Skip to content

ida-agent 0.4.2

Choose a tag to compare

View all tags
@ackwrap ackwrap released this 13 Sep 15:12
v0.4.2
a059ec0

ida-agent 0.4.2

Windows x64 only / 仅支持 Windows x64

Requires IDA Professional 9.4 for Windows with its bundled Qt 6.8.2.
需要 Windows 版 IDA Professional 9.4 及其自带的 Qt 6.8.2。

  • *-setup.exe: per-user installer / 当前用户安装器。
  • *.zip: portable Gateway, IDA plugin, and client skills / 便携版 Gateway、IDA 插件与客户端技能。
  • *-setup.exe.sha256: installer SHA-256 / 安装器校验值。

Close IDA before installing or upgrading. The portable ZIP contains per-file SHA256SUMS.txt.
安装或升级前请关闭 IDA。便携 ZIP 内含逐文件 SHA256SUMS.txt。

Qt runtime DLLs and IDA itself are not included. Other IDA/Qt versions, Linux, and macOS are unsupported.
不包含 IDA 或 Qt 运行时 DLL；不支持其他 IDA/Qt 版本、Linux 和 macOS。

Changes

  • Add debugger discovery and selection, launch/remote connection configuration, process enumeration and attach, suspend, and detach. Existing start/exit, stepping, breakpoints, register reads, and memory access remain available.
  • Keep one-time debugger permission shared by all MCP clients on the current IDA Pipe. Debugger commands enforce process-state requirements; accepted: true acknowledges a request, so query debugger.info to confirm completion.
  • Add optional refresh to string.search and string.search_regex. Searches reuse the current IDB string list by default; refresh: true explicitly rebuilds it and cannot be combined with a pagination cursor.
  • Fix Gateway handling of suspended IDA targets, including debugger.info responses that previously produced INTERNAL_ERROR.
  • Add isolated, licensed idat integration coverage for plugin/Gateway communication and native debugger controls using an owned test process. These tests were run locally; GitHub-hosted CI runs compilation and unit tests only.

Limits

  • Debugger permission still requires graphical IDA; headless MCP debugger calls remain denied. The native idat test driver is test-only and is excluded from release packages.
  • GUI permission interaction and remote debugger connections have not been validated end to end. Register writes, data watchpoints, and a debugger event stream are not added in this release.
  • String search operates on the IDB string list, not arbitrary live process memory. Initial list creation or explicit refresh can still take time. Restart pagination after changing the list; use bounded memory search for live memory.

更新内容

  • 新增调试器发现与选择、启动及远程连接参数配置、进程枚举与附加、暂停和分离；继续支持已有的启动/结束、单步、断点、寄存器读取与内存访问。
  • 保留当前 IDA Pipe 的一次性调试授权，所有 MCP 客户端共享授权。调试命令校验进程状态；accepted: true 表示请求已接受，完成状态需查询 debugger.info 确认。
  • 为 string.search 和 string.search_regex 增加可选 refresh 参数。默认复用当前 IDB 字符串列表；仅 refresh: true 显式重建，且不能与分页游标同时使用。
  • 修复 Gateway 对 IDA 暂停状态的处理，包括此前会返回 INTERNAL_ERROR 的 debugger.info 响应。
  • 增加隔离的、需要许可的 idat 集成测试，使用自有测试进程验证插件/Gateway 通信和原生调试控制。已在本地执行；GitHub 托管 CI 仅执行编译与单元测试。

当前限制

  • 调试授权仍需图形版 IDA；无界面环境中的 MCP 调试请求继续拒绝。原生 idat 测试驱动仅用于测试，不进入发布包。
  • 尚未完成 GUI 授权交互和远程调试器连接的端到端验证。本版未新增寄存器写入、数据观察点或调试事件流。
  • 字符串搜索针对 IDB 字符串列表，不扫描任意实时进程内存。首次建表和显式刷新仍可能耗时；列表变化后应重新开始分页，实时内存请使用有范围限制的内存搜索。
Assets 5
Loading