idalib-rust-skills

idalib

Idiomatic Rust bindings for the IDA SDK, enabling the development of standalone analysis tools using IDA v9.x’s idalib.

IDA support and dependencies

The bindings and examples have been tested against IDA Pro v9.3 on Windows (11), Linux (Ubuntu 24.04 LTS), and macOS Sequoia (Apple Silicon). The latest bindings are only guaranteed compatible with the latest official IDA Pro/SDK release. See the table below for compatibility:

IDA Pro version	Latest compatible idalib
v9.3	0.8.1
v9.2	0.7.2
v9.1	0.6.1
v9.0sp1	0.4.1
v9.0	0.3.0

In addition to the latest IDA SDK and IDA itself, a recent version of LLVM/Clang is required (this is to help generate bindings from the SDK), it can be obtained from, e.g., here. See the bindgen documentation for extended instructions for each supported operating system/environment.

Developing with idalib

For development, only the IDA SDK is required, whereas to run tests, an IDA installation (with a valid license) is required. During build, the crates can locate an IDA installation using the following environment variable:

• IDADIR (optional) set to the directory containing the ida executable (e.g., /Applications/IDA Professional v9.x/Contents/macOS for macOS, or $HOME/ida-pro-9.x for Linux). If not set, the build script will check common locations.

Projects using idalib

• xorpse/idalib-mp: example project demonstrating idalib + multi-processing.
• xorpse/parascope: mass-scan source/decompiled code using weggli rulesets.
• 0xdea/rhabdomancer: locate calls to insecure API functions in a binary file.
• 0xdea/haruspex: extract pseudo-code from the IDA Hex-Rays decompiler.
• 0xdea/augur: extract strings and related pseudo-code from a binary file.

Examples

A minimal project to working with idalib requires the following components:

Cargo.toml:

name = "example-analyser"

# ...

[dependencies]
idalib = "0.8"

[build-dependencies]
idalib-build = "0.8"

build.rs:

fn main() -> Result<(), Box<dyn std::error::Error>> {
    idalib_build::configure_linkage()?;
    Ok(())
}

src/main.rs:

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let idb = idalib::IDB::open("/path/to/binary")?;

    // ...

    Ok(())
}

More comprehensive examples can be found in idalib/examples. To run them:

Linux/macOS:

export IDADIR=...

cargo run --example=dump_ls

Windows:

$env:PATH="C:\Program Files\IDA Professional 9.3;$env:PATH"
$env:IDADIR="C:\Program Files\IDA Professional 9.3"

cargo run --example=dump_ls

Linking

The idalib-build crate provides various build script helpers to simplify linking:

• idalib_build::configure_idalib_linkage: links against (lib)ida and (lib)idalib in the IDA installation directory.
• idalib_build::configure_idasdk_linkage: links against the (lib)ida and (lib)idalib stub libraries bundled with the SDK.
• idalib_build::configure_linkage: links against the (lib)ida and (lib)idalib stub libraries and for Linux/macOS sets the RPATH to refer to the detected (or specified via IDADIR) installation directory.

⚠️ Warning: If you copy the build.rs from idalib/examples, you may encounter unexpected behaviour when IDA is installed in a non-default location and IDADIR is not set, for example:

error while loading shared libraries: [libida.so]

This issue can be worked around by ensuring IDADIR is correctly set at build time, or by ensuring the (lib)ida and (lib)idalib shared libraries are available to the dynamic linker at runtime, e.g., via LD_LIBRARY_PATH or /etc/ld.so.conf{,.d}. Note that using the stub libraries provided by the SDK, e.g., those located at $IDASDK/lib/... as opposed to the libraries in the IDA installation directory will result in crashes.