t\nBase class for custom binary readers.\n\n- `filesize` - Total size\n- `blocksize` - Read block size\n- `read(off, buffer, nbytes)` - Read bytes at offset\n\n## File Enumeration\n- `enumerate_files(path, fname, callback)` - Enumerate files matching pattern\n\n## Platform Folders\n- `get_special_folder(csidl)` - Get OS-specific folders\n  - `CSIDL_APPDATA` - Application data\n  - `CSIDL_LOCAL_APPDATA` - Local app data\n  - `CSIDL_PROGRAM_FILES` - Program files directory\n\n## See Also\nFull docs: skill/docs/ida_diskio.rst\n\n<!-- File: skills/idapython/docs/ida_entry.md (Tokens: ~306 | Category: anthropic-skill) -->\n# ida_entry\n\nEntry point and exported function management - addresses, names, and ordinal numbers.\n\n## Key Functions\n\n- `get_entry_qty() -> int` - Get number of entry points\n- `add_entry(ord, ea, name, makecode, flags=0) -> bool` - Add entry point with ordinal number\n- `get_entry(ord) -> ea_t` - Get address by ordinal number\n- `get_entry_ordinal(idx) -> int` - Get ordinal by index (0..get_entry_qty()-1)\n- `get_entry_name(ord) -> str` - Get entry point name by ordinal\n- `rename_entry(ord, name, flags=0) -> bool` - Rename entry point\n- `set_entry_forwarder(ord, name, flags=0) -> bool` - Set forwarder name (for DLL exports)\n- `get_entry_forwarder(ord) -> str` - Get forwarder name\n\n## Flags (AEF_*)\n\n- `AEF_UTF8` - Name is UTF-8 encoded (default)\n- `AEF_IDBENC` - Name is IDB encoded (implies AEF_NODUMMY)\n- `AEF_NODUMMY` - Prepend '_' if name begins with dummy suffix\n- `AEF_WEAK` - Make name weak\n- `AEF_NOFORCE` - Append to comment if name exists (unless old name is weak)\n\n## See Also\nFull docs: skill/docs/ida_entry.rst\n\n<!-- File: skills/idapython/docs/ida_expr.md (Tokens: ~1092 | Category: anthropic-skill) -->\n# ida_expr\n\nIDC language interpreter - compile/execute IDC scripts, evaluate expressions, manipulate IDC values and objects.\n\n## Key Functions\n\n### Expression Evaluation\n- `eval_expr(rv, where, line) -> str` - Compile and evaluate expression at address context\n- `eval_idc_expr(rv, where, line) -> str` - Same as eval_expr but forces IDC interpreter\n\n### Script Execution\n- `compile_idc_file(line) -> str` - Compile IDC file\n- `compile_idc_text(line) -> str` - Compile IDC text\n- `compile_idc_snippet(func, text, resolver=None, only_safe_funcs=False) -> str` - Compile text into named function\n- `exec_idc_script(result, path, func, args, argsnum) -> str` - Compile and execute function from file\n- `exec_system_script(file, complain_if_no_file=True) -> bool` - Compile and execute \"main\" from system file\n\n### IDC Value Manipulation\n- `idcv_long(v) -> error_t` - Convert to 32/64-bit number\n- `idcv_int64(v) -> error_t` - Convert to 64-bit number\n- `idcv_num(v) -> error_t` - Convert to long (\"true\"→1, \"false\"→0)\n- `idcv_string(v) -> error_t` - Convert to string\n- `idcv_float(v) -> error_t` - Convert to float\n- `idcv_object(v, icls=None) -> error_t` - Create IDC object\n- `move_idcv(dst, src) -> error_t` - Move value (efficient, no copy)\n- `copy_idcv(dst, src) -> error_t` - Shallow copy (objects copied by reference)\n- `deep_copy_idcv(dst, src) -> error_t` - Deep copy objects\n- `free_idcv(v)` - Free VT_STR/VT_OBJ storage\n- `swap_idcvs(v1, v2)` - Swap two variables\n\n### Object/Attribute Access\n- `get_idcv_attr(res, obj, attr, may_use_getattr=False) -> error_t` - Get object attribute\n- `set_idcv_attr(obj, attr, value, may_use_setattr=False) -> error_t` - Set object attribute\n- `del_idcv_attr(obj, attr) -> error_t` - Delete attribute\n- `first_idcv_attr(obj) -> str`, `last_idcv_attr(obj) -> str` - Iterate attributes\n- `get_idcv_slice(res, v, i1, i2, flags=0) -> error_t` - Get slice of string/object\n- `set_idcv_slice(v, i1, i2, _in, flags=0) -> error_t` - Set slice\n\n### Class/Variable Management\n- `add_idc_class(name, super=None) -> idc_class_t*` - Create IDC class\n- `find_idc_class(name) -> idc_class_t*` - Find existing class\n- `add_idc_gvar(name) -> idc_value_t*` - Add global variable\n- `find_idc_gvar(name) -> idc_value_t*` - Find global variable\n- `find_idc_func(prefix, n=0) -> str` - Find IDC function by prefix\n\n## idc_value_t Class\n\nCore IDC value container with variant type support.\n\n### Attributes\n- `vtype: char` - Type (VT_LONG, VT_FLOAT, VT_STR, VT_OBJ, VT_FUNC, VT_PVOID, VT_INT64, VT_REF)\n- `num: int` - Integer value (VT_LONG)\n- `i64: int64` - 64-bit integer (VT_INT64)\n- `e: fpvalue_t` - Float value (VT_FLOAT)\n- `obj: idc_object_t*` - Object reference (VT_OBJ)\n\n### Methods\n- `clear()` - Free storage\n- `qstr() -> str`, `c_str() -> str` - Get string value\n- `set_string(...)`, `set_long(v)`, `set_int64(v)`, `set_float(f)` - Set typed values\n- `is_zero() -> bool`, `is_integral() -> bool`, `is_convertible() -> bool` - Type checks\n\n## Value Types (VT_*)\n- `VT_LONG` - Integer\n- `VT_INT64` - 64-bit integer\n- `VT_FLOAT` - Floating point\n- `VT_STR` - String\n- `VT_OBJ` - Object\n- `VT_FUNC` - Function\n- `VT_PVOID` - void pointer\n- `VT_REF` - Reference\n\n## Compilation Flags (CPL_*)\n- `CPL_DEL_MACROS` - Delete macros after compilation\n- `CPL_USE_LABELS` - Allow program labels\n- `CPL_ONLY_SAFE` - Only thread-safe functions\n\n## Function Flags (EXTFUN_*)\n- `EXTFUN_BASE` - Requires open database\n- `EXTFUN_NORET` - Does not return\n- `EXTFUN_SAFE` - Thread-safe, callable from any thread\n\n## See Also\nFull docs: skill/docs/ida_expr.rst\n\n<!-- File: skills/idapython/docs/ida_fixup.md (Tokens: ~881 | Category: anthropic-skill) -->\n# ida_fixup\n\nRelocation/fixup information for loaders - manage target addresses, offsets, and displacement values.\n\n## Key Functions\n\n- `get_fixup(fd, source) -> bool` - Get fixup information at address\n- `exists_fixup(source) -> bool` - Check if fixup exists\n- `set_fixup(source, fd)` - Set fixup information (loaders use this)\n- `del_fixup(source)` - Delete fixup\n- `get_first_fixup_ea() -> ea_t` - Get first fixup address\n- `get_next_fixup_ea(ea) -> ea_t` - Next fixup after ea\n- `get_prev_fixup_ea(ea) -> ea_t` - Previous fixup before ea\n- `get_fixup_value(ea, type) -> int` - Read bytes and convert to operand value (get relocation addend)\n- `patch_fixup_value(ea, fd) -> bool` - Update bytes from fixup data\n- `get_fixup_desc(source, fd) -> str` - Get description comment\n- `calc_fixup_size(type) -> int` - Calculate fixup size in bytes (-1 on error)\n- `contains_fixups(ea, size) -> bool` - Check if range contains fixups\n- `gen_fix_fixups(from, to, size)` - Relocate bytes when moving segments/rebasing\n\n## fixup_data_t Class\n\nFixup metadata container.\n\n### Attributes\n- `sel: sel_t` - Target segment selector (BADSEL for absolute)\n- `off: ea_t` - Target offset\n- `displacement: adiff_t` - Displacement from target\n\n### Methods\n- `get_type() -> fixup_type_t`, `set_type(type)` - Fixup type access\n- `set_type_and_flags(type, flags=0)` - Set both type and flags\n- `is_custom() -> bool` - Is processor-specific fixup\n- `get_flags() -> int` - Get flags\n- `is_extdef() -> bool`, `set_extdef()`, `clr_extdef()` - Target is symbol vs segment offset\n- `is_unused() -> bool`, `set_unused()`, `clr_unused()` - IDA ignores this fixup\n- `has_base() -> bool` - Is relative fixup (vs segment-relative)\n- `was_created() -> bool` - Was created by IDA (not in original file)\n- `get_base() -> ea_t`, `set_base(new_base)` - Base address for relative fixups\n- `set(source)` - set_fixup wrapper\n- `get(source) -> bool` - get_fixup wrapper\n- `calc_size() -> int` - Fixup size\n\n## Fixup Types (FIXUP_*)\n\n- `FIXUP_OFF8`, `FIXUP_OFF16`, `FIXUP_OFF32`, `FIXUP_OFF64` - Unsigned offsets (8/16/32/64-bit)\n- `FIXUP_OFF8S`, `FIXUP_OFF16S`, `FIXUP_OFF32S` - Signed offsets\n- `FIXUP_SEG16` - 16-bit segment selector\n- `FIXUP_PTR16` - 32-bit pointer (16:16 base:offset)\n- `FIXUP_PTR32` - 48-bit pointer (16:32 base:offset)\n- `FIXUP_HI8`, `FIXUP_HI16` - High 8/16 bits of offset\n- `FIXUP_LOW8`, `FIXUP_LOW16` - Low 8/16 bits of offset\n- `FIXUP_CUSTOM` - Start of custom (processor-specific) types\n\n## Fixup Flags (FIXUPF_*)\n\n- `FIXUPF_REL` - Relative to linear address `base` (else segment-relative)\n- `FIXUPF_EXTDEF` - Target is symbol (else segment offset)\n- `FIXUPF_UNUSED` - Ignored by IDA, disables operand conversion\n- `FIXUPF_CREATED` - Not present in input file\n- `FIXUPF_LOADER_MASK` - Loader-specific flags (not stored in DB)\n\n## See Also\nFull docs: skill/docs/ida_fixup.rst\n\n<!