# IDAPluginList: a categorised catalogue of IDA Pro plugins > IDAPluginList is a running index of IDA plugins, grouped by the job you are trying to do: finding vulnerabilities in a binary, refactoring decompiled code, making the interface easier, or driving the analysis with an AI assistant. Every entry carries the project address, and the repository keeps a directory per plugin that it clones on a daily schedule. **HACK-THE-WORLD/IDAPluginList** — IDA插件集合，含项目名称及项目地址，每日定时Clone项目。 - Repository: https://github.com/HACK-THE-WORLD/IDAPluginList - Stars: 562 · Forks: 62 - Language: Python - License: not declared - Published: 2026-10-22 · Updated: 2026-10-22 · Language: en - Canonical page: https://hysenlabs.com/projects/hack-the-world-idapluginlist ## A list organised by task, not by popularity IDAPluginList is a collection of IDA plugins with the project names and their addresses, and that is the whole of it. The repository description says as much in a single line, and adds that the projects are cloned on a daily schedule. The organising idea is the tag list at the top of the README, which divides the entries into four groups. Security, Code, Enhancement, and a fourth group called AI+ that covers plugins built around large language models. The README is written in Chinese and the tags are rendered as links to the sections below them. What this kind of list is for is worth stating plainly. IDA has a large plugin ecosystem, and the plugins are spread across separate repositories under different authors with different licence terms and different assumptions about which IDA versions they work with. A catalogue that groups them by the task at hand is a discovery aid. The grouping here is not alphabetical and not by author, and there is no ranking by stars or downloads, which is a deliberate choice about what the list is for: finding the plugin that does the thing you need, rather than finding the popular one. The audience is therefore a reverse engineer or malware analyst in the middle of a task, with a specific problem in front of them. A list organised by task serves that person better than a search box over plugin names would. The repository language is Python, the default branch is main, and the project has no GitHub releases and no homepage of its own. ## The security entry, and what it is aimed at The Security category holds one entry, and it is the one with the clearest institutional provenance: VulFi, from Accenture, described as a plugin that assists in finding vulnerabilities in binaries. Placing it alone in its own category rather than folding it into the code group says something about how the list treats it. Vulnerability assistance is a different goal from the rest of the entries. Most plugins here make the analysis faster or the output more readable, and VulFi is aimed at the outcome of the analysis, which is a finding about the binary rather than a finding about the code. There is one link in this category and it is worth pointing at directly: ```bash https://github.com/Accenture/VulFi ``` A single entry is a small sample, and it is worth being honest that the list's category balance does not tell you much about the size of the IDA plugin ecosystem. The Security section is thin because the category is narrow, not because the category is well served. For anyone using the list, the practical habit it supports is to look in the category that matches your goal rather than at the repository as a whole, and then to read the plugin's own documentation, since each project is independent and the list does not summarise what any of them do beyond a phrase. ## Refactoring, renaming, finding crypto constants and patching The Code category is the largest, with six entries, and it covers the work that happens once you have decompiled a binary and start reading it. HexRaysCodeXplorer from REhints is described as a plugin that can automatically refactor C++ applications or modern malware, which is a specific and valuable target, since decompiled C++ is where the decompiler output is hardest to read. auto_re from a1ext is an automatic renaming plugin with tag support, which is the mechanism for propagating a name you have worked out to every occurrence of that symbol. findcrypt-yara from polymorf finds the contents of encryption constants, and more, which saves the analyst from searching for the S-box by eye. patching from gaasedelen is an interactive binary patching plugin, so you can change bytes and see the effect without leaving the tool. keypatch from the keystone engine is a multi-architecture assembler editor, which is the piece that makes interactive patching practical across instruction sets. And symless from thalium reconstructs the structures, classes and virtual function tables used in a binary, which is what turns a flat decompiled listing back into something resembling the original types. Those six entries cover a coherent workflow: rename what you recognise, rebuild the types, find the cryptography, patch what needs patching. The addresses are the deliverable of this list: ```bash https://github.com/REhints/HexRaysCodeXplorer https://github.com/thalium/symless https://github.com/polymorf/findcrypt-yara ``` The Keystone one is worth calling out because the