AETHER - AI-Powered IDA Pro Reverse Engineering Plugin

<em>
An AI-powered reverse-engineering copilot for assisting tedious malware analysis in IDA Pro.
</em>

---

Table of Contents

• Overview
• Key Features
• Improvements over Raw IDA Pro MCP
• Requirements
• Installation
• Manual Installation
• How to Run
• Usage Examples
• Dependencies
• Documentation
• Limitations
• Authors/Maintainers
• License
• Acknowledgments
• Sources

---

Overview

AETHER is an advanced IDA Pro plugin that integrates Large Language Models (LLMs) into your reverse engineering workflow. It automates time-consuming tasks like function annotation, variable renaming, structure creation and contextual analysis, allowing security analysts to focus on deeper malware analysis and threat assessment.

The plugin leverages the IDA Pro Model Context Protocol (MCP) to communicate with LLMs while efficiently managing context and tokens. It is specifically designed for malware analysis, vulnerability research, and binary reverse engineering.

---

Key Features

1. Intelligent Annotation System

• Automatically add meaningful comments to functions and code sections
• Rename variables and function names to improve code readability
• Support for fast annotation mode for quick analysis
• Undo/Redo functionality for annotation changes

2. Smart Function Context Gathering

• Selectively gather function call hierarchies for AI analysis
• LLM intelligently selects which functions to analyze in context
• Displays function call trees to understand code relationships

Example call tree: start [0x10f0] └── main [0x1240] ├── sub_11E0 [0x11e0] └── sub_1F90 [0x1f90] ├── sub_1660 [0x1660] │ └── sub_1340 [0x1340] ├── sub_18F0 [0x18f0] └── sub_1C00 [0x1c00] └── sub_1BA0 [0x1ba0]

3. Real-Time Analysis

• Fast analysis mode for quick function insights
• Real-time annotation with LLM-generated corrections
• Streaming analysis for immediate feedback
• Smart Select analysis for LLM-guided function selection

4. Structural Analysis

• Automatic structure creation and identification
• Structure annotation and field naming
• Structure member analysis and documentation
• Struct update and refinement support for existing structs
• Struct agent tooling to apply inferred structs to variables or addresses

5. Customizable Analysis

• User-defined custom prompts for specific analysis needs
• Multiple LLM model selection
• Configuration management for different analysis profiles
• Retry analysis with different parameters

6. Batching, Indexing & Automation

• Analyze multiple functions in batch mode
• Automated context selection and gathering
• Efficient token usage through context management
• Full-binary function indexing with resumable background processing
• Searchable function index for chatbot-assisted triage and lookup
• Python script generation for IDAPython automation and deobfuscation tasks

7. Copilot - Interactive AI Assistant

• Multi-turn Conversation: Inquire LLM for clarifications and follow-up questions
• Context Management: Select functions as context for intelligent analysis
• Code Summarization: Get concise summaries of complex code sections
• Natural Language Queries: Ask questions about function behavior and logic
• Tool Controls: Choose which chatbot tools are available for a session
• Index Agent: Ask questions against a pre-built function index

8. Experimental Analysis Tools

• Report Generator: Generate Markdown malware-analysis reports for selected function context
• AI Unflatten: Deobfuscate flattened control flow and display cleaned pseudocode in a dedicated viewer
• Auto-Analyze Binary: Start broader automated analysis workflows from the pseudocode context menu

---

Improvements over Raw IDA Pro MCP

• Context Management: Intelligently manages LLM context window to maximize analysis quality
• Optimized Prompting: Specialized prompts engineered for reverse engineering tasks
• Token Efficiency: Reduces token consumption while maintaining analysis quality
• One-Shot Tool Usage: Minimizes API calls through efficient tool interaction
• IDA Integration: Seamless integration with IDA Pro UI and workflows
• Undo/Redo Support: Track and revert AI-generated changes
• Multi-Model Support: Works with multiple LLM providers and models

---

Requirements

Minimum System Requirements

• Operating System: Windows, Linux, or macOS
• Python: 3.11 or higher
• IDA Pro: Version 9.0 or above
• Tested on IDA Pro 9.1 and 9.2

API Requirements

• LLM API Key: An OpenRouter API Key is required by default.
  • Provider Flexibility: While pre-configured for OpenRouter, Aether supports any OpenAI-compatible API.
  • You can customize the provider by editing the DEFAULT_CONFIG in your settings
• Network: Internet connection for LLM API calls (or local LLM server setup)

Others

• MCP Server: ida-pro-mcp server version 1.5.0a8 (installed automatically during setup)

---

Installation

Automatic Installation of ida-pro-mcp & AETHER (Recommended)

There are currently 2 methods of installation, online & offline versions.

The key differences between the two is the the online version downloads necessary dependencies while the offline version assumes ALL dependencies have been installed and checks for them.

Run the following after going into the directory /scripts.

Windows

# Using execution policy bypass (recommended)
powershell -executionpolicy bypass -file .\install.ps1

# OR if your execution policy is already set to Unrestricted
.\install.ps1

# For verbose output and troubleshooting
powershell -executionpolicy bypass -file .\install.ps1 -Verbose

Linux / Ubuntu

chmod +x install.sh
./install.sh

# For verbose output and troubleshooting
./install.sh -v

Post-Installation Configuration

After running the installation script:

1. Start the MCP Server in a new terminal/console and run: ida-pro-mcp --transport http://127.0.0.1:8744/sse
2. Open IDA Pro and load any binary file
3. Open Pseudocode View (Press Tab)
4. Right-click and select AETHER AI-RE > Plugin settings
5. Enter your API credentials:
6. API Key: Your LLM provider API key (e.g., OpenAI API key)
7. Base URL: The API endpoint (e.g., https://api.openai.com/v1)
8. Model: The model name (e.g., gpt-4-turbo, gpt-3.5-turbo)
9. Click "Test Configuration" to verify your setup. It should look like this:

1. Save your configuration
2. Continue using Aether plugin. See How to Run section.

NOTE that only 1 instance of IDA may be running at a time.