-- File: skills/idapython/docs/ida_fpro.md (Tokens: ~481 | Category: anthropic-skill) -->\n# ida_fpro\n\nSystem-independent FILE* operations - cross-module file I/O (use these instead of C stdlib functions).\n\n## qfile_t Class\n\nIDA's FILE* wrapper for cross-module compatibility.\n\n### Constructor Methods\n- `open(filename, mode) -> bool` - Open file (fopen-style mode string)\n- `from_fp(fp) -> qfile_t*` - Wrap existing FILE*\n- `from_capsule(pycapsule) -> qfile_t*` - Wrap Python capsule\n- `tmpfile() -> qfile_t*` - Create temporary file\n\n### File Operations\n- `close()` - Close file\n- `opened() -> bool` - Check if open\n- `flush()` - Flush buffers\n- `size() -> int64` - Get file size\n- `filename() -> str` - Get filename\n\n### Reading\n- `read(size) -> str` - Read bytes (None on error)\n- `readbytes(size, big_endian) -> str` - Read with endianness conversion\n- `gets(len) -> str` - Read line (None on EOF)\n- `get_byte() -> int` - Read single byte (None on EOF)\n\n### Writing\n- `write(buf) -> int` - Write bytes (0 on error, else bytes written)\n- `writebytes(size, big_endian) -> int` - Write with endianness conversion\n- `puts(str) -> int` - Write string\n- `put_byte(chr)` - Write single byte\n\n### Positioning\n- `seek(offset, whence=SEEK_SET) -> int` - Seek (returns new position, not 0 like fseek)\n- `tell() -> int` - Get current position\n\n## Functions\n\n- `qfclose(fp)` - Close FILE*\n\n## Move Flags (QMOVE_*)\n- `QMOVE_CROSS_FS` - Allow cross-filesystem moves\n- `QMOVE_OVERWRITE` - Overwrite existing files\n- `QMOVE_OVR_RO` - Overwrite read-only files\n\n## Important\n\n**Never mix C stdlib FILE* functions with IDA kernel functions.** Each module has its own FILE* state when statically linked. Use qfile_t for all file I/O in plugins.\n\n## See Also\nFull docs: skill/docs/ida_fpro.rst\n\n<!-- File: skills/idapython/docs/ida_frame.md (Tokens: ~1353 | Category: anthropic-skill) -->\n# ida_frame\n\nFunction stack frame manipulation - local variables, register variables, stack pointer tracking.\n\n## Frame Structure\n\n```\n+------------------------------------------------+\n| function arguments                             |\n+------------------------------------------------+\n| return address                                 |\n+------------------------------------------------+\n| saved registers (SI, DI, etc)                  |\n+------------------------------------------------+ <- typical BP\n|                                                |\n| local variables                                |\n|                                                |\n+------------------------------------------------+ <- SP\n```\n\nAccess via: `tinfo_t::get_func_frame(pfn)` or `get_func_frame(out, pfn)` + `tinfo_t::get_udt_details()`\n\n## Key Functions\n\n### Frame Management\n- `add_frame(pfn, frsize, frregs, argsize) -> bool` - Create frame (frsize=locals, frregs=saved regs, argsize=purged bytes)\n- `del_frame(pfn) -> bool` - Delete frame\n- `set_frame_size(pfn, frsize, frregs, argsize) -> bool` - Resize frame\n- `get_frame_size(pfn) -> asize_t` - Full size (locals + saved regs + retaddr + purged bytes)\n- `get_frame_retsize(pfn) -> int` - Return address size\n- `get_func_frame(out, pfn) -> bool` - Get frame type info\n\n### Frame Parts\n- `frame_off_args(pfn) -> ea_t` - Arguments section start\n- `frame_off_retaddr(pfn) -> ea_t` - Return address section start\n- `frame_off_savregs(pfn) -> ea_t` - Saved registers section start\n- `frame_off_lvars(pfn) -> ea_t` - Local variables section start\n- `get_frame_part(range, pfn, part)` - Get part offsets (FPC_ARGS/FPC_RETADDR/FPC_SAVREGS/FPC_LVARS)\n\n### Stack Variables\n- `define_stkvar(pfn, name, off, tif, repr=None) -> bool` - Define stack var (negative off=locals, positive=args)\n- `add_frame_member(pfn, name, offset, tif, repr=None, etf_flags=0) -> bool` - Add member to frame type\n- `set_frame_member_type(pfn, offset, tif, repr=None, etf_flags=0) -> bool` - Change member type\n- `delete_frame_members(pfn, start_offset, end_offset) -> bool` - Delete members in range\n- `build_stkvar_name(pfn, v) -> str` - Auto-generate stack var name\n- `calc_stkvar_struc_offset(pfn, insn, n) -> ea_t` - Calculate stack var offset in frame\n- `calc_frame_offset(pfn, off, insn=None, op=None) -> int` - Calculate offset in frame from SP/BP offset\n- `build_stkvar_xrefs(out, pfn, start_offset, end_offset)` - Get xrefs to stack frame range\n\n### Utilities\n- `is_funcarg_off(pfn, frameoff) -> bool` - Is offset in arguments range\n- `lvar_off(pfn, frameoff) -> int` - Convert to local var offset\n- `is_anonymous_member_name(name) -> bool` - Prefixed with \"anonymous\"\n- `is_dummy_member_name(name) -> bool` - Auto-generated name\n- `is_special_frame_member(tid) -> bool` - Is retaddr or saved regs slot\n- `soff_to_fpoff(pfn, soff) -> int` - Convert struct offset to FP-relative\n- `update_fpd(pfn, fpd) -> bool` - Update frame pointer delta\n- `set_purged(ea, nbytes, override_old_value) -> bool` - Set purged bytes (__stdcall/__pascal)\n\n### Register Variables\n- `add_regvar(pfn, ea1, ea2, canon, user, cmt) -> int` - Define register variable in range\n- `find_regvar(pfn, ea, canon) -> regvar_t*` - Find register variable definition\n- `has_regvar(pfn, ea) -> bool` - Check if regvar exists\n- `rename_regvar(pfn, v, user) -> int` - Rename register variable\n- `set_regvar_cmt(pfn, v, cmt) -> int` - Set comment\n- `del_regvar(pfn, ea1, ea2, canon) -> int` - Delete register variable\n- `free_regvar(v)` - Free regvar_t\n\n### Stack Pointer Tracking\n- `get_spd(pfn, ea) -> int` - Get SP delta before instruction (initial SP - current SP)\n- `get_effective_spd(pfn, ea) -> int` - Get SP delta used by instruction (differs for \"pop [esp+N]\")\n- `get_sp_delta(pfn, ea) -> int` - Get SP modification at location (0 if no change point)\n- `add_auto_stkpnt(pfn, ea, delta) -> bool` - Add automatic SP change point\n- `add_user_stkpnt(ea, delta) -> bool` - Add user-defined SP change point\n- `del_stkpnt(pfn, ea) -> bool` - Delete SP change point\n- `set_auto_spd(pfn, ea, new_spd) -> bool` - Set cumulative SP delta at address\n- `recalc_spd(cur_ea) -> bool` - Recalculate SP for non-fallthrough instructions\n- `recalc_spd_for_basic_block(pfn, cur_ea) -> bool` - Recalculate SP for basic block\n\n## regvar_t Class\n\nRegister variable definition (extends range_t).\n\n### Attributes\n- `canon: str` - Canonical register name (case-insensitive)\n- `user: str` - User-defined name\n- `cmt: str` - Comment near definition\n\n## Error Codes\n\n- `REGVAR_ERROR_OK` - Success\n- `REGVAR_ERROR_ARG` - Bad function arguments\n- `REGVAR_ERROR_RANGE` - Bad definition range\n- `REGVAR_ERROR_NAME` - Name can't be accepted\n\n## Flags\n\n- `STKVAR_VALID_SIZE` - dtyp contains correct variable type (off for \"lea\")\n- `STKVAR_KEEP_EXISTING` - Don't create new var if one exists\n\n## See Also\nFull docs: skill/docs/ida_frame.rst\n\n<!-- File: skills/idapython/docs/ida_funcs.md (Tokens: ~2303 | Category: anthropic-skill) -->\n# ida_funcs\n\nFunction management - define, modify, analyze functions and function chunks. Includes FLIRT signature support.\n\n## Architecture\n\nFunctions consist of:\n- **Entry chunk** - function start (required)\n- **Tail chunks** - optional additional code ranges shared between functions\n- Each tail has an **owner** function\n\n## func_t Class\n\nCore function descriptor (extends range_t).