Idalib CLI

idalib-cli

Agent-first CLI for the IDA Pro IDALib. Stateless: every command takes -d/--db <PATH> — an IDB file (.i64) or a binary (an IDB is created next to it on first use). All state lives in the IDB file; every command prints one JSON document on stdout (errors on stderr, non-zero exit).

When to use

Reverse-engineering, triage, or deep inspection of any binary; decompiling functions; finding xrefs/strings; annotating an IDB; bulk-analysing many samples concurrently.

Core model

idalib-cli -d <bin-or-i64> <command> [args]   # → one JSON document

• Pass a binary → IDB auto-created next to it (<bin>.i64), then opened.
• Pass an .i64 → reopened directly, all prior state intact.
• Omitted -a <ea> addresses accept 0x401000 or 401000.

Setup check (once per environment)

idalib-cli info        # → { idalib_cli, idalib_rs, ida_version, license, ... }

If it errors, the tool isn't built/installed — see the repo README (needs IDADIR + absolute IDASDKDIR, then cargo install --path .).

Command map

Recommended workflow

1. Triage — what is this thing?

idalib-cli -d ./sample meta
idalib-cli -d ./sample segments
idalib-cli -d ./sample strings
idalib-cli -d ./sample functions -u        # user code only

2. Focus — read the interesting parts.

idalib-cli -d ./sample decompile -a 0x401000     # pseudo-code (best readability)
idalib-cli -d ./sample function -a 0x401000      # CFG + blocks + xrefs
idalib-cli -d ./sample disasm -a 0x401000 -n 20  # raw instructions

3. Follow the data — who references what / what does it reference?

idalib-cli -d ./sample xrefs -a 0x401000 --all        # incoming
idalib-cli -d ./sample xrefs -a 0x401000 --from --all # outgoing (calls)
idalib-cli -d ./sample find --text "MAGIC"            # locate a string
idalib-cli -d ./sample find --imm 0x1337              # locate a magic constant
idalib-cli -d ./sample bytes -a 0x401000 -n 32        # raw bytes

4. Name & annotate — persist findings for future turns/agents.

idalib-cli -d ./sample rename -a 0x401000 -n parse_config
idalib-cli -d ./sample set-type -a 0x401000 -t "int parse_config(const char *);"
idalib-cli -d ./sample comments set -a 0x401000 -c "parses config, see 0x402100"
idalib-cli -d ./sample bookmarks add -a 0x401000 -d "entry point"

Batch & parallel (efficiency)

• batch — several facts about one binary, IDB opened once:

  idalib-cli -d ./sample batch -- "meta" "segments" "decompile -a 0x401000"
  

• parallel — one op across many binaries, one subprocess each (IDALib is not thread-safe; isolation is by process):

  idalib-cli parallel -d "./samples/*.i64" --jobs 8 -- "functions -u"
  idalib-cli parallel -d "./a.i64,./b.i64" -- "decompile -a 0x401000"
  

• Compose them for bulk work:

  idalib-cli parallel -d "./samples/*.bin" -- "batch -- meta functions -u"
  

Tips for agents

• JSON contract: parse stdout; treat error: ... on stderr as failure.
• Prefer batch over several separate invocations — it avoids reopening the IDB repeatedly (large IDBs cost seconds per open).
• decompile needs the Hex-Rays decompiler; without it the command fails cleanly — fall back to disasm + function.
• Only one process may use an IDB at a time. parallel respects this; for manual multi-agent work, give each agent its own -d target.
• Annotate as you go — comments/bookmarks persist in the IDB and are visible to later turns and other agents.
• Statelessness means "session" = the IDB path. To resume earlier work, just pass the same -d path again.