{"id":25037979,"url":"https://github.com/0xdea/haruspex","last_synced_at":"2026-02-20T10:02:29.524Z","repository":{"id":264166015,"uuid":"890405371","full_name":"0xdea/haruspex","owner":"0xdea","description":"Vulnerability research assistant that extracts pseudocode from the IDA Hex-Rays decompiler.","archived":false,"fork":false,"pushed_at":"2026-02-18T10:41:38.000Z","size":143801,"stargazers_count":101,"open_issues_count":0,"forks_count":8,"subscribers_count":3,"default_branch":"master","last_synced_at":"2026-02-18T15:03:56.835Z","etag":null,"topics":["ida-plugin","ida-pro","idalib","reverse-engineering","vulnerability-research"],"latest_commit_sha":null,"homepage":"https://hex-rays.com/ida-pro","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xdea.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":3562}},"created_at":"2024-11-18T14:09:55.000Z","updated_at":"2026-02-18T10:41:42.000Z","dependencies_parsed_at":"2025-01-08T07:33:51.054Z","dependency_job_id":"00b40aad-128c-4747-ac9c-db417d99e208","html_url":"https://github.com/0xdea/haruspex","commit_stats":null,"previous_names":["0xdea/haruspex"],"tags_count":29,"template":false,"template_full_name":null,"purl":"pkg:github/0xdea/haruspex","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xdea","download_url":"https://codeload.github.com/0xdea/haruspex/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29647768,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-20T09:27:29.698Z","status":"ssl_error","status_checked_at":"2026-02-20T09:26:12.373Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ida-plugin","ida-pro","idalib","reverse-engineering","vulnerability-research"],"created_at":"2025-02-06T02:01:27.826Z","updated_at":"2026-02-20T10:02:29.518Z","avatar_url":"https://github.com/0xdea.png","language":"Rust","readme":"# haruspex\n\n[![](https://img.shields.io/github/stars/0xdea/haruspex.svg?style=flat\u0026color=yellow)](https://github.com/0xdea/haruspex)\n[![](https://img.shields.io/crates/v/haruspex?style=flat\u0026color=green)](https://crates.io/crates/haruspex)\n[![](https://img.shields.io/crates/d/haruspex?style=flat\u0026color=red)](https://crates.io/crates/haruspex)\n[![](https://img.shields.io/badge/ida-9.3-violet)](https://hex-rays.com/ida-pro)\n[![](https://img.shields.io/badge/twitter-%400xdea-blue.svg)](https://twitter.com/0xdea)\n[![](https://img.shields.io/badge/mastodon-%40raptor-purple.svg)](https://infosec.exchange/@raptor)\n[![build](https://github.com/0xdea/haruspex/actions/workflows/build.yml/badge.svg)](https://github.com/0xdea/haruspex/actions/workflows/build.yml)\n[![doc](https://github.com/0xdea/haruspex/actions/workflows/doc.yml/badge.svg)](https://github.com/0xdea/haruspex/actions/workflows/doc.yml)\n\n\u003e \"Hacking is the discipline of questioning all your assumptions all of the time.\"\n\u003e\n\u003e -- Dave Aitel\n\nHaruspex is a blazing fast IDA Pro headless plugin that extracts pseudocode generated by IDA Pro's\ndecompiler in a format that should be suitable to be imported into an IDE, or parsed by static\nanalysis tools such as [Semgrep](https://semgrep.dev/), [weggli](https://github.com/weggli-rs/weggli),\nor [oneiromancer](https://crates.io/crates/oneiromancer).\n\n![](https://raw.githubusercontent.com/0xdea/haruspex/master/.img/screen01.png)\n\n## Features\n\n* Blazing fast, headless user experience courtesy of IDA Pro 9.x and Binarly's idalib Rust bindings.\n* Support for binary targets for any architecture implemented by IDA Pro's Hex-Rays decompiler.\n* Pseudocode of each function is stored in a separated file in the output directory for easy inspection.\n* External crates can invoke [`decompile_to_file`] to decompile a function and save its pseudocode to disk.