\n\n### Key Attributes\n- `flags: uint64` - Function flags (FUNC_*)\n- `frame: int` - Frame structure netnode ID\n- `frsize: asize_t` - Local variables size\n- `frregs: ushort` - Saved registers size\n- `argsize: asize_t` - Purged bytes on return (__stdcall/__pascal)\n- `fpd: asize_t` - Frame pointer delta (usually 0)\n- `color: bgcolor_t` - User-defined color\n- `points: stkpnt_t*`, `pntqty: int` - SP change points\n- `regvars: regvar_t*`, `regvarqty: int` - Register variables\n- `regargs: regarg_t*`, `regargqty: int` - Register arguments (temporary, cleared when type determined)\n- `tails: range_t*`, `tailqty: int` - Function tails\n- `owner: ea_t` - Tail owner address\n- `referers: ea_t*`, `refqty: int` - Parent functions using this tail\n\n### Methods\n- `is_far() -> bool` - Far function\n- `does_return() -> bool` - Returns to caller\n- `analyzed_sp() -> bool` - SP-analysis performed\n- `need_prolog_analysis() -> bool` - Needs prolog analysis\n- `get_name() -> str` - Function name\n- `get_prototype() -> tinfo_t` - Function prototype\n- `get_frame_object() -> tinfo_t` - Frame structure\n- `addresses()`, `code_items()`, `data_items()`, `head_items()`, `not_tails()` - Iterators\n\n## Key Functions\n\n### Querying Functions\n- `get_func(ea) -> func_t*` - Get function by address (returns entry chunk)\n- `getn_func(n) -> func_t*` - Get function by index (0..get_func_qty()-1)\n- `get_func_qty() -> size_t` - Total function count\n- `get_func_num(ea) -> int` - Get function index (-1 if not found)\n- `get_prev_func(ea) -> func_t*`, `get_next_func(ea) -> func_t*` - Navigate functions\n- `func_contains(pfn, ea) -> bool` - Does function contain address\n- `is_same_func(ea1, ea2) -> bool` - Do addresses belong to same function\n- `get_func_chunknum(pfn, ea) -> int` - Get chunk number (-1=not contained, 0=entry, >0=tail)\n\n### Creating/Modifying Functions\n- `add_func(ea1, ea2=BADADDR) -> bool` - Create function (auto-determines bounds if ea2=BADADDR)\n- `add_func_ex(pfn) -> bool` - Create from func_t struct\n- `del_func(ea) -> bool` - Delete function\n- `update_func(pfn) -> bool` - Update function info (don't use for start/end changes)\n- `set_func_start(ea, newstart) -> int` - Move start address (returns MOVE_FUNC_*)\n- `set_func_end(ea, newend) -> bool` - Move end address\n- `find_func_bounds(nfn, flags) -> int` - Auto-determine boundaries (returns FIND_FUNC_*)\n- `reanalyze_function(pfn, ea1=None, ea2=None, analyze_parents=False)` - Reanalyze function\n\n### Function Information\n- `get_func_name(ea) -> str` - Get name\n- `get_func_cmt(pfn, repeatable) -> str`, `set_func_cmt(pfn, cmt, repeatable) -> bool` - Comments\n- `get_func_ranges(ranges, pfn) -> ea_t` - Get all ranges\n- `calc_func_size(pfn) -> asize_t` - Total size including tails\n- `get_func_bitness(ea) -> int` - Bitness (0=16, 1=32, 2=64, -1=error)\n- `get_func_bits(ea) -> int` - Bits (16/32/64)\n- `get_func_bytes(ea) -> bytes` - Function bytes\n- `is_visible_func(pfn) -> bool`, `set_visible_func(pfn, visible)` - Visibility control\n- `is_finally_visible_func(pfn) -> bool` - Final visibility after all checks\n\n### Function Analysis\n- `func_does_return(ea) -> bool` - Does function return\n- `reanalyze_noret_flag(ea)` - Reanalyze non-return flag\n- `set_noret_insn(ea, noret)` - Mark instruction as non-returning\n- `calc_thunk_func_target(pfn) -> ea_t` - Get thunk target\n- `set_func_name_if_jumpfunc(pfn, name)` - Auto-name jump functions\n\n### Function Chunks (Tails)\n- `get_fchunk(ea) -> func_t*` - Get chunk by address (entry or tail)\n- `getn_fchunk(n) -> func_t*` - Get chunk by index\n- `get_fchunk_qty() -> size_t` - Total chunk count\n- `get_fchunk_num(ea) -> int` - Get chunk index\n- `get_prev_fchunk(ea) -> func_t*`, `get_next_fchunk(ea) -> func_t*` - Navigate chunks\n- `append_func_tail(pfn, tail_ea1, tail_ea2) -> bool` - Add tail to function\n- `remove_func_tail(pfn, tail_ea) -> bool` - Remove tail\n- `set_tail_owner(tail, owner_ea) -> bool` - Change tail owner\n- `get_fchunk_referer(ea, idx) -> ea_t` - Get parent function using tail\n- `func_tail_iterator_set(pfn, fti)` - Initialize tail iterator\n- `func_parent_iterator_set(pfn, fpi)` - Initialize parent iterator\n\n### Locking\n- `lock_func_range(pfn, lock)` - Lock function pointer (prevents deletion/move)\n- `is_func_locked(pfn) -> bool` - Check if locked\n- `lock_func(pfn)`, `lock_func_with_tails_t(pfn)` - RAII lock helpers\n\n### FLIRT Signatures\n- `plan_to_apply_idasgn(name) -> int` - Plan signature application (returns IDASGN_*)\n- `apply_idasgn_to(name, ea, may_show_wait_box) -> int` - Apply signature at address\n- `get_idasgn_qty() -> int` - Number of loaded signatures\n- `get_current_idasgn() -> str` - Current signature name\n- `calc_idasgn_state(n) -> int` - Signature state (IDASGN_*)\n- `del_idasgn(n)` - Delete signature\n- `get_idasgn_title(n) -> str` - Get signature title\n- `get_idasgn_desc(n) -> str` - Get description\n- `get_idasgn_desc_with_matches(n) -> str` - Get description with match count\n- `apply_startup_sig(ea1, ea2)` - Apply startup signature\n- `try_to_add_libfunc(pfn, ea) -> int` - Try to add library function (returns LIBFUNC_*)\n\n### Register Arguments\n- `read_regargs(pfn) -> dyn_regarg_array` - Read register arguments\n- `add_regarg(pfn, reg, type, name) -> bool` - Add register argument\n\n## Function Flags (FUNC_*)\n\n- `FUNC_NORET` - Doesn't return\n- `FUNC_FAR` - Far function\n- `FUNC_LIB` - Library function\n- `FUNC_STATICDEF` - Static\n- `FUNC_FRAME` - Uses frame pointer (BP)\n- `FUNC_USERFAR` - User-specified far\n- `FUNC_HIDDEN` - Hidden chunk\n- `FUNC_THUNK` - Jump/thunk function\n- `FUNC_BOTTOMBP` - BP points to stack frame bottom\n- `FUNC_NORET_PENDING` - Non-return analysis pending\n- `FUNC_SP_READY` - SP-analysis complete\n- `FUNC_FUZZY_SP` - SP changes untraceably (e.g., \"and esp, 0FFFFFFF0h\")\n- `FUNC_PROLOG_OK` - Prolog analyzed\n- `FUNC_PURGED_OK` - argsize validated\n- `FUNC_TAIL` - Function tail chunk\n- `FUNC_LUMINA` - Info from Lumina\n- `FUNC_OUTLINE` - Outlined code, not real function\n- `FUNC_REANALYZE` - Frame changed, needs reanalysis\n- `FUNC_UNWIND` - Exception unwind handler\n- `FUNC_CATCH` - Exception catch handler\n\n## Return Codes\n\n### MOVE_FUNC_*\n- `MOVE_FUNC_OK` - Success\n- `MOVE_FUNC_NOCODE` - No instruction at newstart\n- `MOVE_FUNC_BADSTART` - Bad new start\n- `MOVE_FUNC_NOFUNC` - No function at ea\n- `MOVE_FUNC_REFUSED` - Plugin refused\n\n### FIND_FUNC_* (flags)\n- `FIND_FUNC_NORMAL` - Stop on undefined byte\n- `FIND_FUNC_DEFINE` - Create instruction on undefined byte\n- `FIND_FUNC_IGNOREFN` - Ignore existing function boundaries\n- `FIND_FUNC_KEEPBD` - Don't modify boundaries, just create instructions\n\n### FIND_FUNC_* (results)\n- `FIND_FUNC_OK` - Ready for add_func()\n- `FIND_FUNC_EXIST` - Already exists\n- `FIND_FUNC_UNDEF` - Has unexplored bytes\n\n### IDASGN_*\n- `IDASGN_OK` - Success\n- `IDASGN_BADARG` - Bad argument\n- `IDASGN_APPLIED` - Already applied\n- `IDASGN_CURRENT` - Current signature\n- `IDASGN_PLANNED` - Planned for application\n\n### LIBFUNC_*\n- `LIBFUNC_FOUND` - Found and added\n- `LIBFUNC_NONE` - Not found\n- `LIBFUNC_DELAY` - Delayed (needs more analysis)\n\n## Iterators\n\n- `func_tail_iterator_t` - Iterate function tails\n- `func_item_iterator_t` - Iterate function items (addresses/code/data/heads)\n- `func_parent_iterator_t` - Iterate parent functions using tail\n\n## See Also\nFull docs: skill/docs/ida_funcs.rst\n\n<!-- File: skills/idapython/docs/ida_gdl.md (Tokens: ~455 | Category: anthropic-skill) -->\n# ida_gdl\n\nLow level graph drawing operations - flow charts and call graphs.\n\n## Key Classes\n\n### FlowChart\nPythonic flowchart class for determining basic blocks.\n- `FlowChart(f, bounds, flags)` - Create flow chart for function\n- `size` - Number of blocks in flow chart\n- `refresh()` - Refresh flow chart\n- Iterate blocks directly: `for bb in fc: ...`\n\n### BasicBlock\nBasic block within a flowchart.\n- `id` - Block number\n- `start_ea`, `end_ea` - Address range\n- `type` - Block type (fcb_normal, fcb_ret, fcb_noret, etc.)\n- `preds()` - Iterator over predecessor blocks\n- `succs()` - Iterator over successor blocks\n\n### qflow_chart_t\nLow-level flow chart builder (use FlowChart instead for Python).\n- `create(title, pfn, ea1, ea2, flags)` - Build flow chart\n- `nsucc(node)`, `npred(node)` - Successor/predecessor counts\n- `succ(node, i)`, `pred(node, i)` - Get nth successor/predecessor\n\n## Key Functions\n\n- `gen_flow_graph(filename, title, pfn, ea1, ea2, gflags)` - Generate flow graph to .dot/.gdl\n- `gen_simple_call_chart(filename, wait, title, gflags)` - Simple call graph\n- `is_ret_block(btype)` - Check if block returns\n- `is_noret_block(btype)` - Check if block never returns\n\n## Constants\n\n**Block types**: fcb_normal, fcb_indjump, fcb_ret, fcb_cndret, fcb_noret, fcb_enoret, fcb_extern, fcb_error\n\n**Flow chart flags**: FC_NOEXT (no external blocks), FC_CALL_ENDS (calls end blocks), FC_NOPREDS (skip predecessors)\n\n**Chart generation**: CHART_GEN_DOT, CHART_GEN_GDL, CHART_WINGRAPH, CHART_NOLIBFUNCS\n\n## See Also\nFull docs: skill/docs/ida_gdl.rst\n\n<!