# Ida Re Triage

> Use when triaging an authorized binary/driver/firmware/dump/IDB for RE or vuln research.

- Skill: `netvar1337/ida-re-triage` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add netvar1337/ida-re-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/ida-re-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- License: MIT
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/ida-re-triage

---


> Bundled with Unleash skills pack. Source: C:\Users\Admin\.agents\skills\ida-re-triage\SKILL.md

# IDA RE Triage

Start static, preserve evidence, and make analysis changes only when requested.

1. Confirm target, architecture, scope, and a working-copy location. Record SHA-256, file size, architecture, load base, and tool version.
2. If no IDB is active, open the working copy in IDA and wait for auto-analysis before using `idassistmcp`. Use the configured `idassistmcp` only after it responds.
3. Read first: binary metadata, segments, imports, exports, entry points, strings, functions, code, and xrefs. State addresses and evidence in findings.
4. For Windows drivers, trace `DriverEntry`, `DriverObject->MajorFunction`, device creation, and IOCTL dispatch. Treat `METHOD_NEITHER`, `FILE_ANY_ACCESS`, unchecked lengths, arbitrary pointer use, and privileged hardware/process operations as leads to verify, not conclusions.
5. Do not call IDA mutating tools (`patch_bytes`, rename, comments, types, variables, data creation, bookmarks) unless the user explicitly asks. Do not execute the target, attach to a live process, or perform write/allocate/free operations on the target unless explicitly requested.
6. Finish with a concise evidence table: finding, address, data flow, confidence, and next static check. Keep copied inputs and IDBs local to the working area.