Skip to content

Conversation

@0xeb
Copy link
Member

@0xeb 0xeb commented Jan 30, 2026

Summary

  • Add search_bytes() and search_first() SQL functions for binary pattern matching
  • Add --config CLI flag for persistent settings
  • Enable AI agent by default
  • Add convenience views: callers, callees, string_refs for common xref queries
  • Update agent prompt with documentation

New Features

Binary Search Functions

SELECT search_bytes('48 8B ?? 00');  -- Returns JSON array of matches
SELECT search_first('CC CC CC');     -- Returns first match address or NULL

CLI Config

idasql --config set ai.provider claude
idasql --config get ai.provider

Convenience Views

-- Who calls a function?
SELECT caller_name FROM callers WHERE func_addr = 0x401000;

-- What does a function call?
SELECT callee_name FROM callees WHERE func_name LIKE '%main%';

-- Find functions by string content
SELECT func_name FROM string_refs WHERE string_value LIKE '%error%';

Test plan

  • Build and run existing tests
  • Test search_bytes with various patterns
  • Test views return expected columns and data
  • Test --config flag

0xeb added 5 commits January 28, 2026 23:12
- Add ctree_v_returns view documentation with example queries
- Update types_func_args with 16 new type classification columns:
  - Surface: is_ptr, is_int, is_integral, is_float, is_void, is_struct, is_array
  - Resolved: is_ptr_resolved, is_int_resolved, is_integral_resolved, etc.
- Add function signature query patterns section
- Update summary table with new capabilities
- Add --config [path] [value] CLI option to view/set agent configuration
- Support provider-specific BYOK paths: agent.byok.{claude,copilot}.{enabled,key,endpoint,model,type}
- Enable IDASQL_WITH_AI_AGENT=ON by default
- Add search_bytes(pattern) - returns JSON array of matches
- Add search_bytes(pattern, start, end) - range-limited search
- Add search_first(pattern) - returns first match address or NULL
- Support IDA pattern syntax: wildcards (?, ??), alternatives ((01 02))
- Update agent prompt with search examples and RDTSC optimization pattern
- Fix HTTP build with XSQL_HAS_THINCLIENT define
Add pre-built SQL views for common xref analysis patterns:
- callers: who calls each function
- callees: what each function calls
- string_refs: which functions reference which strings

These views simplify common queries and avoid the need for
complex JOINs between xrefs and funcs tables.

Also update agent prompt with documentation and examples.
@0xeb 0xeb merged commit 35157df into main Jan 30, 2026
14 checks passed
@0xeb 0xeb deleted the feat/consolidated branch January 30, 2026 20:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants