Scripting IDA Pro With IDAPython

When to Use

• You use IDA Pro and want to automate repetitive analysis — enumerate functions, decode strings, apply signature-based renames, and export results — via IDAPython.
• You need a headless idat batch invocation to process many samples.

Do not use IDA's debugger (-r) on untrusted samples on your host — these scripts drive static analysis. Work in an isolated environment.

Prerequisites

• IDA Pro with IDAPython, and the samples to analyze.

Safety & Handling

• IDA static analysis does not execute the sample; keep the input directory isolated.

Workflow

Step 1: Generate an analysis script

python scripts/analyst.py script --emit functions,strings --out ida_export.py

Emits an IDAPython script using the real API (idautils.Functions, idc.get_func_name, idautils.Strings) that writes results to JSON next to the IDB.

Step 2: Generate the headless batch command

python scripts/analyst.py batch --script ida_export.py --input sample.exe

Builds the idat -A -S"script" input invocation (auto-mode, run script, no UI) for batch runs.

Step 3: Run and collect

Execute the batch command per sample and aggregate the JSON exports.

Step 4: Iterate

Extend the generated script with signature renames (FLIRT) and decompiler (ida_hexrays) output as needed.

Validation

• The generated script uses real IDAPython API calls.
• The batch command uses -A (auto) and -S (script) correctly.
• JSON output is produced per processed IDB.

Pitfalls

• IDAPython API drift between IDA 7.x and 9.x — target your version.
• Forgetting -A leaves IDA waiting for interactive input in batch.
• Decompiler calls require a licensed Hex-Rays decompiler.

References

• See references/api-reference.md for the generator.
• IDAPython and idat batch references (linked in frontmatter).