Content
# IDA SigMaker MCP Server
Expose IDA SigMaker functionality to LLM agents via the Model Context Protocol (MCP) server. By GayBottle and Claude Opus 4.7.
## Features
The MCP server provides the following tools:
### 1. `generate_signature`
Generate a unique binary signature at a specified address.
**Parameters:**
- `address` (string): Hexadecimal address, e.g., `"0x140001000"`
- `format` (string, optional): Output format - `ida`, `x64dbg`, `mask`, `bitmask`, default `ida`
- `max_length` (integer, optional): Maximum signature length, default `100`
**Returns:**
```json
{
"address": "0x140001000",
"signature": "E8 ? ? ? ? 45 33 F6 66 44 89 34 33",
"length": 13,
"format": "ida",
"unique": true,
"source": "original sigmaker"
}
```
### 2. `generate_xref_signatures`
Generate signatures for all cross-references to a target address (indirectly locating the target).
**Parameters:**
- `address` (string): Target address
- `format` (string, optional): Output format, default `ida`
- `top_n` (integer, optional): Return top N shortest signatures, default `5`
- `max_length` (integer, optional): Maximum signature length, default `100`
**Returns:**
```json
{
"target": "0x140001000",
"format": "ida",
"xref_count": 15,
"xref_signatures": [
{
"signature": "E8 ? ? ? ? 48 8B",
"caller": "0x140002000",
"length": 7
}
],
"source": "original sigmaker"
}
```
### 3. `search_signature`
Search for a signature pattern in a binary.
**Parameters:**
- `pattern` (string): Signature pattern (IDA format: `E8 ? ? ? ?` or `E8 ?? ?? ?? ??`)
- `limit` (integer, optional): Maximum results, default `100`
**Returns:**
```json
{
"pattern": "E8 ? ? ? ? 45 33 F6",
"matches": 3,
"addresses": [
"0x140001000",
"0x140002000",
"0x140003000"
]
}
```
### 4. `batch_generate_signatures`
Batch generate signatures for multiple addresses.
**Parameters:**
- `addresses` (array): List of addresses, e.g., `["0x140001000", "0x140002000"]`
- `format` (string, optional): Output format, default `ida`
- `max_length` (integer, optional): Maximum signature length, default `100`
**Returns:**
```json
{
"format": "ida",
"total": 2,
"results": [
{
"address": "0x140001000",
"signature": "E8 ? ? ? ? 45 33 F6",
"length": 7,
"success": true
},
{
"address": "0x140002000",
"error": "Signature not unique",
"success": false
}
]
}
```
### 5. `verify_signature_unique`
Verify if a signature is unique and points to the correct address.
**Parameters:**
- `signature` (string): Signature pattern
- `expected_address` (string): Expected address
**Returns:**
```json
{
"signature": "E8 ? ? ? ? 45 33 F6",
"expected": "0x140001000",
"matches": 1,
"addresses": ["0x140001000"],
"unique": true,
"correct": true
}
```
## Prerequisites
### 1. Software Versions
- **Python**: 3.11+ (recommended 3.11.9)
- **IDA Pro**: 9.0+ (tested 9.0)
- **OpenCode**: Latest version
### 2. IDA SigMaker Plugin Installation
#### Method A: Using pre-compiled DLL (recommended)
1. Download `SigMaker64.dll` from [IDA SigMaker Releases](https://github.com/A200K/IDA-Pro-SigMaker/releases)
2. Copy to IDA plugin directory:
```
C:\Users\<username>\AppData\Roaming\Hex-Rays\IDA Pro\plugins\SigMaker64.dll
```
#### Method B: Compile from source
1. Clone repository:
```bash
git clone https://github.com/A200K/IDA-Pro-SigMaker.git
```
2. Compile `SigMaker64.dll` using Visual Studio
3. Copy to IDA plugin directory
### 3. Python Dependency Installation
```bash
pip install requests
```
### 4. IDA MCP Plugin Installation
IDA MCP plugin provides RPC interface:
```bash
pip install ida-pro-mcp
```
After installation, IDA Pro will automatically load the MCP plugin and listen on `127.0.0.1:13337`.
## Installation and Configuration
### 1. Clone this repository
```bash
git clone https://github.com/yourusername/ida-sigmaker-mcp.git
cd ida-sigmaker-mcp
```
### 2. Configure environment variables (optional)
Set in `~/.bashrc` or system environment variables:
```bash
export SIGMAKER_PATH="D:\ida-sigmaker-mcp"
export IDA_RPC_URL="http://127.0.0.1:13337"
```
If not set, default values will be used.
