{"id":25037979,"url":"https://github.com/0xdea/haruspex","last_synced_at":"2026-05-31T12:00:37.303Z","repository":{"id":264166015,"uuid":"890405371","full_name":"0xdea/haruspex","owner":"0xdea","description":"Vulnerability research assistant that extracts pseudocode from the IDA Hex-Rays decompiler.","archived":false,"fork":false,"pushed_at":"2026-05-30T08:08:42.000Z","size":163271,"stargazers_count":123,"open_issues_count":2,"forks_count":8,"subscribers_count":3,"default_branch":"master","last_synced_at":"2026-05-30T10:08:14.951Z","etag":null,"topics":["ida-plugin","ida-pro","idalib","reverse-engineering","vulnerability-research"],"latest_commit_sha":null,"homepage":"https://hex-rays.com/ida-pro","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xdea.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":3562}},"created_at":"2024-11-18T14:09:55.000Z","updated_at":"2026-05-30T08:08:46.000Z","dependencies_parsed_at":"2025-01-08T07:33:51.054Z","dependency_job_id":"00b40aad-128c-4747-ac9c-db417d99e208","html_url":"https://github.com/0xdea/haruspex","commit_stats":null,"previous_names":["0xdea/haruspex"],"tags_count":33,"template":false,"template_full_name":null,"purl":"pkg:github/0xdea/haruspex","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xdea","download_url":"https://codeload.github.com/0xdea/haruspex/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xdea%2Fharuspex/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33730241,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-31T02:00:06.040Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ida-plugin","ida-pro","idalib","reverse-engineering","vulnerability-research"],"created_at":"2025-02-06T02:01:27.826Z","updated_at":"2026-05-31T12:00:37.296Z","avatar_url":"https://github.com/0xdea.png","language":"Rust","funding_links":["https://github.com/sponsors/3562"],"categories":["Applications","Recently Updated","IDA Plugins"],"sub_categories":["Security tools","[Feb 05, 2025](/content/2025/02/05/README.md)"],"readme":"# haruspex\n\n[![](https://img.shields.io/github/stars/0xdea/haruspex.svg?style=flat\u0026color=yellow)](https://github.com/0xdea/haruspex)\n[![](https://img.shields.io/crates/v/haruspex?style=flat\u0026color=green)](https://crates.io/crates/haruspex)\n[![](https://img.shields.io/crates/d/haruspex?style=flat\u0026color=red)](https://crates.io/crates/haruspex)\n[![](https://img.shields.io/badge/ida-9.3-violet)](https://hex-rays.com/ida-pro)\n[![](https://img.shields.io/badge/twitter-%400xdea-blue.svg)](https://twitter.com/0xdea)\n[![](https://img.shields.io/badge/mastodon-%40raptor-purple.svg)](https://infosec.exchange/@raptor)\n[![build](https://github.com/0xdea/haruspex/actions/workflows/build.yml/badge.svg)](https://github.com/0xdea/haruspex/actions/workflows/build.yml)\n[![doc](https://github.com/0xdea/haruspex/actions/workflows/doc.yml/badge.svg)](https://github.com/0xdea/haruspex/actions/workflows/doc.yml)\n\n\u003e \"Hacking is the discipline of questioning all your assumptions all of the time.\"\n\u003e\n\u003e -- Dave Aitel\n\nHaruspex is a blazing fast IDA Pro headless plugin that extracts pseudocode generated by IDA Pro's\ndecompiler in a format that should be suitable to be imported into an IDE, or parsed by static\nanalysis tools such as [Semgrep](https://semgrep.dev/), [weggli](https://github.com/weggli-rs/weggli),\nor [oneiromancer](https://crates.io/crates/oneiromancer).\n\n![](https://raw.githubusercontent.com/0xdea/haruspex/master/.img/screen01.png)\n\n## Features\n\n- Blazing fast, headless user experience courtesy of IDA Pro 9.x and Binarly's idalib Rust bindings.\n- Support for binary targets for any architecture implemented by IDA Pro's Hex-Rays decompiler.\n- Pseudocode of each function is stored in a separated file in the output directory for easy inspection.\n- External crates can invoke [`decompile_to_file`] to decompile a function and save its pseudocode to disk.