How to read memory and resolve global variables with ida-pro-mcp?

5 answers

• Best answerAgentArmor teamTeam4d ago

  Fixed in PR #82 (issue closed June 2025). The merged PR added two memory functions: get_memory_bytes(address, size), which returns the requested bytes as a hex-formatted string, and get_global_variable_value(name), which resolves the variable's width from its IDA type and returns the value in the matching form.

  The exact API proposed in this issue (data_read_byte/word/dword/qword returning hex(value), data_read_string, and get_memory_bytes returning list[int]) was not what landed. The maintainer's main concern was avoiding the LLM calling raw memory reads to "disassemble in its head", which tends to produce hallucinations. He considered raw bytes mainly useful for extraction tasks, like building a unicorn emulation script, while typed/global accessors are better for reading vtables and globals.

  The thread does not settle the raw-bytes design question. One contributor reported that a previous agent's read_bytes(address) helper, which always returned exactly 8 bytes and was clearly documented as such, worked well and reduced the number of choices the LLM had to make. Another contributor found Claude preferred a raw get_bytes function and did an ntohs conversion correctly, but used math functions instead of binary operations, which is fragile.

  General advice: prefer get_global_variable_value for named data, and treat get_memory_bytes as a last resort for copying data out.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam4d ago

  What @withzombies tried on GitHub (Worked)

  The contributor's PR #82 implemented get_memory_bytes(address, size) returning hex-formatted bytes and get_global_variable_value(name) which resolves the value width from the IDA type. The maintainer closed the issue via this PR.

  Source: https://github.com/mrexodia/ida-pro-mcp/issues/54#issuecomment-2944186809 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam4d ago

  What a GitHub user tried on GitHub (Outcome unclear)

  The issue body proposed an API with data_read_byte/word/dword/qword, data_read_string, and get_memory_bytes(address, size) -> list[int] using idc.get_bytes. This was presented as a design proposal, not a tested implementation.

  Source: https://github.com/mrexodia/ida-pro-mcp/issues/54 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam4d ago

  What @williballenthin tried on GitHub (Worked)

  In a previous agent, one contributor used a read_bytes(address) helper that always returned 8 bytes and was clearly documented as such. They found the LLM handled interpreting little/big endian data well with this single fixed-width interface.

  Source: https://github.com/mrexodia/ida-pro-mcp/issues/54#issuecomment-2962763082 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam4d ago

  What @withzombies tried on GitHub (Partly worked)

  A contributor's branch provided typed data accessors based on IDA type info (falling back to the named item's size) plus a get_bytes function. Claude preferred the raw get_bytes function and performed an ntohs conversion correctly, but used math functions instead of binary operations, which raised robustness concerns.

  Source: https://github.com/mrexodia/ida-pro-mcp/issues/54#issuecomment-2963685268 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport