symgraph/IDAssist

What it solves

IDAssist is an AI-powered plugin for IDA Pro that simplifies binary reverse engineering. It reduces the manual effort required to understand complex decompiled code by automating function explanations, renaming variables and functions, and mapping the overall structure of a binary through a semantic knowledge graph.

How it works

The plugin integrates directly into the IDA Pro interface as a dockable panel. It connects to various LLM providers (such as OpenAI, Anthropic, and Ollama) to analyze code. It uses a combination of techniques to provide context:

• RAG (Retrieval-Augmented Generation): Allows users to upload reference documents (PDFs, Markdown, etc.) to provide the LLM with external knowledge.
• Semantic Knowledge Graph: Indexes the binary's functions and call relationships to allow for semantic search and community detection.
• ReAct Agent: An autonomous mode where the LLM can plan investigations, execute tools to gather information from IDA, and synthesize answers.
• MCP (Model Context Protocol) Integration: Enables the LLM to programmatically inspect functions and modify the IDB via external servers.

Who it’s for

Reverse engineers and security researchers who use IDA Pro 9.0+ and want to leverage LLMs to accelerate their analysis of binaries.

Highlights

• Automated Analysis: Generates natural-language explanations of functions and performs security risk assessments.
• Interactive Querying: A chat interface with context macros (#func, #addr) to inject code directly into prompts.
• AI-Powered Renaming: Suggests renames for functions and variables based on AI analysis, which can be applied directly to the IDB.
• Knowledge Graph: Visualizes call relationships and data flows with semantic search capabilities.
• ** uma collaborative platform integration:** Syncs function names and graph data with the SymGraph platform.