IDA Domain API

The IDA Domain API is an open-source Python API designed to provide domain-focused abstractions for reverse engineering tasks in IDA. It treats core concepts like functions, types, and cross-references (xrefs) as first-class citizens to make scripting more natural and consistent.

Key Characteristics:

• Complementary to IDA Python SDK: It sits on top of the existing SDK. You can use both side-by-side, combining the Domain API's simplicity with the SDK's full flexibility.
• Pure Python: No compilation is required, and it works with modern Python versions.
• Independently Versioned: You can upgrade or pin versions independently of IDA itself.
• Compatibility Requirement: Requires IDA Pro 9.1.0 or later.

The IDA Domain API is designed to be fully compatible with the standard IDA Python SDK. You can use ida_domain for high-level domain analysis and fall back to native ida_ modules (like ida_funcs, ida_name, etc.) when you need specific low-level SDK functionality. This allows you to use IDA Domain objects (like a function object) and pass their attributes (like start_ea) directly into SDK functions.

import ida_domain
import ida_funcs

db = ida_domain.Database()
db.open('/path/to/your/database.idb')

# Iterate using ida_domain and call IDA Python SDK functions
for i, func in enumerate(db.functions.get_all()):
    print(ida_funcs.get_func_name(func.start_ea))

The ida-domain package can be used both inside and outside of the IDA environment.

• Inside IDA: When running within an IDA plugin or the IDA Python console, the API works with the currently opened IDB (IDA Database).
• Outside IDA: It can be used transparently in external scripts, provided the IDA environment is correctly configured/registered.

When running scripts from within the IDA GUI (e.g., via the IDA console), you do not need to provide a file path. Call Database.open() with no arguments to obtain a handle to the currently active database.

from ida_domain import Database
# Get handle to the currently open database
db = Database.open()

The Domain API replaces tuple-based entry enumeration with db.entries.get_all(), which yields EntryInfo dataclass objects. Use the properties of EntryInfo instead of manual unpacking.

EntryInfo fields:

• ordinal: export ordinal number
• address: address of entry point
• name: entry point name
• forwarder_name: forwarder name (or empty string)

Use entry.has_forwarder() to check for forwarders.

# After migration
def extract_exports(db: Database):
    for entry in db.entries.get_all():
        if entry.has_forwarder():
            yield Export(entry.forwarder_name), entry.address
        else:
            yield Export(entry.name), entry.address

The IDA Domain API provides capabilities for opening, exploring, and traversing an IDA database. Common tasks include:

• Opening and exploring a database.
• Performing a complete traversal of all elements within a database.

The project provides documentation in a format optimized for Large Language Models (LLMs) following the llmstxt.org convention. This allows AI coding agents and LLMs to ingest the project's documentation more efficiently.

You can access these files at:

• /llms.txt: A concise version of the documentation.
• /llms-full.txt: A comprehensive version containing the full documentation.