name of the upstream project gives it away: a Keystone engine plugin is an assembler that supports many architectures, and using it inside IDA means the patch you write does not have to be typed in the target's own instruction set by hand. ## Reading Go binaries, tidying pseudocode and grouping functions The Enhancement category is the longest one, with ten numbered entries, and it covers everything from Go-specific analysis to making the interface less tiresome. Two of them are about Go. AlphaGolang from SentinelLabs is for analysing Go binaries, and IDAGolangHelper from sibears parses the Go type information stored in a compiled binary. Those are related but distinct, and the pairing makes sense: one plugin helps you see the shape of a Go program, the other recovers the type data that a Go binary carries. Four are about making output and navigation better. IDABeautify from P4nda0s makes the pseudocode prettier. CTO from herosi creates a simple and efficient function call tree diagram. IdaClu from harlamism groups similar functions together, which is the feature that turns a large function list into something navigable when you are hunting for a family of similar routines. And LazyIDA from L4ys is described as letting you use IDA more lazily, which is a friendly way of saying it removes steps from the repetitive parts of the interface. Two are about identification and output. Finger from aliyunav identifies functional symbols, so a library function can be recognised by what it does rather than by the name the compiler gave it. FuncExporter from gh0stkey exports all pseudocode, call logic and similar information in one action, which is what you want when the output is going into a report or into another tool. And Gepetto from JusticeRage uses ChatGPT to help IDA with decompilation. It sits at the edge of the AI group, which is where the list puts the AI-assisted work: ```bash https://github.com/SentineLabs/AlphaGolang https://github.com/gh0stkey/FuncExporter ``` One detail in this category is a small sign of how the list is maintained by hand. The numbering runs 1 through 9 and then jumps to 12, so the sequence is missing two numbers. That is harmless, and it does suggest the list is edited as things are added rather than regenerated from a structured source. ## The two AI entries, and what the MCP one changes The AI+ category is the newest group and the smallest, with two entries, and they point in different directions. ida-pro-mcp from mrexodia is an MCP service based on IDA, for assisting reverse engineering with AI. The MCP part is the significant detail. The Model Context Protocol is the convention that lets an AI assistant call tools exposed by another program, so an MCP service inside IDA means the assistant can query the database, look up names and functions and navigate the analysis, rather than receiving a screenshot or a pasted listing. The difference is between an assistant that can comment on a decompiled function and one that can go and find the function itself. OpenReCopilot from WinMin is the second entry, an AI-based binary analysis assistance tool. It sits in the same category with a different framing: assistance rather than a protocol bridge. The category is worth watching for a practical reason. The two entries answer two different questions. One asks whether the assistant can be given programmatic access to the tool, the other asks whether the tool can host an assistant. A list that keeps them in separate categories rather than in one AI bucket is making a small distinction that is probably going to matter more as this area develops. The addresses: ```bash https://github.com/mrexodia/ida-pro-mcp https://github.com/WinMin/OpenReCopilot ``` Neither entry is described in more than a phrase here, so anyone adopting one should read that project's own documentation for the model configuration, the data handling and the limits, none of which the list addresses. ## Every plugin has a directory, which changes what the list is The top level of the repository is the part that tells you this is more than a Markdown file. There is a directory for each entry in the README: AlphaGolang, CTO, Finger, FuncExporter, Gepetto, HexRaysCodeXplorer, IDABeautify, IDAGolangHelper, IdaClu, LazyIDA, OpenReCopilot, VulFi, auto_re, findcrypt-yara, ida-pro-mcp, keypatch, patching, pdb and symless. The names match the projects one for one, in the order they appear in the list. That is consistent with the repository description, which says the projects are cloned on a daily schedule, and with the .github/ directory at the root, which is where the workflow that does it would live. So the list is not only a curated set of addresses, it is a mirror of the projects themselves, refreshed on a schedule. The practical consequence is that you can read the source of any plugin without leaving the repository, and the snapshot tells you what the project looked like at the moment of the clone. It also means the repository is large and moves constantly, with upstream changes arriving as commits in directories that are not yours. The pdb entry is the one case where the directory list and the README list need a second look. The README describes a PDB plugin repair and enhancement, and