✨ Features

• 🗄️ Stateless — pass -d/--db <PATH> (a binary or an .i64); no daemon, no session bookkeeping.
• 💾 Persistent IDB state — the IDB file is the state: comments, bookmarks, names and analysis survive across processes.
• 🧩 Full IDALib coverage — segments, functions, CFG, disassembly, Hex-Rays decompilation, strings, names, xrefs, entries, metadata, comments, bookmarks, FLIRT signatures.
• ⚡ batch & parallel — run many commands with one IDB open; fan a command out to many databases concurrently (glob supported).
• 🤖 Agent-first — one JSON document on stdout, errors on stderr; skills included for Codex / Claude Code / OpenCode.

🚀 Install

Prerequisites: IDA Pro 9.1 (licensed, launched once) · IDA 9.1 SDK unpacked (build time only) · Rust + LLVM/Clang (bindgen requirements)

export IDADIR="/Applications/IDA Professional 9.1.app/Contents/MacOS"  # IDA install dir
export IDASDKDIR=/path/to/idasdk91                                     # unpacked SDK (absolute path!)

git clone <this-repo> && cd idalib-cli
cargo install --path .

idalib-cli info    # ✅ verify tool version, IDA version, license

The SDK is needed at build time only; the binary links your local IDA libraries at runtime. Dev checks without an SDK: cargo test --no-default-features --features stub-idalib.

🎮 Commands & usage

Every command needs -d/--db <PATH> — an IDB file (.i64) or a binary (an IDB is created next to it on first use). Addresses accept 0x401000 or 401000. Output is always one JSON document; errors go to stderr with a non-zero exit code.

Database

Query

Edit (persisted in the IDB)

Combine

Scenario walkthroughs

🔎 Triage an unknown binary

idalib-cli -d ./sample meta            # what is it? (filetype/compiler/bitness)
idalib-cli -d ./sample segments        # memory layout
idalib-cli -d ./sample strings         # quick hints
idalib-cli -d ./sample functions -u    # user code only

🔍 Dig into a function

idalib-cli -d ./sample function -a 0x401000       # CFG + blocks + xrefs
idalib-cli -d ./sample decompile -a 0x401000      # read the pseudo-code
idalib-cli -d ./sample disasm -a 0x401000 -n 20   # or the raw instructions
idalib-cli -d ./sample xrefs -a 0x401000 --all    # who calls it

📝 Annotate findings (survives across processes/agents)

idalib-cli -d ./sample comments set -a 0x401000 -c "parses config, see 0x402100"
idalib-cli -d ./sample bookmarks add -a 0x401000 -d "entry point"
idalib-cli -d ./sample comments get -a 0x401000    # verify

⚡ Bulk analysis of many samples

# first pass: create IDBs + overview for every sample
idalib-cli parallel -d "./samples/*.bin" -- "batch -- meta functions -u"

# deep pass: decompile one hot function in every IDB
idalib-cli parallel -d "./samples/*.i64" --jobs 8 -- "decompile -a 0x401000"

🔎 Search & inspect raw data

idalib-cli -d ./sample find --text "MAGIC"            # string hits
idalib-cli -d ./sample find --imm 0x1337              # immediate-value hits
idalib-cli -d ./sample find --pattern 554889e5        # byte pattern (prologue)
idalib-cli -d ./sample bytes -a 0x401000 -n 32        # hexdump
idalib-cli -d ./sample bytes -a 0x401000 --width qword -n 4
idalib-cli -d ./sample xrefs -a 0x401000 --from       # outgoing refs (calls)
idalib-cli -d ./sample rename -a 0x401000 -n decrypt  # label it
idalib-cli -d ./sample set-type -a 0x401000 -t "int f(const char *, int);"  # set prototype

🤖 Agent-friendly batched inspection (one JSON doc)

idalib-cli -d ./sample batch -- "meta" "segments" "functions -u" "decompile -a 0x401000"

Agent workflow guide: skills/idalib-cli/SKILL.md; a runnable end-to-end example in examples/workflow.sh.

{
  "id": 7,
  "start": "0x401000",
  "end": "0x401080",
  "size": 128,
  "name": "main",
  "blocks": 3,
  "decompiled": true,
  "pseudocode": "int __cdecl main(...) { ... }"
}

⚙️ Configuration

Optional ~/.idapro/idalib-cli/config.toml (base dir: $IDALIB_CLI_HOME):

❓ FAQ