idasql

IDASQL

Give any AI agent the ability to understand compiled binaries.

IDASQL is a SQL interface for IDA Pro databases, created by Elias Bachaalany. It exposes 30+ virtual tables covering functions, cross-references, strings, types, imports, disassembly, and decompilation. Use /idasql skills from your coding agent to work fully headlessly -- the agent runs IDA in the background for you -- or open IDA's UI and collaborate with your coding agent to reverse engineer together. No IDAPython. No scripting. Just SQL.

Why SQL? SQL is the universal query language that every AI agent already speaks. IDASQL is agent-agnostic: Claude, ChatGPT, Copilot, Cursor, custom agents, or no agent at all. Any tool that can issue a SQL query can analyze a binary.

• No indexing required. IDA already has everything indexed. Queries run instantly against the live database.
• No scripting needed. 30+ SQL tables replace hundreds of lines of IDAPython.
• Headless, GUI, or both. Run fully headlessly, inside IDA's UI, or connect multiple databases simultaneously.
• Read and write. IDASQL is not just a query tool. It allows reading and writing the most important aspects of an IDA database: decompilation comments, type recovery, type application (structure and union offsets), detecting type casts, and automatically guessing and updating the correct prototype.

IDASQL supports analyzing, cross-referencing, and transferring annotations between one or more databases at the same time. What you can do is limited only by your imagination and the power of the model you use.

How It Works

IDA Pro already has its own database format describing functions, strings, cross-references, types, and more. IDASQL maps these internal structures to live SQL virtual tables. There is no separate exporting or indexing step -- queries execute directly against IDA's database and changes are reflected live.

Mode	How to start	Best for
Standalone CLI	idasql -s binary.i64 -i	Direct SQL, scripting, pipelines
IDA Plugin	Select idasql from IDA's CLI dropdown	SQL inside the GUI, live database
Skill Workflow	/idasql:connect in your coding CLI	AI-driven analysis -- the agent issues SQL queries autonomously

You / Agent  -->  Natural language or SQL
                        |
                  /idasql skills (LLM translates intent to SQL)
                        |
                     IDASQL  -->  IDA database(s)
                        |
                     Results  -->  LLM summarizes & reasons

…

One command. Instant results. No scripting required.

Quick Start

After installing the IDASQL CLI and plugin, start your favorite coding agent and begin reverse engineering by prompting. IDASQL runs fully headlessly -- your agent orchestrates IDA Pro: starting, analyzing, decompiling, annotating, saving -- or hosted inside the IDA GUI where you collaborate with your agent in real time.

Getting Started

Open your favorite coding agent (e.g. Claude Code) and type:

/idasql:connect Please open sample_malware.exe in the background and let's analyze it together.

The agent starts IDASQL headlessly in the background. From this point on, chat naturally with the database. For instance:

/idasql:annotations Fully annotate the function I'm looking at, also use the decompiler skill.

The model autonomously reasons about the best approach to understand the function, fully reverse engineers it, and annotates it.

When you're done, ask the agent to save and shut down:

/idasql:connect Please save all databases and shut down IDASQL.

Working with Multiple Databases

You can work with two or more databases simultaneously. Prompt your agent:

/idasql:connect In this folder, there are many *.exe files. Please use parallel agents to open IDASQL in the background and report how many functions each has.

Then follow up:

Tell me, how many strings all these databases have in common?

The agent works with all databases at the same time. You can cross-reference, compare, and transfer annotations between them.

Working with IDA UI

Everything above works equally from the IDA GUI. To engage your agent with an open IDA session:

1. In IDA's idasql> prompt, type:

   .http start
   

2. IDA outputs:

   IDASQL HTTP server: http://127.0.0.1:8174
   

3. In your coding agent:

   /idasql:connect Let's work with this database: http://127.0.0.1:8174
   

Now IDASQL and your IDA UI are connected and working together.

Installation

Coding Agent Plugins

IDASQL skills give your coding agent full control over IDA databases through natural language.

• Claude Code -- full plugin with 15 topic-focused skills, installed from the allthingsida/idasql-skills marketplace.
• GitHub Copilot CLI -- also supports IDASQL skills via the same plugin.
• Codex (OpenAI) -- supports skills via the same plugin packaging. See the idasql-skills repo for the Codex install steps.

Prerequisites

1. IDA Pro installed with its directory in your PATH (ida.exe on Windows, ida on macOS/Linux)
2. idasql downloaded from Releases and placed next to the IDA binary
3. Verify setup: idasql --version should work from command line

Install (Claude Code)

Inside Claude Code, run:

/plugin marketplace add allthingsida/idasql-skills

then install the idasql plugin from that marketplace. See the idasql-skills README for Codex and other install paths.

