Automatic rules-based binary analysis with IDA Pro and CLIPS

Ryan Hicks AVG

IDA Pro is the premier disassembler used by reverse-engineering and malware analysis specialists. CLIPS is a highly regarded expert system available in the public domain. These two tools combined can produce a means of automatically analysing binary files that can greatly speed up the sample intake and classification process, thus reducing researcher workload.

The makers of IDA Pro provide a C++ based plug-in SDK that gives access to its internal database. This database contains disassembly information about the binary under analysis. By feeding this information into a CLIPS knowledge base, it is possible to determine the disposition of samples.

First, this paper this will give an overview of the IDA Pro SDK, CLIPS, and the steps necessary to connect the two. Next, it will show which IDA Pro database structures are of interest to malware researchers and how to create CLIPS rules that are of use in analysing binaries in a malware research context. Lastly, usage hints and sample code will be provided.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.