\n\n## Blog posts\n\n- \u003chttps://hex-rays.com/blog/streamlining-vulnerability-research-idalib-rust-bindings\u003e\n- \u003chttps://hnsecurity.it/blog/streamlining-vulnerability-research-with-ida-pro-and-rust\u003e\n\n## See also\n\n- \u003chttps://github.com/0xdea/ghidra-scripts/blob/main/Haruspex.java\u003e\n- \u003chttps://github.com/0xdea/semgrep-rules\u003e\n- \u003chttps://github.com/0xdea/weggli-patterns\u003e\n- \u003chttps://docs.hex-rays.com/release-notes/9_0#headless-processing-with-idalib\u003e\n- \u003chttps://github.com/idalib-rs/idalib\u003e\n- \u003chttps://github.com/xorpse/parascope\u003e\n- \u003chttps://hnsecurity.it/blog/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep\u003e\n\n## Installing\n\nThe easiest way to get the latest release is via [crates.io](https://crates.io/crates/haruspex):\n\n1. Download, install, and configure IDA Pro (see \u003chttps://hex-rays.com/ida-pro\u003e).\n2. Install LLVM/Clang (see \u003chttps://rust-lang.github.io/rust-bindgen/requirements.html\u003e).\n3. On Linux/macOS, install as follows:\n   ```sh\n   export IDADIR=/path/to/ida # if not set, the build script will check common locations\n   cargo install haruspex\n   ```\n   On Windows, instead, use the following commands:\n   ```powershell\n   $env:LIBCLANG_PATH=\"\\path\\to\\clang+llvm\\bin\"\n   $env:PATH=\"\\path\\to\\ida;$env:PATH\"\n   $env:IDADIR=\"\\path\\to\\ida\" # if not set, the build script will check common locations\n   cargo install haruspex\n   ```\n\n## Compiling\n\nAlternatively, you can build from [source](https://github.com/0xdea/haruspex):\n\n1. Download, install, and configure IDA Pro (see \u003chttps://hex-rays.com/ida-pro\u003e).\n2. Install LLVM/Clang (see \u003chttps://rust-lang.github.io/rust-bindgen/requirements.html\u003e).\n3. On Linux/macOS, compile as follows:\n   ```sh\n   git clone --depth 1 https://github.com/0xdea/haruspex\n   cd haruspex\n   export IDADIR=/path/to/ida # if not set, the build script will check common locations\n   cargo build --release\n   ```\n   On Windows, instead, use the following commands:\n   ```powershell\n   git clone --depth 1 https://github.com/0xdea/haruspex\n   cd haruspex\n   $env:LIBCLANG_PATH=\"\\path\\to\\clang+llvm\\bin\"\n   $env:PATH=\"\\path\\to\\ida;$env:PATH\"\n   $env:IDADIR=\"\\path\\to\\ida\" # if not set, the build script will check common locations\n   cargo build --release\n   ```\n\n## Usage\n\n1. Make sure IDA Pro is properly configured with a valid license.\n2. Make sure the `IDADIR` environment variable is set if your IDA Pro installation is in a non-standard location.\n3. Run as follows:\n   ```sh\n   haruspex \u003cbinary_file\u003e\n   ```\n4. Find the extracted pseudocode of each decompiled function in the `binary_file.dec` directory:\n   ```sh\n   vim \u003cbinary_file\u003e.dec\n   code \u003cbinary_file\u003e.dec\n   ```\n\n## Compatibility\n\nOnly the latest IDA Pro release is officially supported, but older versions may work as well. The following table\nsummarizes the latest compatible release for each IDA Pro version:\n\n| IDA Pro version | Latest compatible release |\n| --------------- | ------------------------- |\n| v9.0.240925     | v0.2.4                    |\n| v9.0.241217     | v0.3.5                    |\n| v9.1.250226     | v0.6.2                    |\n| v9.2.250908     | v0.7.5                    |\n| v9.3.260213     | v0.8.1                    |\n| v9.3.260327     | v0.9.0                    |\n| v9.3.260421     | current release           |\n\n\u003e [!NOTE]\n\u003e Check the [idalib](https://github.com/idalib-rs/idalib) documentation for additional information.\n\n## Changelog\n\n- [CHANGELOG.md](https://github.com/0xdea/haruspex/blob/master/CHANGELOG.md)\n\n## TODO\n\n- Add global and per-function type extraction (see this [issue](https://github.com/0xdea/haruspex/issues/3)).\n- Use the `.cpp` extension instead of `.c` to output pseudocode (see\n  this [issue](https://github.com/0xdea/semgrep-rules/issues/12))?\n- Integrate with Semgrep scanning (see \u003chttps://github.com/0xdea/semgrep-rules\u003e).\n- Integrate with weggli scanning (see \u003chttps://github.com/0xdea/weggli-patterns\u003e).\n- Improve decompiler output in the style of [HexRaysPyTools](https://github.com/igogo-x86/HexRaysPyTools)\n  and [abyss](https://github.com/patois/abyss).\n- Implement parallel analysis (see \u003chttps://github.com/fugue-re/fugue-mptp\u003e).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xdea%2Fharuspex","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xdea%2Fharuspex","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xdea%2Fharuspex/lists"}