Skills

Skill	Description
connect	Connect to IDA databases: CLI, HTTP server, session bootstrap, skill routing, global contracts.
disassembly	Query IDA disassembly: functions, segments, instructions, blocks, operands, graphs.
data	Query IDA strings, bytes, and binary data: search, rebuild, byte patterns.
xrefs	Analyze IDA cross-references: callers, callees, imports, data refs, grep search.
decompiler	Decompile IDA functions: pseudocode, ctree AST, local variables, labels.
annotations	Edit IDA databases: comments, renames, types, bookmarks, enum/struct rendering.
types	IDA type system: create/modify/apply structs, unions, enums, typedefs, parse_decls.
debugger	IDA debugger: breakpoints, byte patching, conditions, patch inventory.
storage	Persistent key-value storage in IDA databases via netnode_kv.
idapython	Execute IDAPython via idasql: snippets, sandbox, output capture.
functions	Complete idasql SQL function reference catalog.
analysis	Analyze IDA binaries: triage, security audit, crypto/network detection, multi-table queries.
resource	Re-source IDA binaries: recursive annotation, structure recovery, type reconstruction.
ui-context	Capture live IDA UI context: screen, selection, widget focus, address anchors.

Example Prompts

/idasql:analysis analyze this binary; tell me the most called functions.
/idasql:data find functions that reference "password" strings and rank by xrefs.
/idasql:xrefs show callers of CreateFileW and summarize error handling.
/idasql:data identify suspicious hardcoded URLs and the functions that reference them.

The /idasql skills drive analysis from your coding CLI -- no IDAPython scripting required.

CLI Help

…

Legacy 32-bit .idb inputs are upgraded by idalib to a sibling .i64. When that happens, idasql exits before serving SQL, returns exit code 3, and prints one JSON object to stdout with status:"upgraded" and reopen_with. Repeat the same operation with -s .

Building from Source

Prerequisites

• CMake 3.20+
• C++20 compiler
• IDA SDK 9.0+ (set IDASDK environment variable)

cmake -S . -B build -DIDASQL_WITH_MCP=ON -DIDASQL_BUILD_EXAMPLES=OFF
cmake --build build --config Release

Useful CMake switches:

Switch	Default	Description
IDASQL_WITH_MCP	ON	Build MCP server support via fastmcpp. Disable for a smaller/offline build or when you do not need --mcp / .mcp.
IDASQL_BUILD_CLI	ON	Build the standalone idasql command-line tool.
IDASQL_BUILD_PLUGIN	ON	Build the IDA plugin.
IDASQL_BUILD_EXAMPLES	ON	Build the example programs under examples/.

Notes:

• Hex-Rays support is always compiled in and detected at runtime. If Hex-Rays is unavailable, decompiler-backed tables/functions are simply not registered.
• HTTP REST support is always compiled in; use --http from the CLI or .http start from the REPL/plugin CLI.
• IDAPython SQL execution is compiled in but disabled by default at runtime. Enable it per session with PRAGMA idasql.enable_idapython = 1;.
• IDASQL_WITH_MCP=ON fetches fastmcpp; OFF removes MCP support and the --mcp / .mcp commands.
• XSQL_WITH_THINCLIENT is forced ON, and HTTPLIB_USE_OPENSSL_IF_AVAILABLE is forced OFF because IDASQL uses local plain HTTP.

Available Tables

30+ virtual tables covering functions, strings, types, cross-references, disassembly, decompilation, and more.

Core

Table	Description
funcs	Functions - name, addr, size, end addr, flags (INSERT/UPDATE/DELETE)
segments	Segments - name, start/end addr, permissions, class (INSERT/UPDATE/DELETE)
names	Named locations - addr, name, flags (INSERT/UPDATE/DELETE)
entries	Entry points - export/program/tls callbacks (ordinal, addr, name)
imports	Imports - module, name, addr, ordinal
xrefs	Cross-references - from/to addr, type, is_code
blocks	Basic blocks - start/end addr, func_addr, size
fchunks	Function chunks - split/tail chunks with owner
instructions	Disassembly - addr, mnemonic, operands, itype, func_addr (UPDATE operand format_spec / DELETE)
instruction_operands	Normalized instruction operands - opnum, text, type, value; optimized by addr and func_addr
heads	All head items (code + data) - optimized address lookup/range navigation

Strings & Bytes

Table	Description
strings	Strings - addr, content, length, type
bytes	Raw bytes - value/word/dword/qword writable (UPDATE patches, DELETE reverts), original_value, is_patched (fast patch enumeration via WHERE is_patched = 1)

Decompiler

Table	Description
pseudocode	Decompiled pseudocode via Hex-Rays
ctree	Hex-Rays ctree AST nodes
ctree_lvars	Local variables from Hex-Rays decompilation
ctree_call_args	Hex-Rays call argument details per call site
ctree_labels	Hex-Rays ctree labels (goto targets)

Types

Table	Description
types	Type library - structs, unions, enums with members (INSERT/UPDATE/DELETE)
types_members	Struct/union member details (INSERT/UPDATE/DELETE)
types_enum_values	Enum member values (INSERT/UPDATE/DELETE)
types_func_args	Function type argument details
local_types	Local type library entries

Annotations

Table	Description
comments	Comments - addr, regular and repeatable comments (INSERT/UPDATE/DELETE)
bookmarks	Bookmarks - slot, addr, description (INSERT/UPDATE/DELETE)
breakpoints	Breakpoints - addr, type, enabled, condition (full CRUD)
hidden_ranges	Collapsed/hidden ranges - start/end, description, header, footer

Search

Table	Description
grep	Unified entity search table (