IDA Security Scanner

January 19, 2026 · View on GitHub

IDA Pro 9.1+ Python 3.10+

Automated vulnerability detection in IDA Pro using SAST rules on decompiled code

IDA Security Scanner Interface

What is IDA Security Scanner?

IDA Security Scanner bridges the gap between binary reverse engineering and static code analysis. Instead of manually hunting for vulnerabilities in decompiled code, this plugin:

  1. Extracts pseudocode from IDA's Hex-Rays decompiler
  2. Runs SAST rules via opengrep on the C-like output
  3. Displays results in an interactive UI directly inside IDA
  4. Provides AI explanations (optional) for each finding

Perfect for vulnerability research, CTF challenges, and security audits.

Installation

1. Copy the plugin folder

# macOS
cp -r symbiotic /Applications/IDA*/Contents/MacOS/plugins/

# Windows
xcopy symbiotic %IDADIR%\plugins\symbiotic\ /E /I

# Linux
cp -r symbiotic ~/.idapro/plugins/

2. Install opengrep

Download the opengrep binary from the official releases:

https://github.com/opengrep/opengrep/releases

Rename the binary to opengrep-core and place it in the IDA plugins folder (same location as the plugin):

# macOS
mv opengrep /Applications/IDA*/Contents/MacOS/plugins/opengrep-core

# Windows
move opengrep.exe %IDADIR%\plugins\opengrep-core.exe

# Linux
mv opengrep ~/.idapro/plugins/opengrep-core

Note: The plugin expects the binary at plugins/opengrep-core by default. You can change this path in the plugin settings.

3. Configure AI (Optional)

See the AI Integration section below.

Usage

ShortcutAction
Ctrl+Shift+SScan current function
Ctrl+Shift+LScan ALL functions
Ctrl+Shift+AAsk AI about selected finding

Scan Options

Detection Rules

IDA Security Scanner uses YAML-based rules powered by opengrep (a semgrep fork). Rules are defined in code-rules.yaml.

Adding Custom Rules

Why add custom rules?

  • Target specific vulnerability patterns for your audit
  • Detect proprietary API misuse in embedded systems
  • Create rules for CTF-specific patterns
  • Hunt for known CVE patterns in binaries

How to add a rule:

Edit code-rules.yaml and add your pattern:

rules:
  # Example: Detect dangerous gets() usage
  - id: BUFFER_OVERFLOW_GETS
    languages: [c]
    message: "Buffer overflow: gets() has no bounds checking"
    pattern: gets($BUF)
    severity: CRITICAL

  # Example: Detect potential integer overflow
  - id: INTEGER_OVERFLOW
    languages: [c]
    message: "Potential integer overflow in malloc size calculation"
    pattern: malloc($X * $Y)
    severity: WARNING

  # Example: Detect hardcoded credentials
  - id: HARDCODED_PASSWORD
    languages: [c]
    message: "Hardcoded password detected"
    pattern-regex: '(password|passwd|pwd)\s*=\s*"[^"]+"'
    severity: HIGH

Pattern syntax reference: See opengrep/semgrep documentation

See the full rules file: code-rules.yaml

AI Integration

IDA Security Scanner can use LLM APIs to provide detailed explanations of detected vulnerabilities and suggest exploitation paths.

Quick Setup

  1. Copy the example configuration:

    cp .env.example .env

  2. Edit .env with your API credentials (see below)

  3. Use Ctrl+Shift+A on any finding to get AI analysis

Supported Providers

ProviderDocumentationHow to get API Key
OpenAIplatform.openai.comGet API Key
Anthropic (Claude)docs.anthropic.comGet API Key
Google Geminiai.google.devRequires OpenAI-compatible proxy
Local ModelsVia Ollama, LM StudioUse OpenAI-compatible endpoint

Configuration Example

# .env file
AI_PROVIDER=openai
AI_API_KEY=sk-your-api-key-here
AI_MODEL=gpt-5.2
AI_BASE_URL=https://api.openai.com/v1  # Optional, for custom endpoints

AI Configuration

AI Response Example

AI Response

Features

  • Automatic Vulnerability Detection — Scans decompiled functions for dangerous patterns
  • YAML-based Rules — Easy to customize and extend with your own patterns
  • Interactive UI — Filter by severity, function name, add custom tags
  • AI Analysis — Get detailed explanations via LLM integration
  • Persistent State — Tags and notes survive between IDA sessions
  • Fast Scanning — Leverages opengrep's optimized pattern matching

Credits

  • opengrep — Static analysis engine (semgrep fork)
  • IDA Pro — Reverse engineering platform

License

MIT License — See LICENSE for details.