Individual skill

reverse-eng-ida

Deep reverse engineering in IDA Pro — Hex-Rays decompile, cross-references, types, patching — via the GUI or the ida-pro-mcp bridge for agent-driven analysis. Load when a PE/ELF/Mach-O/DLL/SYS needs pseudocode-grade analysis: license/serial checks, crypto or protocol recovery, a sink found during triage, malware capability mapping. Signals: "decompile this exe/dll", IDA, Hex-Rays, idapro_* tools, port 13337, .i64/.idb database, idalib.

skills/reverse-engineering/reverse-eng-ida/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: No
Observed behavior: Not checked yet
Last checked: Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 27
Repository last updated: Oct 14, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
ai-security Repository topic
application-security Repository topic
blue-team Repository topic
bug-bounty Repository topic
claude-code Repository topic
codex Repository topic
detection-engineering Repository topic
gemini Repository topic
engineering Derived category
data Derived category
data-databases Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 5,463 bytes
SKILL.mdcore · 5,463 bytes
cheatsheet.mddoc · 4,678 bytes

Read excerpt


# IDA Pro deep analysis

## When it applies
You have an in-scope binary (confirmed in `scope.txt`, a client-owned thick client/service, or a sample
you own — see `tradecraft-scope-roe`) and cheap triage (`reverse-eng-binary-triage`) has surfaced
functions worth real decompilation: auth/license logic, custom crypto or protocol parsers, a suspected
vulnerable sink, or a malware sample whose capabilities you must map. Use `reverse-eng-radare2` for
fast CLI recon first; use `reverse-eng-ghidra` when there's no IDA license.

## Why it works
Hex-Rays recovers near-source pseudocode, and IDA's cross-reference database ties every string,
import, and data item to the code that touches it — so you navigate by *who uses this* instead of
reading linearly. Renaming and retyping as you go compounds: each good name makes the next function
cheaper to read.