the directory is named pdb, so the correspondence holds, but it is worth checking the address in the README for that entry when you clone it, since the directory name alone does not tell you the upstream owner. None of this makes the list wrong, but it does make it a different kind of artefact from a curated table of links, and it explains why there is no release history: there is nothing here to release, only a mirror that refreshes. ## What the list does not tell you, and how to use it anyway The gaps are specific, and they are the reason the list works as a discovery aid rather than as a selection tool. There is no licence information. The repository's own licence is recorded as unknown, and the list says nothing about the licence of any individual plugin. That matters more than it sounds, because a plugin runs inside your analysis environment and the licences in this ecosystem range from permissive to copyleft to no licence at all. You have to go and look at each project. There is no version information and no IDA compatibility information. A plugin written for a particular IDA release will not necessarily work on a newer one, and the list does not record which release a plugin was last tested against. There is no installation guidance either, so the sequence of steps for each plugin has to be read from its own documentation. And the descriptions are one line each, in Chinese, with no summary of what a plugin does internally. For a reader who does not read Chinese, that means the categories are the usable part of the README and the addresses are the rest. The alternative approach is the obvious one: find the plugin repositories yourself, through a search, and use them directly. The difference in approach is that this list gives you a curated grouping by task and a daily refreshed copy of each project, so you can compare candidates for the same job side by side instead of guessing at search results. What it cannot do is tell you which of them to trust. The sensible way to use it is as a first pass: pick the category that matches your problem, open the two or three candidate projects, check their licences and their IDA version support, and then work with the plugin that fits. The list has already done the part that takes longest, which is finding the candidates at all. ## Conclusion IDAPluginList suits a reverse engineer who knows what problem they have, whether finding crypto constants, patching a binary, decompiling Go or wiring an AI assistant into the analysis, and who wants the candidate projects in one screen instead of searching for them. It does not suit somebody who needs to judge which plugin to trust, since the entries are one-line descriptions with no licence, version or IDA compatibility information, and the repository itself carries no declared licence. Check three things before you take a plugin from the list: the licence of the plugin's own repository, since each project has its own terms and this list does not state them, whether the plugin supports your IDA version, and whether the daily clone means you are looking at a fresh copy rather than a release. The last push to the repository was on 2026-10-18 and the project publishes no GitHub releases. ## FAQ ### What is IDAPluginList? It is a collection of IDA plugins with their project names and addresses, organised into four tagged categories: security, code, enhancement and AI. The repository also keeps a directory per plugin and clones the projects on a daily schedule. ### Which IDA plugins are in the list? The entries include VulFi from Accenture for finding vulnerabilities in binaries, HexRaysCodeXplorer for refactoring decompiled C++, auto_re for tagged renaming, findcrypt-yara for encryption constants, patching and keypatch for interactive binary patching, symless for rebuilding structures and vtables, AlphaGolang and IDAGolangHelper for Go binaries, IDABeautify, CTO, IdaClu, Finger, LazyIDA, Gepetto, FuncExporter, ida-pro-mcp and OpenReCopilot. ### What is the ida-pro-mcp plugin? It is an MCP service based on IDA, for assisting reverse engineering with AI, and it is listed in the AI+ category alongside OpenReCopilot, an AI-based binary analysis assistance tool. The list describes both in a single phrase each, so the project documentation is where the details are. ### Does IDAPluginList tell me which plugin to use? No. Each entry has a one-line description, and the list records no licence, version, IDA compatibility or installation details, so those have to be checked in each plugin's own repository. The grouping by task is the part intended to help you narrow the field. ### How is the IDAPluginList repository maintained? The repository description states that the listed projects are cloned on a daily schedule, and the top level contains one directory per plugin alongside a .github/ directory. The project has no GitHub releases and no declared licence of its own. ## Sources - [HACK-THE-WORLD/IDAPluginList on GitHub](https://github.com/HACK-THE-WORLD/IDAPluginList) - [Issues](https://github.com/HACK-THE-WORLD/IDAPluginList/issues) - [README](https://github.com/HACK-THE-WORLD/IDAPluginList/blob/main/README.md) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/hack-the-world-idapluginlist