<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# IDA/Ghidra Scripts — API Reference

## IDAPython Core API

```python
import idautils, idaapi, idc

# Iterate all functions
for func_ea in idautils.Functions():
    name = idc.get_func_name(func_ea)
    func = idaapi.get_func(func_ea)
    print(f"{hex(func_ea)} {name} size={func.size()}")

# Cross-references to address
for xref in idautils.XrefsTo(ea):
    print(f"  from {hex(xref.frm)} type={xref.type}")

# Read bytes at address
data = idc.get_bytes(ea, 16)

# Set function name
idc.set_name(ea, "decrypted_string_func", idc.SN_FORCE)

# Add comment
idc.set_cmt(ea, "XOR key: 0x41", 0)
```

## Ghidra Scripting API

```python
# Ghidra headless analysis
# analyzeHeadless /tmp/project proj -import binary -postScript script.py

from ghidra.program.model.listing import CodeUnit

# Get all functions
fm = currentProgram.getFunctionManager()
for func in fm.getFunctions(True):
    print(f"{func.getEntryPoint()} {func.getName()} size={func.getBody().getNumAddresses()}")

# Get references to function
refMgr = currentProgram.getReferenceManager()
refs = refMgr.getReferencesTo(func.getEntryPoint())

# Read memory bytes
mem = currentProgram.getMemory()
buf = bytearray(16)
mem.getBytes(addr, buf)

# Decompile function
from ghidra.app.decompiler import DecompInterface
decomp = DecompInterface()
decomp.openProgram(currentProgram)
result = decomp.decompileFunction(func, 30, monitor)
print(result.getDecompiledFunction().getC())
```

## Capstone Disassembly Engine

```python
from capstone import Cs, CS_ARCH_X86, CS_MODE_32, CS_MODE_64, CS_ARCH_ARM

# x86-64
md = Cs(CS_ARCH_X86, CS_MODE_64)
for insn in md.disasm(code, 0x400000):
    print(f"{hex(insn.address)}: {insn.mnemonic} {insn.op_str}")

# ARM
md = Cs(CS_ARCH_ARM, CS_MODE_ARM)
```

## Unicorn Emulation Engine

```python
from unicorn import Uc, UC_ARCH_X86, UC_MODE_64
from unicorn.x86_const import UC_X86_REG_RAX, UC_X86_REG_RSP

mu = Uc(UC_ARCH_X86, UC_MODE_64)
mu.mem_map(0x400000, 0x1000)      # Map code
mu.mem_map(0x500000, 0x1000)      # Map stack
mu.mem_write(0x400000, code)       # Write code
mu.reg_write(UC_X86_REG_RSP, 0x500800)
mu.emu_start(0x400000, 0x400000 + len(code))
result = mu.reg_read(UC_X86_REG_RAX)
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Analysis completed, no suspicious indicators |
| 1 | Suspicious APIs or encrypted strings found |
| 2 | Runtime error or unsupported binary format |
