IDASQL v0.0.19

idasql v0.0.19 lets you apply FLIRT signatures, roll back to undo checkpoints, query from IDAPython, and open results in IDA through ida:// links. It also adds 28 new tables and views, and builds for IDA 9.2, 9.3 and 9.4.

Highlights

FLIRT signatures from SQL. INSERT applies a signature, by short name or .sig path, and returns once analysis has used it. SELECT shows each signature's state and how many functions it matched. available_signatures lists every .sig IDA can find for the database's processor.

INSERT INTO signatures(name) VALUES ('vc32rtf');
SELECT name, title, state, matches FROM signatures;
SELECT name FROM funcs WHERE flags & 4;      -- library code, skip it in triage

Undo checkpoints (#59). Named undo points built on IDA's own undo engine. They cover every idasql write, headless and in the GUI. With auto_checkpoint = 'statement', every statement that writes gets its own checkpoint.

INSERT INTO checkpoints(label) VALUES ('before renames');
UPDATE funcs SET name = 'parse_header' WHERE addr = 0x401000;
UPDATE checkpoints SET state = 'undone' WHERE label = 'before renames';

import idasql in IDAPython (#57). Run SQL from the IDA console, a script or a plugin, with no server in between. Values come back as Python types, ? parameters are bound by SQLite, and a failed query raises idasql.Error naming the statement.

import idasql
for f in idasql.query("SELECT addr, name FROM funcs WHERE size > ?", 100):
    print(hex(f.addr), f.name)

ida:// deep links for IDA 9.4 (#43). Join deep_links to any result to get a link that opens IDA at that function, in pseudocode or disassembly. Up to the final idb_path parameter, which idasql adds, the link is identical to IDA's own Copy Link. idasql link register makes these links open from any app, and ida_open_link() navigates from SQL.

New tables and views

• Program structure: func_summary (one triage row per function), func_at(addr), function_chunks, function_frames, data_items, switch_tables, switch_cases, dominators, post_dominators, loops
• Decompiler: microcode and microcode_operands at any maturity, the portable ir_ops / ir_operands / ir_maturities / ir_v_* views, and decompiler_splits (Split expression without a pseudocode window)
• Database and session: notepad, ida_config (IDA's .cfg keys, readable and settable), checkpoints, undo_state, available_signatures, deep_links, deep_link_parse
• Now writable: signatures (INSERT applies), and runtime_settings (UPDATE replaces the value PRAGMAs)

Changed

• Functions with tail chunks are handled everywhere: disasm_func, funcs.size and func_at cover every chunk, and a shared tail reports every owner.
• Integer and address writes are exact. '0x90', 1.5 or a blob is refused with the column named, never truncated.
• cfg_edges true/false follow the branch (true is the jump target). Addresses outside every function read as NULL, not 0.
• segments INSERT uses the database's bitness. struct_member_xrefs reports the operand and the access offset and size.
• The X-XSQL-Timeout header sets a per-request timeout over HTTP.
• Builds are pinned to reviewed dependency revisions (libxsql 1.0.24).

Fixed

• Plugin teardown no longer leaves listeners calling into freed state.
• /cancel reaches only requests that have started.
• Decompiler tables keep every row under multi-function OR queries.

Downloads

Pick the archives for your IDA version. Plugin binaries are built per IDA SDK and are not interchangeable across versions.

IDA	Plugin (HCLI package)	Command-line tool	ARM64 plugins
9.4	idasql-v0.0.19-ida94-plugin.zip	idasql-v0.0.19-ida94-cli-manual.zip	idasql-v0.0.19-ida94-arm64-plugin-manual.zip
9.3	idasql-v0.0.19-ida93-plugin.zip	idasql-v0.0.19-ida93-cli-manual.zip	idasql-v0.0.19-ida93-arm64-plugin-manual.zip
9.2	idasql-v0.0.19-ida92-plugin.zip	idasql-v0.0.19-ida92-cli-manual.zip	n/a

• Plugin: Windows x64, Linux x64 and macOS Arm64 in one archive, with ida-plugin.json. Install it with HCLI, or copy ida-plugin.json and your platform's binary into IDA's plugins folder.
• Command-line tool: one idasql executable per platform. It also includes Linux Arm64 for 9.3 and 9.4, and Windows Arm64 for 9.4. Put it next to the IDA executable.
• ARM64 plugins: Linux Arm64 for 9.3 and 9.4, and Windows Arm64 for 9.4. Install them by hand.

Checksums are in SHA256SUMS.txt.

Agent skills

idasql-skills v0.0.19 adds a deep-links skill, a checkpoints reference with a hook that rolls back an agent's turn, and FLIRT recipes. Every skill is updated for this release.

---

Thanks to @torsts for the function-tails report, and to @noamz10, @po0p and @rcaragea for the feature requests. This release closes #43, #57 and #59.

If idasql saves you time: PayPal · Buy Me a Coffee

Full changelog: v0.0.18.1...v0.0.19