-- File: skills/idapython/docs/ida_graph.md (Tokens: ~510 | Category: anthropic-skill) -->\n# ida_graph\n\nGraph view management - custom graph visualization and interaction (medium priority for typical reverse engineering).\n\n## Key Classes\n\n### GraphViewer\nPythonic class for creating custom graph views.\n- Override `OnRefresh()` - Populate graph nodes/edges\n- Override `OnGetText(node)` - Get node display text\n- Override `OnDblClick(node)` - Handle double-click\n- Override `OnClick(node)` - Handle single-click\n- `Show()` - Display graph viewer\n- `Close()` - Close graph viewer\n\n### interactive_graph_t\nLow-level interactive graph implementation (use GraphViewer instead for Python).\n\n### mutable_graph_t\nAbstract graph structure for manipulation.\n- `create_mutable_graph()` - Create new graph\n- `delete_mutable_graph(g)` - Delete graph\n\n## Key Functions\n\n### Graph Creation\n- `create_graph_viewer(title, gid, callback)` - Create graph viewer widget\n- `create_interactive_graph(title)` - Create interactive graph\n- `create_disasm_graph(ea)` - Create disassembly graph at address\n\n### Graph Manipulation\n- `get_node_info(graph, node)` - Get node display info (color, text, etc.)\n- `set_node_info(graph, node, info, flags)` - Set node properties\n- `del_node_info(graph, node)` - Delete node info\n- `viewer_set_node_info(viewer, node, info, flags)` - Set node info in viewer\n\n### Graph Navigation\n- `viewer_get_curnode(viewer)` - Get currently selected node\n- `viewer_center_on(viewer, node)` - Center view on node\n- `viewer_fit_window(viewer)` - Zoom to fit\n- `viewer_get_selection(viewer)` - Get selected items\n\n### Graph Groups\n- `viewer_create_groups(viewer, groups)` - Create node groups\n- `viewer_delete_groups(viewer, groups)` - Delete groups\n- `viewer_set_groups_visibility(viewer, groups, visible)` - Show/hide groups\n\n## Constants\n\n**Node info flags**: NIF_BG_COLOR, NIF_FRAME_COLOR, NIF_EA, NIF_TEXT, NIF_FLAGS, NIF_ALL\n\n**Layout types**: layout_digraph, layout_tree, layout_circle, layout_polar_tree, layout_orthogonal, layout_radial_tree\n\n**Graph item types**: git_none, git_edge, git_node, git_tool, git_text\n\n## See Also\nFull docs: skill/docs/ida_graph.rst\n\n<!-- File: skills/idapython/docs/ida_hexrays.md (Tokens: ~1696 | Category: anthropic-skill) -->\n# ida_hexrays\n\nHex-Rays decompiler - microcode and ctree (AST) representations. **Critical for decompilation work.**\n\n## Core Architecture\n\n**Two representations**:\n- **Microcode**: Low-level optimized IR (mba_t, mblock_t, minsn_t, mop_t)\n- **Ctree**: High-level AST-like C code (cfunc_t, cinsn_t, cexpr_t)\n\n## Key Functions\n\n### Decompilation\n- `decompile(ea, hf=None, flags=0)` - Decompile function at address, returns cfuncptr_t\n- `decompile_func(pfn, hf=None, flags=0)` - Decompile func_t object\n- `gen_microcode(mbr, hf=None, retlist=None, flags=0, reqmat=MMAT_GLBOPT3)` - Generate microcode only\n\n### Callbacks\n- `install_hexrays_callback(callback)` - Register event hook (hxe_maturity, hxe_print_func, etc.)\n\n## Ctree Classes (High-Level)\n\n### cfunc_t\nDecompiled function - the main result.\n- `body` - Root cinsn_t (function body)\n- `lvars` - List of local variables (lvar_t)\n- `mba` - Underlying microcode (mba_t)\n- `get_pseudocode()` - Get text as list of lines\n- `build_c_tree()` - Rebuild ctree from microcode\n- `verify(allow_cot_empty)` - Validate ctree integrity\n\n### cinsn_t\nC statement (if, for, while, return, expression, block, etc.).\n- `op` - Statement type (cit_block, cit_if, cit_for, cit_while, cit_return, etc.)\n- `ea` - Associated address\n- `cif`, `cfor`, `cwhile`, `creturn`, `cexpr` - Type-specific data unions\n- Access via: `insn.cif.expr` (if condition), `insn.cblock` (compound statement)\n\n### cexpr_t\nC expression (operators, variables, constants, calls, etc.).\n- `op` - Expression type (cot_var, cot_num, cot_call, cot_add, cot_cast, etc.)\n- `type` - Expression type info (tinfo_t)\n- `x`, `y`, `z` - Operands (for binary/ternary ops)\n- `n` - Number value (cnumber_t)\n- `v` - Variable reference (var_ref_t)\n- `obj_ea` - Global variable/function address\n- `print1()` - Format as text\n\n### citem_t\nBase class for cinsn_t and cexpr_t.\n- `ea` - Address\n- `op` - Opcode (ctype_t enum)\n- `contains_label()` - Has goto label\n\n## Microcode Classes (Low-Level)\n\n### mba_t\nMicrocode array - function as basic blocks.\n- `qty` - Number of blocks\n- `get_mblock(n)` - Get block by index\n- `natural` - Natural (entry) block array\n- `vars` - Local variables (lvars_t)\n- `maturity` - Optimization level (MMAT_ZERO to MMAT_LVARS)\n- `build_graph()` - Construct CFG\n- `optimize_local(blk)` - Optimize single block\n- `optimize_global()` - Global optimization pass\n\n### mblock_t\nBasic block in microcode.\n- `head`, `tail` - First/last instruction (minsn_t)\n- `start`, `end` - Address range\n- `type` - Block type (BLT_STOP, BLT_1WAY, BLT_2WAY, BLT_NWAY)\n- `nsucc()`, `npred()` - Successor/predecessor counts\n- `succ(n)`, `pred(n)` - Get nth successor/predecessor\n- `for_all_insns(visitor)` - Iterate instructions\n- `insert_into_block(ins, where)` - Add instruction\n\n### minsn_t\nMicrocode instruction.\n- `opcode` - Operation (m_mov, m_add, m_call, m_ldx, m_stx, etc.)\n- `l`, `r`, `d` - Left, right, destination operands (mop_t)\n- `ea` - Instruction address\n- `next`, `prev` - Linked list pointers\n- `is_assert()` - Check if assertion\n- `equal_mops(other)` - Compare operands\n- `for_all_ops(visitor)` - Iterate operands\n\n### mop_t\nMicrocode operand.\n- `t` - Operand type (mop_z=none, mop_r=register, mop_n=immediate, mop_S=stack, mop_v=global, mop_b=block, mop_f=case, mop_l=local var, mop_a=address, mop_h=helper, mop_str=string, mop_c=call, mop_fn=function, mop_p=pair, mop_sc=scattered)\n- `r` - Register number (if mop_r)\n- `nnn` - Immediate value (mnumber_t, if mop_n)\n- `g` - Global address (if mop_v)\n- `s` - Stack offset (stkvar_ref_t, if mop_S)\n- `l` - Local var reference (lvar_t, if mop_l)\n- `size` - Operand size in bytes\n- `is_reg(reg, size)` - Check if specific register\n- `is_const()` - Check if constant\n\n### lvar_t\nLocal variable (stack/register).\n- `name` - Variable name\n- `type` - Variable type (tinfo_t)\n- `location` - vdloc_t (register or stack location)\n- `defea` - Definition address\n- `width` - Size in bytes\n- `is_stk_var()`, `is_reg_var()` - Location checks\n- `set_lvar_type(tif)` - Change type\n\n## Key Event Types\n\n**Maturity levels** (microcode optimization stages):\n- MMAT_ZERO - Unoptimized\n- MMAT_GENERATED - After instruction generation\n- MMAT_PREOPTIMIZED - After pre-optimization\n- MMAT_LOCOPT - After local optimization\n- MMAT_CALLS - After call analysis\n- MMAT_GLBOPT1/2/3 - Global optimization passes\n- MMAT_LVARS - After local variable allocation\n\n**Callback events**:\n- hxe_maturity - Microcode maturity changed\n- hxe_print_func - About to print function\n- hxe_func_printed - Function printed\n- hxe_open_pseudocode - Pseudocode window opened\n- hxe_create_hint - Create hover hint\n\n## Common Patterns\n\n### Decompile and get text\n```python\ncfunc = ida_hexrays.decompile(ea)\nfor line in cfunc.get_pseudocode():\n    print(line.line)\n```\n\n### Modify variable name/type\n```python\ncfunc = ida_hexrays.decompile(ea)\nlvar = cfunc.lvars[0]\nlvar.name = \"new_name\"\nlvar.set_lvar_type(new_tinfo)\ncfunc.save_user_labels()\n```\n\n### Walk ctree\n```python\nclass visitor(ida_hexrays.ctree_visitor_t):\n    def visit_expr(self, e):\n        if e.op == ida_hexrays.cot_call:\n            print(f\"Call at {e.ea:#x}\")\n        return 0\n\ncfunc = ida_hexrays.decompile(ea)\nvisitor().apply_to(cfunc.body, None)\n```\n\n### Walk microcode\n```python\nmba = ida_hexrays.gen_microcode(...)