\n\n## Blog posts\n\n* \u003chttps://hex-rays.com/blog/streamlining-vulnerability-research-idalib-rust-bindings\u003e\n* \u003chttps://hnsecurity.it/blog/streamlining-vulnerability-research-with-ida-pro-and-rust\u003e\n\n## See also\n\n* \u003chttps://github.com/0xdea/ghidra-scripts/blob/main/Haruspex.java\u003e\n* \u003chttps://github.com/0xdea/semgrep-rules\u003e\n* \u003chttps://github.com/0xdea/weggli-patterns\u003e\n* \u003chttps://docs.hex-rays.com/release-notes/9_0#headless-processing-with-idalib\u003e\n* \u003chttps://github.com/idalib-rs/idalib\u003e\n* \u003chttps://github.com/xorpse/parascope\u003e\n* \u003chttps://hnsecurity.it/blog/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep\u003e\n\n## Installing\n\nThe easiest way to get the latest release is via [crates.io](https://crates.io/crates/haruspex):\n\n1. Download, install, and configure IDA Pro (see \u003chttps://hex-rays.com/ida-pro\u003e).\n2. Install LLVM/Clang (see \u003chttps://rust-lang.github.io/rust-bindgen/requirements.html\u003e).\n3. On Linux/macOS, install as follows:\n    ```sh\n    export IDADIR=/path/to/ida # if not set, the build script will check common locations\n    cargo install haruspex\n    ```\n   On Windows, instead, use the following commands:\n    ```powershell\n    $env:LIBCLANG_PATH=\"\\path\\to\\clang+llvm\\bin\"\n    $env:PATH=\"\\path\\to\\ida;$env:PATH\"\n    $env:IDADIR=\"\\path\\to\\ida\" # if not set, the build script will check common locations\n    cargo install haruspex\n    ```\n\n## Compiling\n\nAlternatively, you can build from [source](https://github.com/0xdea/haruspex):\n\n1. Download, install, and configure IDA Pro (see \u003chttps://hex-rays.com/ida-pro\u003e).\n2. Install LLVM/Clang (see \u003chttps://rust-lang.github.io/rust-bindgen/requirements.html\u003e).\n3. On Linux/macOS, compile as follows:\n    ```sh\n    git clone --depth 1 https://github.com/0xdea/haruspex\n    cd haruspex\n    export IDADIR=/path/to/ida # if not set, the build script will check common locations\n    cargo build --release\n    ```\n   On Windows, instead, use the following commands:\n    ```powershell\n    git clone --depth 1 https://github.com/0xdea/haruspex\n    cd haruspex\n    $env:LIBCLANG_PATH=\"\\path\\to\\clang+llvm\\bin\"\n    $env:PATH=\"\\path\\to\\ida;$env:PATH\"\n    $env:IDADIR=\"\\path\\to\\ida\" # if not set, the build script will check common locations\n    cargo build --release\n    ```\n\n## Usage\n\n1. Make sure IDA Pro is properly configured with a valid license.\n2. Run as follows:\n    ```sh\n    haruspex \u003cbinary_file\u003e\n    ```\n3. Find the extracted pseudocode of each decompiled function in the `binary_file.dec` directory:\n    ```sh\n    vim \u003cbinary_file\u003e.dec\n    code \u003cbinary_file\u003e.dec\n    ```\n\n## Compatibility\n\n* IDA Pro 9.0.240925 - Latest compatible: v0.2.4.\n* IDA Pro 9.0.241217 - Latest compatible: v0.3.5.\n* IDA Pro 9.1.250226 - Latest compatible: v0.6.2.\n* IDA Pro 9.2.250908 - Latest compatible: v0.7.5.\n* IDA Pro 9.3.260213 - Latest compatible: current version.\n\n*Note: check [idalib](https://github.com/idalib-rs/idalib) documentation for additional information.*\n\n## Changelog\n\n* [CHANGELOG.md](CHANGELOG.md)\n\n## TODO\n\n* Use the `.cpp` extension instead of `.c` to output pseudocode (see\n  this [issue](https://github.com/0xdea/semgrep-rules/issues/12))?\n* Integrate with Semgrep scanning (see \u003chttps://github.com/0xdea/semgrep-rules\u003e).\n* Integrate with weggli scanning (see \u003chttps://github.com/0xdea/weggli-patterns\u003e).\n* Improve decompiler output in the style of [HexRaysPyTools](https://github.com/igogo-x86/HexRaysPyTools)\n  and [abyss](https://github.com/patois/abyss).\n* Implement parallel analysis (see \u003chttps://github.com/fugue-re/fugue-mptp\u003e).\n","funding_links":["https://github.com/sponsors/3562"],"categories":["Applications","Recently Updated","IDA Plugins"],"sub_categories":["Security tools","[Feb 05, 2025](/content/2025/02/05/README.md)"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xdea%2Fharuspex","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xdea%2Fharuspex","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xdea%2Fharuspex/lists"}