### 3. Configure OpenCode
Edit OpenCode configuration file:
**Windows:** `C:\Users\<username>\.config\opencode\opencode.json`
Add the following configuration:
```json
{
"mcpServers": {
"ida-sigmaker": {
"type": "local",
"command": ["python", "D:/ida-sigmaker-mcp/mcp-server/sigmaker_mcp.py"],
"enabled": true,
"timeout": 30000
}
}
}
```
**Note:**
- Use forward slashes `/` or double backslashes `\\` for paths
- Set `timeout` to 30 seconds to avoid large binary analysis timeouts
### 4. Start services
1. **Start IDA Pro** and open the target binary file
- IDA MCP plugin will automatically start RPC server (port 13337)
2. **Start OpenCode**
- OpenCode will automatically start `sigmaker_mcp.py`
- No need to manually start any services
### 5. Verify installation
Test in OpenCode:
```
Generate signature for address 0x140001000
```
If signature result is returned, installation is successful.
## Usage Examples
### Using in OpenCode
#### Generate single signature
```
Generate IDA format signature for address 0x140031670
```
#### Batch generate signatures
```
Batch generate signatures for addresses 0x140031670, 0x140031510, 0x1400315f0
```
#### Search signature
```
Search signature "48 89 C1 E8 ?? ?? ?? ??"
```
#### Verify signature uniqueness
```
Verify signature "98 0C ? 86 E8" is unique and points to 0x140031670
```
#### Generate XREF signatures
```
Generate top 3 xref signatures for address 0x140031670
```
## Supported Signature Formats
- **IDA**: `E8 ? ? ? ? 45 33 F6` (single `?` as wildcard)
- **x64Dbg**: `E8 ?? ?? ?? ?? 45 33 F6` (double `??` as wildcard)
- **Mask**: `E8 00 00 00 00 45 33 F6` + `x????xxx`
- **BitMask**: Bit-level mask format
## Architecture
```
┌─────────────────┐
│ OpenCode │ (AI Agent)
│ (LLM Agent) │
└────────┬────────┘
│ stdin/stdout (JSON-RPC)
▼
┌─────────────────┐
│ sigmaker_mcp.py │ (MCP Server)
└────────┬────────┘
│ subprocess stdin/stdout
▼
┌─────────────────┐
│ ida_pro_mcp │ (IDA MCP Server)
│ server.py │
└────────┬────────┘
│ HTTP JSON-RPC (127.0.0.1:13337)
▼
┌─────────────────┐
│ IDA Pro │ (ida.exe)
│ ida_mcp │ (internal plugin)
└────────┬────────┘
│ Python API (idaapi)
▼
┌─────────────────┐
│ SigMaker64.dll │ (original plugin)
│ sigmaker.py │
└─────────────────┘
```
**Workflow:**
1. OpenCode starts `sigmaker_mcp.py` automatically
2. IDA Pro loads `ida_mcp` plugin and listens on port 13337
3. Agent calls sigmaker tools, `sigmaker_mcp.py` starts temporary subprocess connecting IDA MCP
4. IDA MCP uses Python API to call original sigmaker plugin
5. Results return to agent through the same path
## Troubleshooting
### 1. "IDA RPC error: No response from IDA"
**Cause:** IDA Pro not running or IDA MCP plugin not loaded
**Solution:**
- Ensure IDA Pro is running
- Check if IDA loaded `ida_mcp` plugin
- Verify port 13337 is not occupied: `netstat -ano | findstr 13337`
### 2. "Cannot create code signature for data"
**Cause:** Target address is in data section, not code section
**Solution:**
- Ensure address points to code segment
- Use IDA's `C` key to convert data to code
- Or use xref signatures for indirect location
### 3. "Signature not unique"
**Cause:** Generated signature has multiple matches in binary
**Solution:**
- Increase `max_length` parameter
- Use `generate_xref_signatures` for caller-based signatures
- Manually adjust signature pattern
### 4. "Module 'sigmaker' not found"
**Cause:** `SIGMAKER_PATH` environment variable not set or incorrect path
**Solution:**
- Set environment variable: `export SIGMAKER_PATH="D:\ida-sigmaker-mcp"`
- Or add `env` field in OpenCode configuration
### 5. MCP server not started
**Cause:** OpenCode configuration error or Python path error
**Solution:**
- Check `opencode.json` configuration file path
- Ensure Python is in PATH: `python --version`
- View OpenCode logs: `~/.config/opencode/logs/`
## Performance Optimization
- **Persistent connection:** MCP server uses persistent subprocess connection to avoid starting new processes for each call
- **Batch operations:** Use `batch_generate_signatures` for batch signature generation to reduce RPC overhead
- **Timeout setting:** Increase `timeout` value for large binary analysis
## Acknowledgements
- **IDA SigMaker**: Based on [@A200K](https://github.com/A200K/IDA-Pro-SigMaker) IDA Pro SigMaker project
- **Original Python version**: [@mahmoudimus](https://github.com/mahmoudimus/ida-sigmaker)
- **MCP protocol**: [Model Context Protocol](https://modelcontextprotocol.io/)
- **OpenCode**: [OpenCode MCP documentation](https://www.opencode.asia/ecosystem/mcp-servers/)
## License
Same license as the main IDA SigMaker project. See [LICENSE](../LICENSE).