\nfor blk in mba.natural:\n    ins = blk.head\n    while ins:\n        print(f\"{ins.ea:#x}: {ins.opcode}\")\n        ins = ins.next\n```\n\n## See Also\nFull docs: skill/docs/ida_hexrays.rst\n\n**External resources**:\n- https://hex-rays.com/blog/hex-rays-decompiler-primer\n- https://hex-rays.com/blog/microcode-in-pictures\n\n<!-- File: skills/idapython/docs/ida_ida.md (Tokens: ~802 | Category: anthropic-skill) -->\n# ida_ida\n\nDatabase-wide configuration via the `inf` structure - processor info, file type, address ranges, and analysis flags.\n\n## Key Functions\n\n### Database Properties\n- `inf_get_min_ea()`, `inf_set_min_ea(ea)` - Database address range start\n- `inf_get_max_ea()`, `inf_set_max_ea(ea)` - Database address range end\n- `inf_get_start_ea()`, `inf_set_start_ea(ea)` - Entry point address\n- `inf_get_baseaddr()`, `inf_set_baseaddr(ea)` - Image base address\n- `inf_get_main()`, `inf_set_main(ea)` - Main function address\n\n### Architecture Info\n- `inf_is_16bit()`, `inf_is_32bit_exactly()`, `inf_is_64bit()` - Architecture bit width\n- `inf_set_32bit(v)`, `inf_set_64bit(v)` - Set architecture\n- `inf_is_be()`, `inf_set_be(v)` - Big-endian check/set\n- `inf_is_dll()`, `inf_set_dll(v)` - DLL vs executable\n\n### File Information\n- `inf_get_procname()`, `inf_set_procname(name)` - Processor name (x86, ARM, etc.)\n- `inf_get_filetype()`, `inf_set_filetype(ft)` - File type (f_PE, f_ELF, f_MACHO, etc.)\n- `inf_get_md5()`, `inf_get_sha256()` - File hashes\n- `inf_get_input_file_path()` - Original input file path\n- `inf_get_imagebase()` - PE/ELF image base\n\n### Analysis Flags\n- `inf_get_af()`, `inf_set_af(flags)` - Get/set all analysis flags\n- `inf_get_af2()`, `inf_set_af2(flags)` - Secondary analysis flags\n- Analysis flag constants: AF_CODE, AF_JUMPTBL, AF_PROC, AF_LVAR, AF_TRACE, AF_FLIRT, etc.\n\n### Display Options\n- `inf_is_graph_view()`, `inf_set_graph_view(v)` - Default to graph vs text view\n- `inf_get_indent()`, `inf_set_indent(n)` - Disassembly indentation\n- `inf_get_margin()`, `inf_set_margin(n)` - Right margin\n\n### Database State\n- `inf_is_auto_enabled()`, `inf_set_auto_enabled(v)` - Auto-analysis state\n- `inf_readonly_idb()`, `inf_set_readonly_idb(v)` - Read-only mode\n- `inf_get_database_change_count()` - Change counter (for caching)\n\n### Compiler Info\n- `inf_get_cc_id()`, `inf_set_cc_id(id)` - Calling convention ID\n- `inf_get_cc_size_i()`, `inf_get_cc_size_l()` - sizeof(int), sizeof(long)\n- `inf_get_abibits()`, `inf_set_abibits(bits)` - ABI flags\n\n## Key Constants\n\n**File types**: f_PE, f_ELF, f_MACHO, f_BIN, f_COFF, f_OMF, f_AOUT, f_HEX\n\n**Analysis flags**: AF_CODE (create instructions), AF_JUMPTBL (analyze jump tables), AF_PROC (create functions), AF_LVAR (local variables), AF_FLIRT (apply FLIRT signatures)\n\n**Loader flags**: LFLG_64BIT, LFLG_IS_DLL, LFLG_PC_FLAT (flat memory model)\n\n**Name display**: NM_REL_OFF (show offsets), NM_EA (show addresses), NM_SHORT (short names)\n\n**Demangling**: DEMNAM_GCC3 (GCC v3 ABI), DEMNAM_CMNT (show in comments), DEMNAM_NAME (show as name)\n\n## See Also\nFull docs: skill/docs/ida_ida.rst\n\n<!-- File: skills/idapython/docs/ida_idaapi.md (Tokens: ~343 | Category: anthropic-skill) -->\n# ida_idaapi\n\nCore IDAPython infrastructure - plugin system, type definitions, and Python integration utilities.\n\n## Key Constants\n\n### Address Types\n- `ea_t` - Effective address type (int)\n- `BADADDR` - Invalid address sentinel\n- `BADADDR32` - 32-bit invalid address (0xFFFFFFFF)\n- `BADADDR64` - 64-bit invalid address (0xFFFFFFFFFFFFFFFF)\n\n### Plugin Return Codes\n- `PLUGIN_SKIP` - Plugin init failed, unload\n- `PLUGIN_OK` - Plugin loaded successfully\n- `PLUGIN_KEEP` - Keep plugin loaded\n\n## Key Functions\n\n- `require(modulename, package=None)` - Load or reload module (forces reload for development)\n- `notify_when(when, callback)` - Register event callbacks (NW_OPENIDB, NW_CLOSEIDB, etc.)\n- `as_cstr(s)` - Convert to C string\n- `as_uint32(v)`, `as_int32(v)`, `as_signed(v)` - Type conversions\n- `IDAPython_ExecScript(path)` - Execute Python script\n- `set_script_timeout(seconds)`, `disable_script_timeout()` - Script execution limits\n\n## Key Classes\n\n### plugin_t\nBase class for IDA plugins.\n- Override `init()`, `run()`, `term()` methods\n- Set `flags`, `comment`, `help`, `wanted_name`, `wanted_hotkey`\n\n### plugmod_t\nModern plugin module interface (IDA 7.2+).\n- Override `run(arg)` method\n- Supports multiple plugin instances\n\n## See Also\nFull docs: skill/docs/ida_idaapi.rst\n\n<!-- File: skills/idapython/docs/ida_idc.md (Tokens: ~107 | Category: anthropic-skill) -->\n# ida_idc\n\nMarked positions (bookmarks) in IDA database - low priority module with limited scope.\n\n## Key Functions\n\n- `mark_position(ea, lnnum, x, y, slot, comment)` - Create bookmark at address in slot (0-1023)\n- `get_marked_pos(slot)` - Get address of bookmark in slot\n- `get_mark_comment(slot)` - Get comment for bookmark in slot\n\n## See Also\nFull docs: skill/docs/ida_idc.rst\n\n<!-- File: skills/idapython/docs/ida_idd.md (Tokens: ~382 | Category: anthropic-skill) -->\n# ida_idd\n\nInterface to debugger modules - defines structures for target processor debugging and API.\n\n## Key Classes/Functions\n\n### debug_event_t\nDebug event information container\n- `eid()` - get event type (PROCESS_STARTED, BREAKPOINT, EXCEPTION, etc.)\n- `modinfo()` - module info for PROCESS_STARTED/LIB_LOADED\n- `exc()` - exception details for EXCEPTION events\n- `bpt()` - breakpoint addresses\n\n### debugger_t\nDebugger module interface\n- `get_debug_event(event, timeout_ms)` - wait for debug event\n- `resume(event)` - continue execution\n- `read_registers(tid, clsmask, values)` - read thread registers\n- `write_register(tid, regidx, value)` - write thread register\n- `read_memory(nbytes, ea, buffer, size)` - read process memory\n- `write_memory(nbytes, ea, buffer, size)` - write process memory\n- `update_bpts(nbpts, bpts, nadd, ndel)` - add/delete breakpoints\n\n### regval_t\nRegister value container\n- `set_int(x)` - set integer value\n- `set_float(v)` - set floating point\n- `pyval(dtype)` - get Python value\n\n### Python Helpers\n- `dbg_read_memory(ea, sz)` - read debuggee memory, returns bytes or None\n- `dbg_write_memory(ea, buffer)` - write bytes to debuggee\n- `dbg_get_registers()` - get register definitions\n- `dbg_get_memory_info()` - get memory layout\n\n## Event Types\n- PROCESS_STARTED, PROCESS_EXITED, PROCESS_ATTACHED, PROCESS_DETACHED\n- THREAD_STARTED, THREAD_EXITED\n- BREAKPOINT, STEP, EXCEPTION\n- LIB_LOADED, LIB_UNLOADED\n\n## See Also\nFull docs: skill/docs/ida_idd.rst\n\n<!-- File: skills/idapython/docs/ida_idp.md (Tokens: ~392 | Category: anthropic-skill) -->\n# ida_idp\n\nInterface to processor modules - defines target assembler and processor features.\n\n## Key Classes/Functions\n\n### Instruction Analysis\n- `is_call_insn(insn)` - is instruction a call?\n- `is_ret_insn(insn, flags)` - is instruction a return?\n- `is_indirect_jump_insn(insn)` - is instruction an indirect jump?\n- `is_basic_block_end(insn, call_stops_block)` - does instruction end a basic block?\n- `has_cf_chg(feature, opnum)` - does instruction modify operand?\n- `has_cf_use(feature, opnum)` - does instruction use operand value?\n\n### Processor Info\n- `get_ph()` - get processor_t structure\n- `get_ash()` - get assembler asm_t structure\n- `set_processor_type(processor_name, level)` - change processor module\n- `get_idp_name()` - get current processor name\n- `str2reg(regname)` - convert register name to index\n- `get_reg_name(regidx, width)` - get register name\n\n### processor_t\nGlobal processor structure (accessed via `ph`)\n- `ph.id` - processor ID (PLFM_386, PLFM_ARM, PLFM_MIPS, etc.)\n- `ph.flag` - processor flags (PR_SEGS, PR_USE32, PR_USE64, etc.)\n- `ph.cnbits` / `ph.dnbits` - code/data address bits\n- `ph_get_instruc()` - get instruction names\n\n### Instruction Features (CF_*)\n- CF_STOP - doesn't continue execution\n- CF_CALL - call instruction\n- CF_CHG1..CF_CHG8 - modifies operand 1-8\n- CF_USE1..CF_USE8 - uses operand 1-8\n- CF_JUMP - indirect jump/call\n\n## See Also\nFull docs: skill/docs/ida_idp.rst\n\n<!-- File: skills/idapython/docs/ida_ieee.md (Tokens: ~324 | Category: anthropic-skill) -->\n# ida_ieee\n\nIEEE floating point conversion utilities.