symgraph/IDAssist

What it solves

IDAssist is an AI-powered plugin for IDA Pro that simplifies the complex process of binary reverse engineering. It helps analysts identify the purpose of decompiled functions, understand the overall structure of a binary, and automate tedious tasks like renaming variables and functions based on AI suggestions.

How it works

The plugin integrates directly into IDA Pro's interface as a dockable panel. It connects to various LLM providers (such as OpenAI, Anthropic, and Ollama) to analyze code. It uses a combination of techniques to provide context:

• RAG (Retrieval-Augmented Generation): Users can upload reference documents to provide the LLM with specific external knowledge.
• Semantic Knowledge Graph: The tool builds a graph of the binary's functions, call relationships, and data flows, allowing for semantic search and community detection.
• ReAct Agent: An autonomous agent mode that can plan investigation strategies and execute tools to gather information from the binary.
• MCP Integration: Support for Model Context Protocol (MCP) servers, allowing the LLM to programmatically inspect the disassembly and modify the IDB.

Who it’s for

Reverse engineers and security researchers who use IDA Pro 9.0+ and want to leverage LLMs to accelerate their analysis of compiled binaries.

Highlights

• Automated Analysis: Generates natural-language explanations of functions and performs security analysis (risk levels and API detection).
• Interactive Querying: A chat interface with context macros for injecting code, addresses, or disassembly ranges.
• AI-Driven Renaming: Suggests renames for functions, variables, and types with confidence scores.
• Collaborative Integration: Syncs data with the SymGraph platform for collaborative reverse engineering.
• Flexible LLM Support: Compatible with a wide range of providers including local models via Ollama and cloud APIs via LiteLLM.