{"id":161068,"date":"2025-10-14T07:42:38","date_gmt":"2025-10-14T07:42:38","guid":{"rendered":"https:\/\/hnsecurity.it\/?p=161068"},"modified":"2026-07-16T12:36:04","modified_gmt":"2026-07-16T12:36:04","slug":"streamlining-vulnerability-research-with-the-idalib-rust-bindings-for-ida-9-2","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/streamlining-vulnerability-research-with-the-idalib-rust-bindings-for-ida-9-2\/","title":{"rendered":"Streamlining vulnerability research with the idalib Rust bindings for IDA 9.2"},"content":{"rendered":"

“The attack surface is the vulnerability.
\nFinding a bug there is just a detail.”
\n— Mark Dowd
\n<\/em><\/p><\/blockquote>\n

A\u00a0previous version<\/a> of this article appeared on the HN Security blog<\/a> in February 2025. This updated and revised version was also published as a guest feature<\/a> on the Hex-Rays blog in October 2025.<\/p>\n

TL;DR<\/h2>\n

Following the release of\u00a0IDA Pro 9.2<\/a>, I updated my tools that were built to assist with\u00a0reverse engineering and vulnerability research against binary targets<\/strong>:<\/p>\n

    \n
  • rhabdomancer<\/a>: a headless IDA Pro plugin that\u00a0locates calls to potentially insecure API functions<\/strong> in a binary file. Auditors can backtrace from these candidate points to find pathways allowing access from untrusted input.<\/li>\n
  • haruspex<\/a>: a headless IDA Pro plugin that\u00a0extracts pseudocode<\/strong>\u00a0generated by IDA Pro\u2019s decompiler in a format suitable for import into an IDE or to be parsed by static analysis tools such as Semgrep or weggli.<\/li>\n
  • augur<\/a>: a headless IDA Pro plugin that\u00a0extracts strings and related pseudocode<\/strong>\u00a0from a binary file. It stores pseudocode of functions that reference strings in an organized directory tree.<\/li>\n<\/ul>\n

    These plugins are based on my\u00a0previous work<\/a>\u00a0and leverage Hex-Rays\u2019\u00a0idalib<\/a>\u00a0alongside Binarly\u2019s\u00a0idiomatic Rust bindings<\/a>\u00a0for the IDA SDK to achieve a\u00a0blazing<\/strong>\u00a0fast, headless user experience.\u00a0<\/strong>They have\u00a0<\/strong>assisted me in finding\u00a0real-world vulnerabilities at scale<\/strong>.<\/p>\n

    Introducing the award-winning idalib Rust bindings<\/strong><\/h2>\n

    Last year, after approaching\u00a0Rust<\/a>\u00a0and having explored some basic\u00a0offensive\u00a0<\/a>applications<\/a>, I decided it was time for\u00a0my first serious Rust project<\/strong>. When\u00a0idalib v0.1.0<\/a>\u00a0was announced, I had an idea: port to IDA Pro some of my original\u00a0Ghidra scripts<\/a>\u00a0that aim to\u00a0streamline vulnerability research<\/strong>, using Rust! \ud83e\udd80 \ud83d\udca1<\/p>\n

    \n

    Our REsearch team is thrilled about the new IDA v9.0! #efiXplorer<\/a> is fully compatible with v9.0 and still supports IDA v8.4\ud83d\ude80
    \ud83d\udd2c    https:\/\/t.co\/WHYGifmjGS<\/a><\/p>\n

    We are thrilled to announce IDAlib \u2014 idiomatic Rust bindings for the IDA SDK \ud83c\udf89 Kudos to @xorpse<\/a>!
    \u2699\ufe0f    https:\/\/t.co\/PLoNkf8sQn<\/a> pic.twitter.com\/J1no6oFatO<\/a><\/p>\n

    — BINARLY\ud83d\udd2c (@binarly_io) October 1, 2024<\/a><\/p><\/blockquote>\n