\n\n## Key Classes/Functions\n\n### fpvalue_t\nIEEE floating point value representation (internal format)\n- `from_str(p)` - parse from string\n- `to_str(buf, bufsize, mode)` - convert to string\n- `from_sval(x)` / `to_sval(round)` - convert to/from signed integer\n- `from_int64(x)` / `to_int64(round)` - convert to/from 64-bit int\n- `from_uint64(x)` / `to_uint64(round)` - convert to/from unsigned 64-bit\n- `from_10bytes(fpval)` / `to_10bytes(fpval)` - 10-byte float conversions\n- `from_12bytes(fpval)` / `to_12bytes(fpval)` - 12-byte float conversions\n- `fadd(y)`, `fsub(y)`, `fmul(y)`, `fdiv(y)` - arithmetic operations\n- `eabs()`, `negate()` - absolute value and negation\n- `is_negative()` - check sign\n- `get_kind()` - get value kind (FPV_NORM, FPV_NAN, FPV_PINF, FPV_NINF)\n\n## Error Codes\n- REAL_ERROR_OK, REAL_ERROR_FORMAT, REAL_ERROR_RANGE\n- REAL_ERROR_BADDATA, REAL_ERROR_FPOVER, REAL_ERROR_BADSTR\n- REAL_ERROR_ZERODIV, REAL_ERROR_INTOVER\n\n## See Also\nFull docs: skill/docs/ida_ieee.rst\n\n<!-- File: skills/idapython/docs/ida_kernwin.md (Tokens: ~587 | Category: anthropic-skill) -->\n# ida_kernwin\n\nInterface between kernel and UI - dialogs, menus, choosers, custom viewers, and UI utilities.\n\n## Key Functions\n\n### User Interaction\n- `msg(fmt, ...)` - print to output window\n- `warning(fmt, ...)` / `error(fmt, ...)` - show warning/error dialog\n- `ask_yn(defval, fmt, ...)` - yes/no question\n- `ask_str(defval, hist, fmt, ...)` - string input\n- `ask_long(defval, fmt, ...)` - integer input\n- `ask_addr(defval, fmt, ...)` - address input\n- `ask_file(forsave, defval, fmt, ...)` - file chooser\n\n### Navigation\n- `jumpto(ea, opnum=-1, uijmp_flags=0)` - jump to address\n- `get_screen_ea()` - current cursor address\n- `read_selection()` - get selected address range\n- `choose_func(title)` - let user choose a function\n- `choose_name(ea, title)` - let user choose a name\n\n### UI Elements\n- `find_widget(title)` - find widget by title\n- `activate_widget(widget, take_focus)` - activate widget\n- `close_widget(widget, flags)` - close widget\n- `open_*_window(ea)` - open disasm/hex/exports/imports/etc window\n\n### Actions\n- `register_action(desc)` - register menu action\n- `unregister_action(name)` - unregister action\n- `attach_action_to_menu(path, name, flags)` - add action to menu\n- `attach_action_to_toolbar(toolbar, name)` - add to toolbar\n- `update_action_*()` - update action state/label/icon/etc\n\n### Choosers (Lists)\n- `Choose` class - create custom list windows\n- `choose_refresh()` - refresh chooser\n- `get_chooser_obj(title)` - get chooser Python object\n\n### Custom Viewers\n- `create_empty_widget(title)` - empty widget\n- `create_code_viewer(widget, custviewer, flags)` - code viewer\n- `simplecustviewer_t` - simple text viewer\n\n### Misc\n- `execute_sync(func, reqf)` - execute in UI thread\n- `refresh_idaview()` / `refresh_idaview_anyway()` - refresh disassembly\n- `beep(type)` - system beep\n- `get_highlight(viewer)` - get highlighted identifier\n- `set_highlight(viewer, text, flags)` - set highlight\n\n## Widget Types (BWN_*)\nDISASM, HEXVIEW, OUTPUT, FUNCS, NAMES, STRINGS, SEGS, IMPORTS, EXPORTS, PSEUDOCODE, etc.\n\n## See Also\nFull docs: skill/docs/ida_kernwin.rst\n\n<!-- File: skills/idapython/docs/ida_libfuncs.md (Tokens: ~284 | Category: anthropic-skill) -->\n# ida_libfuncs\n\nFLIRT signature library metadata and access.\n\n## Key Functions\n\n- `get_idasgn_header_by_short_name(out_header, name)` - get signature header by short name\n- `get_idasgn_path_by_short_name(name)` - get full path to signature file\n\n## idasgn_header_t\n\nSignature file header structure\n- `processor_id` - target processor\n- `file_formats` - supported file formats\n- `ostype` - OS type (OSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_UNIX, etc.)\n- `apptype` - application type (APPT_CONSOLE, APPT_GRAPHIC, APPT_LIBRARY, APPT_DRIVER, etc.)\n- `libname_length` - library name length\n- `number_of_modules` - module count\n- `ctype_name` - compiler type name\n\n## Constants\n\n### OS Types\nOSTYPE_MSDOS, OSTYPE_WIN, OSTYPE_OS2, OSTYPE_NETW, OSTYPE_UNIX, OSTYPE_OTHER\n\n### Application Types\n- APPT_CONSOLE, APPT_GRAPHIC, APPT_PROGRAM, APPT_LIBRARY, APPT_DRIVER\n- APPT_1THREAD, APPT_MTHREAD\n- APPT_16BIT, APPT_32BIT, APPT_64BIT\n\n## See Also\nFull docs: skill/docs/ida_libfuncs.rst\n\n<!-- File: skills/idapython/docs/ida_lines.md (Tokens: ~272 | Category: anthropic-skill) -->\n# ida_lines\n\nLine rendering and text generation for disassembly output.\n\n## Key Functions\n\n### Line Generation\n- `generate_disasm_line(ea, flags)` - generate disassembly line at ea\n- `generate_many_lines(ea, flags)` - generate multiple lines (includes function header, etc.)\n- `tag_remove(tagged_line)` - remove color tags from line\n- `tag_skipcode(p)` - skip color tag at position\n- `tag_advance(p, cnt)` - advance by cnt printable characters\n\n### Color Tags\n- `SCOLOR_*` constants - color tag markers (instructions, registers, comments, etc.)\n- Lines contain embedded color codes (e.g., `\\x01` for instruction color)\n\n### Line Prefix/Suffix\n- `gl_comm` / `set_gl_comm(start, end)` - comment delimiters\n- `inf_get_indent()` - get indentation amount\n\n## Common Use Cases\n\nGenerate colored disassembly:\n```python\nline = ida_lines.generate_disasm_line(ea, 0)\nplain = ida_lines.tag_remove(line)\n```\n\n## Low Priority\n\nThis module is mostly for display formatting. Core analysis uses ida_ua (instruction decoding) and ida_bytes (data access) instead.\n\n## See Also\nFull docs: skill/docs/ida_lines.rst\n\n<!-- File: skills/idapython/docs/ida_loader.md (Tokens: ~996 | Category: anthropic-skill) -->\n# ida_loader\n\nLoader and file operations - loading binaries, database management, file I/O, and plugin loading.\n\n## Key Functions\n\n### Database Operations\n- `save_database(outfile=None, flags=-1, root=None, attr=None)` - Save database with optional new filename\n- `flush_buffers()` - Flush buffers to disk\n- `is_trusted_idb()` - Check if database is trusted\n- `get_path(pt)` / `set_path(pt, path)` - Get/set file paths (PATH_TYPE_CMD, PATH_TYPE_IDB, PATH_TYPE_ID0)\n\n### File Loading\n- `load_binary_file(filename, li, neflags, fileoff, basepara, binoff, nbytes)` - Load binary into database\n- `file2base(li, pos, ea1, ea2, patchable)` - Load file portion into address range\n- `mem2base(mem, ea, fpos)` - Load from memory buffer\n- `reload_file(file, is_remote)` - Reload input file bytes without losing analysis\n- `base2file(fp, pos, ea1, ea2)` - Unload database to binary file\n\n### File Type Detection\n- `get_basic_file_type(li)` - Recognize file type (libraries, zip, etc.)\n- `get_file_type_name()` - Get current file type name (from idainfo.filetype)\n\n### Output Generation\n- `gen_file(otype, fp, ea1, ea2, flags)` - Generate output files (MAP, EXE, IDC, LST, ASM, DIF)\n- `gen_exe_file(fp)` - Generate executable file from database\n\n### File/Memory Mapping\n- `get_fileregion_offset(ea)` - Get file offset for linear address (returns -1 if unmapped)\n- `get_fileregion_ea(offset)` - Get linear address for file offset (returns BADADDR if not found)\n\n### Plugin Management\n- `load_plugin(name)` - Load plugin by name or path\n- `run_plugin(plg, arg)` - Run loaded plugin with argument\n- `load_and_run_plugin(name, arg)` - Load and run plugin in one call\n- `find_plugin(name, load_if_needed=False)` - Find plugin, optionally loading it\n- `get_plugin_options(plugin)` - Get -Oplugin:options from command line\n\n### Import/IDS\n- `set_import_ordinal(modnode, ea, ord)` - Set ordinal import entry info\n- `set_import_name(modnode, ea, name)` - Set named import entry info\n- `load_ids_module(fname)` - Load and apply IDS file\n\n### Archives\n- `process_archive(temp_file, li, module_name, neflags, defmember, loader)` - Process archive file\n- `extract_module_from_archive(fname, is_remote=False)` - Extract module from archive interactively\n\n### Snapshots\n- `build_snapshot_tree(root)` - Build snapshot tree structure\n\n## Key Classes\n\n### snapshot_t\nDatabase snapshot representation.\n- `id` - Snapshot ID (qtime64_t timestamp)\n- `flags` - Snapshot flags (SSF_AUTOMATIC, etc.)