---

Manual Installation

For developers or advanced users who prefer manual setup:

1. Clone this repository: bash git clone https://github.com/CSIT-SG/AETHER cd AETHER

2. Install IDA Pro MCP (Local Wheel): Ensure the .whl file is located in your packages directory, then run: bash pip install ./scripts/packages/ida_pro_mcp-1.5.0a8-py3-none-any.whl

3. Install AETHER dependencies: bash pip install -r requirements.txt

4. Switch IDA Python environment (if needed): bash idapyswitch

5. Verify IDA Python and plugin environment match

---

How to Run

Use AETHER Features

In IDA Pro, navigate to the Pseudocode View (Tab key) and right-click to access AETHER features:

• Fast Analysis: Quickly annotate only the current function for rapid triage
• Batch Analysis: Analyze a function tree or manually selected function set, and annotate selected functions
• Smart Select Analysis: Let AI pick out more important functions to analyze that are related to current function for annotation
• Struct Creator: Infer and create a struct for the highlighted variable, then apply it in IDA
• Experimental > Report Generator: Generate a report on the current function
• Experimental > AI Unflatten: Deobfuscate flattened control flow and present cleaner pseudocode for review
• Experimental > Auto-Analyze Binary: Start wider automated binary analysis workflows
• Indexing Binary: Build a searchable function index with categories and importance levels for faster context retrieval
• Chatbot: Use natural-language queries with tool-assisted lookups and indexed context for interactive analysis (for index, index binary before running chatbot for best effect)
• Python Script Generation: Chatbot can call upon tool generate_python_script to create scripts for deobfuscation or other purposes
• Settings: Configure API keys and analysis parameters

---

Usage Examples

Auto-Annotating a Function

1. Right-click on a function in Pseudocode View
2. Select AETHER AI-RE > Annotate only this Function
3. AETHER will:
4. Analyze the function logic
5. Generate meaningful variable names
6. Add explanatory comments
7. Apply changes to IDA Pro
8. Use Undo latest annotation if you want to revert changes

Batch Analyzing a Call Chain

1. Right-click on a function in Pseudocode View
2. Use AETHER AI-RE > Annotate function tree with default selection to build call tree
3. Select functions within the call tree that should be excluded/included
4. AETHER processes the entire call chain with intelligent context management

Indexing a Binary and Reviewing Results

1. Right-click in Pseudocode View and open AETHER AI-RE > Indexing > Index Binary
2. Wait for indexing to complete. A completion popup will show how many functions were classified.
3. Open AETHER AI-RE > Indexing > Index Statistics to review:
4. Total indexed functions
5. Batch progress and token usage
6. Importance/category breakdown
7. The exact Index file: path at the bottom of the statistics dialog
8. To find the index file on disk:
9. Copy the path shown in Index Statistics and open it with your file manager/editor, or
10. Go to the default index directory:
    • Windows: %LOCALAPPDATA%\\AETHER-IDA\\indexes\\
    • Linux/macOS: ~/.idapro/ainalyse-indexes/
11. The file is stored as <program_identifier>.json.
12. If the binary changes significantly or tags look outdated, run AETHER AI-RE > Indexing > Re-index Binary.
13. This clears the previous index and rebuilds it from scratch.
14. If indexing is interrupted, use Resume Indexing to continue from saved progress.

Generating a Report

1. Right-click in Pseudocode View and open AETHER AI-RE > Experimental > Generate Report on this function
2. AETHER gathers the selected function context and asks the configured LLM to produce a Markdown report.
3. Review the generated report beside the binary and validate any detection logic before operational use.

AI Unflatten

1. Right-click in Pseudocode View and open AETHER AI-RE > Experimental > AI Unflatten
2. AETHER sends the current function pseudocode through the unflattening workflow.
3. Review the generated cleaned pseudocode in the AI Unflattener viewer.

Python Script Generation from Chatbot

1. Open AETHER AI-RE > Open AI Chatbot
2. Ask the chatbot to generate an IDAPython script for a specific function and objective.
3. The generate_python_script tool opens an interactive script window where generated code can be reviewed, regenerated, and run.

Custom Prompt Analysis

1. Right-click on a function in Pseudocode View
2. Select AETHER AI-RE > AInalyse (advanced options)
3. Enter your custom prompt (e.g., "Find all potential vulnerabilities in this code")
4. AETHER analyzes the function using your custom instructions

Automatic Structure Creation

1. In IDA Pro's Pseudocode View, click on a variable and highlight it
2. Right-click and select AETHER AI-RE > Create struct for highlighted variable (or press Ctrl+Alt+V)
3. AETHER will:
4. Analyze the variable and its usage patterns across the function
5. Identify structure members and their offsets
6. Determine field types based on code context
7. Create a properly formatted C structure definition
8. Automatically apply the struct type to the variable in IDA Pro
9. Review and refine the created structure in IDA's struct view if needed

Limitations: - Works best with variables that have clear access patterns (e.g., var->member or var[offset]) - Requires sufficient context within the function to infer member types accurately - May struggle with complex nested structures or opaque variable usage - Manual review recommended for critical reverse engineering tasks

Interactive AI Copilot

1. Right-click in Pseudocode View and select AETHER AI-RE > Open AI Chatbot
2. A dedicated Chatbot panel opens with conversation interface
3. Ask Questions - Type natural language questions about th