\n- `desc` - Description string (max 128 chars)\n- `filename` - Snapshot filename\n- `children` - Child snapshots\n\n### plugin_info_t\nPlugin metadata.\n- `path` - Full plugin path\n- `name` - Short name (appears in menu)\n- `hotkey` - Current hotkey\n- `flags` - Plugin flags\n- `comment` - Plugin comment\n\n### loader_t\nLoader module interface (low-priority: advanced loader development only).\n\n### idp_desc_t / idp_name_t\nProcessor module metadata (low-priority: processor module development).\n\n## Key Flags\n\n### Load Flags (NEF_*)\n- `NEF_FIRST` - First file loaded into database\n- `NEF_SEGS` - Create segments\n- `NEF_CODE` - Load as code segment\n- `NEF_RELOAD` - Reload at same place (don't recreate segments/fixups)\n- `NEF_FLAT` - Autocreate FLAT group (PE)\n\n### Database Flags (DBFL_*)\n- `DBFL_KILL` - Delete unpacked database\n- `DBFL_COMP` - Collect garbage\n- `DBFL_BAK` - Create backup file\n- `DBFL_TEMP` - Temporary database\n\n### Output File Types (OFILE_*)\n- `OFILE_MAP` - MAP file\n- `OFILE_EXE` - Executable\n- `OFILE_IDC` - IDC script\n- `OFILE_LST` - Disassembly listing\n- `OFILE_ASM` - Assembly\n- `OFILE_DIF` - Difference\n\n## See Also\nFull docs: skill/docs/ida_loader.rst\n\n<!-- File: skills/idapython/docs/ida_merge.md (Tokens: ~340 | Category: anthropic-skill) -->\n# ida_merge\n\nIDA Teams merge functionality - 3-way merging of IDB files (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for IDA Teams only. Handles merging of base_idb, local_idb, and remote_idb databases with conflict resolution.\n\n## Key Concepts\n\n- **base_idb**: Common ancestor database (middle pane in UI)\n- **local_idb**: Local database receiving merge result (left pane)\n- **remote_idb**: Remote database merging into local (right pane)\n\n## Merge Phases\nMerges occur in phases: global settings, segmentation, bytes, names, functions, types, debugger settings, etc.\n\n## Key Functions\n\n- `is_diff_merge_mode()` - Check if in merge/diff mode\n- `create_nodeval_merge_handler()` / `create_nodeval_merge_handlers()` - Create merge handlers for custom data\n- `destroy_moddata_merge_handlers()` - Destroy module data merge handlers\n- `get_ea_diffpos_name()` - Get name of EA difference position\n\n## Key Classes\n\n### merge_data_t\nMerge operation data container.\n\n### merge_handler_params_t\nParameters for creating merge handlers.\n\n### merge_node_helper_t / merge_node_info_t\nHelpers for merging netnode data.\n\n## Merge Kinds (MERGE_KIND_*)\nExtensive list including: NETNODE, INF, SEGMENTS, FUNC, FRAME, EXPORTS, IMPORTS, ENUMS, STRUCTS, TILS, TINFO, BYTEVAL, FLAGS, CREFS, DREFS, BPTS, DEBUGGER, etc.\n\n## See Also\nFull docs: skill/docs/ida_merge.rst\n\n<!-- File: skills/idapython/docs/ida_mergemod.md (Tokens: ~184 | Category: anthropic-skill) -->\n# ida_mergemod\n\nHelper functions for plugin/processor module merging in IDA Teams (not available in IDA Pro).\n\n## Overview\n\nLow-priority module for plugin/processor developers needing to merge custom module data. Used in response to `ev_create_merge_handlers` event.\n\n## Key Function\n\n- `create_std_modmerge_handlers(mhp, helper, merge_node_info=None)` - Create standard merge handlers for module data\n\n## Merge Sources Supported\n1. Data fields inside moddata (plugmod_t/procmod_t)\n2. Values in module netnode\n3. Values in arbitrary netnodes\n4. Data fields in auxiliary structures\n5. Indexed arrays in netnodes\n\n## See Also\nFull docs: skill/docs/ida_mergemod.rst\nExamples: plugins/mex1, plugins/mex2, plugins/mex3, plugins/ex_merge_ldrdata\n\n<!-- File: skills/idapython/docs/ida_moves.md (Tokens: ~768 | Category: anthropic-skill) -->\n# ida_moves\n\nNavigation history, bookmarks, and location tracking in IDA views.\n\n## Key Classes\n\n### lochist_entry_t\nLocation history entry combining place and renderer info.\n- `rinfo` - Renderer information (renderer_info_t)\n- `plce` - Place pointer (place_t*)\n- `place()` / `set_place(p)` - Get/set place\n- `is_valid()` - Check if entry is valid\n- `renderer_info()` - Get renderer info reference\n\n### navstack_entry_t\nNavigation stack entry extending lochist_entry_t.\n- `widget_id` - Widget identifier\n- `ud_str` - User-defined string\n- Inherits all lochist_entry_t members\n\n### navstack_t\nNavigation history stack (back/forward navigation).\n- `init(defpos, stream_name, flags)` - Initialize stack\n- `set_current(e, in_charge)` / `get_current(out, widget_id)` - Set/get current position\n- `stack_jump(try_to_unhide, e)` - Jump to entry\n- `stack_back(out, cnt, try_to_unhide)` / `stack_forward(out, cnt, try_to_unhide)` - Navigate backward/forward\n- `stack_nav(out, forward, cnt, try_to_unhide)` - Generic navigation\n- `stack_index()` / `stack_size()` - Get current index/size\n- `stack_clear(new_tip)` - Clear stack with new tip\n- `get_stack_entry(out, index)` / `set_stack_entry(index, e)` - Get/set entry at index\n- `is_history_enabled()` - Check if history is enabled\n\n### bookmarks_t\nBookmark management (static methods).\n- `mark(e, index, title, desc, ud)` - Create/update bookmark\n- `get(out, index, ud)` - Get bookmark entry\n- `get_desc(e, index, ud)` - Get bookmark description\n- `find_index(e, ud)` - Find bookmark index\n- `size(e, ud)` - Get bookmark count\n- `erase(e, index, ud)` - Delete bookmark\n- `get_dirtree_id(e, ud)` - Get dirtree ID for bookmark\n\n### renderer_info_t\nView renderer state (graph position, zoom, cursor).\n- `rtype` - Renderer type (tcc_renderer_type_t)\n- `gli` - Graph location info (graph_location_info_t)\n- `pos` - Position info (renderer_info_pos_t)\n\n### graph_location_info_t\nGraph view location and zoom state.\n- `zoom` - Zoom level\n- `orgx` / `orgy` - Origin coordinates\n\n### segm_move_info_t / segm_move_infos_t\nSegment relocation tracking (for when segments move).\n- `to` - Target address\n- `size` - Size moved\n- `find(ea)` - Find move info for address\n\n## Constants\n\n### Location State Flags (LSEF_*)\n- `LSEF_PLACE` - Place component\n- `LSEF_RINFO` - Renderer info component\n- `LSEF_PTYPE` - Place type component\n- `LSEF_ALL` - All components\n\n### Unhide Flags (UNHID_*)\n- `UNHID_SEGM` - Unhid segment at target\n- `UNHID_FUNC` - Unhid function at target\n- `UNHID_RANGE` - Unhid range at target\n\n### Other Constants\n- `MAX_MARK_SLOT` - Maximum bookmark slot number\n- `LHF_HISTORY_DISABLED` - History disabled flag\n- `DEFAULT_CURSOR_Y` / `DEFAULT_LNNUM` - Default cursor position\n\n## See Also\nFull docs: skill/docs/ida_moves.rst\n\n<!-- File: skills/idapython/docs/ida_nalt.md (Tokens: ~2955 | Category: anthropic-skill) -->\n# ida_nalt\n\nNetnode-based storage for various analysis information - switch tables, references, types, strings, imports, metadata.\n\n## Key Functions\n\n### Netnode Access\n- `ea2node(ea)` / `node2ea(node)` - Convert between addresses and netnodes\n- `end_ea2node(ea, size)` - Get netnode for address range end\n- `getnode(ea)` - Get netnode for address\n\n### Address Flags (AFL_*)\nExtensive flag system for tracking analysis state at addresses.\n\n#### Query Flags\n- `get_aflags(ea)` / `set_aflags(ea, flags)` / `del_aflags(ea)` - Get/set/delete flags\n- `upd_abits(ea, set, clr)` / `set_abits(ea, bits)` / `clr_abits(ea, bits)` - Update address bits\n- `is_hidden_item(ea)` / `hide_item(ea)` / `unhide_item(ea)` - Item visibility\n- `is_hidden_border(ea)` / `hide_border(ea)` / `unhide_border(ea)` - Border visibility\n- `is_colored_item(ea)` / `set_colored_item(ea)` / `clr_colored_item(ea)` - Colored items\n- `is_usersp(ea)` / `set_usersp(ea)` / `clr_usersp(ea)` - User stack pointer\n- `uses_modsp(ea)` / `set_usemodsp(ea)` / `clr_usemodsp(ea)` - Modified stack pointer\n- `is_libitem(ea)` / `set_libitem(ea)` / `clr_libitem(ea)` - Library item\n- `is_noret(ea)` / `set_noret(ea)` / `clr_noret(ea)` - No-return function\n- `is_notcode(ea)` / `set_notcode(ea)` / `clr_notcode(ea)` - Not code\n- `is_notproc(ea)` / `set_notproc(ea)` / `clr_notproc(ea)` - Not procedure\n- `is_type_guessed_by_ida(ea)` / `set_type_guessed_by_ida(ea)` - IDA type guess\n- `is_func_guessed_by_hexrays(ea)` / `set_func_guessed_by_hexrays(ea)` - Hex-Rays function guess\n- `is_data_guessed_by_hexrays(ea)` / `set_data_guessed_by_hexrays(ea)` - Hex-Rays data guess\n- `is_type_determined_by_hexrays(ea)` / `set_type_determined_by_hexrays(ea)` - Hex-Rays type determination\n\n### Type Information\n- `get_tinfo(tif, ea)` / `set_tinfo(ea, tif)` / `del_tinfo(ea)` - Address type info\n- `get_op_tinfo(tif, ea, opnum)` / `set_op_tinfo(ea, opnum, tif)` / `del_op_tinfo(ea, opnum)` - Operand type info\n- `has_ti(ea)` / `has_ti0(ea)` / `has_ti1(ea)` - Check if type info exists\n\n### String Types\n- `get_str_type(ea)` / `set_str_type(ea, strtype)` / `del_str_type(ea)` - String type at address\n- `get_str_type_code(strtype)` - Get string type code\n- `get_str_term1(strtype)` / `get_str_term2(strtype)` - String terminators\n- `get_str_encoding_idx(ea)` / `set_str_encoding_idx(ea, idx)` - String encoding\n- `make_str_type(base, lyt)` - Construct string type code\n- `is_pascal(strtype)` - Check if Pascal string\n- `get_str_type_prefix_length(strtype)` - Get prefix length\n\n### References and Offsets\n- `get_refinfo(ri, ea, opnum)` / `set_refinfo(ea, opnum, type, target, base, tdelta)` / `del_refinfo(ea, opnum)` - Reference info\n- `set_refinfo_ex(ea, opnum, ri)` - Set reference info with refinfo_t\n- `get_custom_refinfo(out, cfmt)` / `find_custom_refinfo(cfmt)` - Custom reference formats\n- `get_reftype_by_size(size)` - Get reference type by size\n- `is_reftype_target_optional(rt)` - Check if target is optional\n\n### Switch Tables\n- `get_switch_info(si, ea)` / `set_switch_info(ea, si)` / `del_switch_info(ea)` - Switch info\n- `get_switch_parent(ea)` / `set_switch_parent(ea, parent)` / `del_switch_parent(ea)` - Switch parent\n\n### Arrays\n- `get_array_parameters(out, ea)` / `set_array_parameters(ea, params)` / `del_array_parameters(ea)` - Array display parameters\n\n### Custom Data Types\n- `get_custom_data_type_ids(out, ea)` / `set_custom_data_type_ids(ea, ids)` / `del_custom_data_type_ids(ea)` - Custom data types\n\n### Colors and Alignment\n- `get_item_color(ea)` / `set_item_color(ea, color)` / `del_item_color(ea)` - Item color\n- `get_alignment(ea)` / `set_alignment(ea, align)` / `del_alignment(ea)` - Alignment\n\n### Source Line Numbers\n- `get_source_linnum(ea)` / `set_source_linnum(ea, lnnum)` / `del_source_linnum(ea)` - Source line mapping\n\n### Absolute Base\n- `get_absbase(ea)` / `set_absbase(ea, base)` / `del_absbase(ea)` - Absolute segment base\n\n### File Metadata\n- `get_root_filename()` / `set_root_filename(path)` - Input file root name\n- `get_input_file_path()` - Input file full path\n- `dbg_get_input_path()` - Debugger input path\n- `retrieve_input_file_size()` - File size\n- `retrieve_input_file_crc32()` / `retrieve_input_file_md5()` / `retrieve_input_file_sha256()` - File hashes\n- `get_archive_path()` / `set_archive_path(path)` - Archive path\n- `get_loader_format_name()` / `set_loader_format_name(name)` - Loader format\n\n### IDB Version and Timing\n- `get_initial_ida_version()` / `get_initial_idb_version()` - IDA/IDB versions\n- `get_idb_ctime()` - IDB creation time\n- `get_elapsed_secs()` - Analysis elapsed time\n- `get_idb_nopens()` - IDB open count\n\n### Image Base\n- `get_imagebase()` / `set_imagebase(base)` - Image base address\n\n### String Encodings\n- `get_encoding_qty()` - Number of encodings\n- `get_encoding_name(idx)` - Encoding name\n- `add_encoding(name, bpu)` / `del_encoding(idx)` / `rename_encoding(idx, name)` - Manage encodings\n- `get_encoding_bpu(idx)` / `get_encoding_bpu_by_name(name)` - Bytes per unit\n- `get_strtype_bpu(strtype)` - String type bytes per unit\n- `get_default_encoding_idx()` / `set_default_encoding_idx(idx)` - Default encoding\n- `get_outfile_encoding_idx()` / `set_outfile_encoding_idx(idx)` - Output file encoding\n- `encoding_from_strtype(strtype)` - Get encoding from string type\n\n### Imports\n- `get_import_module_qty()` - Number of import modules\n- `get_import_module_name(idx)` - Import module name\n- `enum_import_names(idx, callback)` - Enumerate imports\n- `delete_imports()` - Delete all imports\n\n### GOT/PLT\n- `get_gotea()` / `set_gotea(ea)` - Global Offset Table address\n\n### Notepad\n- `get_ida_notepad_text()` / `set_ida_notepad_text(text)` - IDA notepad text\n\n### Source Debug Paths\n- `get_srcdbg_paths()` / `set_srcdbg_paths(paths)` - Source debug paths\n- `get_srcdbg_undesired_paths()` / `set_srcdbg_undesired_paths(paths)` - Undesired debug paths\n\n### Assembly Include\n- `get_asm_inc_file()` / `set_asm_inc_file(file)` - Assembly include file\n\n### IDS Modules\n- `get_ids_modnode()` / `set_ids_modnode(node)` - IDS module netnode\n\n### ABI\n- `get_abi_name()` - ABI name\n\n## Key Classes\n\n### switch_info_t\nSwitch statement information.\n- `flags` - Switch flags (SWI_*)\n- `ncases` - Number of cases (excluding default)\n- `jumps` - Jump table start address\n- `values` - Values table address (if SWI_SPARSE)\n- `lowcase` - Lowest case value\n- `defjump` - Default jump address (BADADDR if none)\n- `startea` - Start of switch idiom\n- `jcases` - Jump table entries (if SWI_INDIRECT)\n- `elbase` - Element base\n- `regnum` / `regdtype` - Switch expression register\n- `get_jtable_size()` / `set_jtable_size(size)` - Jump table size\n- `get_jtable_element_size()` / `set_jtable_element_size(size)` - Element size\n- `has_default()` / `is_sparse()` / `is_custom()` / `is_indirect()` / `is_subtract()` - Query flags\n\n### refinfo_t\nReference/offset information.\n- `target` - Reference target (BADADDR if none)\n- `base` - Base of reference (may be BADADDR)\n- `tdelta` - Offset from target\n- `flags` - Reference flags (REFINFO_*)\n- `type()` / `set_type(rt)` - Reference type (REF_OFF16, REF_OFF32, REF_OFF64, etc.)\n- `is_target_optional()` / `no_base_xref()` / `is_pastend()` / `is_rvaoff()` / `is_custom()` / `is_subtract()` / `is_signed()` - Query flags\n- `init()` - Initialize\n\n### array_parameters_t\nArray display parameters.\n- `flags` - Array flags (AP_*)\n- `lineitems` - Items per line\n- `alignment` - Item alignment (-1=don't align, 0=auto, else width)\n- `is_default()` - Check if default\n\n### opinfo_t\nOperand type information union (structure/enum/strpath/custom).\n\n### strpath_t\nStructure path for nested structure member offsets.\n\n### enum_const_t\nEnumeration constant reference.\n\n## Key Constants\n\n### String Types (STRTYPE_*)\n- `STRTYPE_TERMCHR` / `STRTYPE_C` / `STRTYPE_C_16` / `STRTYPE_C_32` - C strings\n- `STRTYPE_PASCAL` / `STRTYPE_PASCAL_16` / `STRTYPE_PASCAL_32` - Pascal strings\n- `STRTYPE_LEN2` / `STRTYPE_LEN2_16` / `STRTYPE_LEN2_32` - 2-byte length prefix\n- `STRTYPE_LEN4` / `STRTYPE_LEN4_16` / `STRTYPE_LEN4_32` - 4-byte length prefix\n\n### String Layout (STRLYT_*)\n- `STRLYT_TERMCHR` / `STRLYT_PASCAL1` / `STRLYT_PASCAL2` / `STRLYT_PASCAL4` - Layout types\n\n### String Width (STRWIDTH_*)\n- `STRWIDTH_1B` / `STRWIDTH_2B` / `STRWIDTH_4B` - Character width\n\n### Reference Types (REF_*)\n- `REF_OFF16` / `REF_OFF32` / `REF_OFF64` - Full offsets\n- `REF_LOW8` / `REF_LOW16` / `REF_HIGH8` / `REF_HIGH16` - Partial offsets\n\n### Reference Info Flags (REFINFO_*)\n- `REFINFO_RVAOFF` - RVA offset\n- `REFINFO_PASTEND` - Past end of segment\n- `REFINFO_CUSTOM` - Custom format\n- `REFINFO_NOBASE` - No base\n- `REFINFO_SUBTRACT` - Subtract instead of add\n- `REFINFO_SIGNEDOP` - Signed operand\n\n### Switch Info Flags (SWI_*)\n- `SWI_SPARSE` - Sparse switch (has values table)\n- `SWI_V32` / `SWI_J32` - 32-bit values/jumps\n- `SWI_USER` - User-defined\n- `SWI_CUSTOM` - Custom switch\n- `SWI_INDIRECT` - Indirect jump table\n\n### Address Flags (AFL_*)\nExtensive flag set including: AFL_LINNUM, AFL_USERSP, AFL_PUBNAM, AFL_WEAKNAM, AFL_HIDDEN, AFL_MANUAL, AFL_NOBRD, AFL_ZSTROFF, AFL_LIB, AFL_TI, AFL_COLORED, AFL_NORET, AFL_FIXEDSPD, AFL_ALIGNFLOW, AFL_USERTI, AFL_RETFP, AFL_USEMODSP, AFL_NOTCODE, AFL_NOTPROC, and type guessing flags.\n\n### Root Info Indices (RIDX_*)\nDatabase-level metadata keys: RIDX_FILE_FORMAT_NAME, RIDX_MD5, RIDX_SHA256, RIDX_IDA_VERSION, RIDX_STR_ENCODINGS, RIDX_SRCDBG_PATHS, RIDX_DBG_BINPATHS, RIDX_ABINAME, RIDX_ARCHIVE_PATH, RIDX_PROBLEMS, etc.\n\n## See Also\nFull docs: skill/docs/ida_nalt.rst\n\n<!-- ... +28 more modular skills available via /api/skills/mrexodia/ida-pro-mcp?path={path} -->\n</yakaai_skills>"}