AI小模型（Qwen3-30B-A3B）MCP(ida-pro-mcp)逆向教学提示词（cherry studio和roo code）
·
本文面向有特殊环境需求的群体。如果您能够使用在线模型，那么本教程对您可能不太适用。在国内，使用 trae 可便捷满足相关需求。经实际测试，本地部署模型时，若使用 24G 显存，显卡可选择两张 M40 12g（价格约 500 元左右）。追求性价比的朋友，也可直接采用单卡 24G 版本，让旧显卡重焕生机。当然你有3090等卡更好
对于参与 CTF 等有离线需求场景的用户而言，此方案将提供较大助力 。本人对逆向可以说是一窍不通，所以简单的题走点捷径。这里就不放原题目了，各位可以自己找题测试，并针对本文给出的提示词做出优化。目前还在进一步测试，理论上安卓的so库逆向也可以用这个干，MCP动态调试的教程等有空研究了看看。
阿里开源真心yyds，多少老旧设备能被这个模型挖掘最大价值。
这里使用的模型是Qwen3-30B-A3B-Q4-K_M
魔塔社区地址为：
Qwen3-30B-A3B-128K-GGUF
下载链接为：Qwen3-30B-A3B-128K-GGUF
显存占用情况
推荐使用llama.cpp进行推理
我用的启动参数如下，依据个人需求改就行，弄不来的用ollama改下上下文也行，部署就不做过多教学了
/workspace/llama.cpp/build/bin/llama-server -m /root/gguf/Qwen3-30B-A3B-Q4_K_M.gguf --reasoning-format deepseek -ngl 99 -fa -sm row --temp 0.6 --top-k 20 --top-p 0.95 --min-p 0 -c 40960 -n 131072 --host 0.0.0.0 -np 2IDA的MCP部署可以参考下面两篇文章，别人已经写的很详细了，我这里就不多详细步骤了
IDA Pro+MCP+DeepSeek逆向小实战:构建AI逆向分析工作流_ida pro mcp-CSDN博客IDA_Pro MCP接入与使用教程 - 吾爱破解 - 52pojie.cn
这里先放效果（会做的人直接看strings或者f5看下伪代码直接秒出）：
1、cherry studio客户端(比较麻烦，需要多轮对话)
2、roo code(配置繁琐，但是只用点点点)
roo code对话原文md（只删了文件结构信息，其他没动过，这个和分析没啥关系）
**User:**
<task>
程序在运行时会创建一个互斥锁（mutex），分析出该互斥锁创建时的名称
</task>
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:01:24.208Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
# Current Workspace Directory (d:/CTF/文件结构这里被我删了) Files
文件结构这里被我删了
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<use_mcp_tool>
<server_name>github.com/mrexodia/ida-pro-mcp</server_name>
<tool_name>get_entry_points</tool_name>
<arguments>
{
"offset": 0,
"count": 100
}
</arguments>
</use_mcp_tool>
---
**User:**
[use_mcp_tool for 'github.com/mrexodia/ida-pro-mcp'] Result:
{
"address": "0x10001000",
"name": "curl_slist_append",
"size": "0x1"
}
{
"address": "0x10001000",
"name": "curl_slist_append",
"size": "0x1"
}
{
"address": "0x10001000",
"name": "curl_slist_append",
"size": "0x1"
}
{
"address": "0x10001000",
"name": "curl_slist_append",
"size": "0x1"
}
{
"address": "0x10001000",
"name": "curl_slist_append",
"size": "0x1"
}
{
"address": "0x10001000",
"name": "curl_slist_append",
"size": "0x1"
}
{
"address": "0x1000175e",
"name": "DllEntryPoint",
"size": "0x23"
}
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:06:40.627Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<use_mcp_tool>
<server_name>github.com/mrexodia/ida-pro-mcp</server_name>
<tool_name>list_strings_filter</tool_name>
<arguments>
{
"offset": 0,
"count": 100,
"filter": "Global|Local"
}
</arguments>
</use_mcp_tool>
---
**User:**
[use_mcp_tool for 'github.com/mrexodia/ida-pro-mcp'] Result:
{
"data": [],
"next_offset": null
}
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:09:35.808Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<use_mcp_tool>
<server_name>github.com/mrexodia/ida-pro-mcp</server_name>
<tool_name>list_imports</tool_name>
<arguments>
{
"offset": 0,
"count": 100
}
</arguments>
</use_mcp_tool>
---
**User:**
[use_mcp_tool for 'github.com/mrexodia/ida-pro-mcp'] Result:
{
"data": [
{
"address": "0x10013df4",
"imported_name": "CloseHandle",
"module": "KERNEL32"
},
{
"address": "0x10013df8",
"imported_name": "CreateFileW",
"module": "KERNEL32"
},
{
"address": "0x10013dfc",
"imported_name": "CreateMutexA",
"module": "KERNEL32"
},
{
"address": "0x10013e00",
"imported_name": "DecodePointer",
"module": "KERNEL32"
},
{
"address": "0x10013e04",
"imported_name": "DeleteCriticalSection",
"module": "KERNEL32"
},
{
"address": "0x10013e08",
"imported_name": "EnterCriticalSection",
"module": "KERNEL32"
},
{
"address": "0x10013e0c",
"imported_name": "ExitProcess",
"module": "KERNEL32"
},
{
"address": "0x10013e10",
"imported_name": "FindClose",
"module": "KERNEL32"
},
{
"address": "0x10013e14",
"imported_name": "FindFirstFileExW",
"module": "KERNEL32"
},
{
"address": "0x10013e18",
"imported_name": "FindNextFileW",
"module": "KERNEL32"
},
{
"address": "0x10013e1c",
"imported_name": "FlushFileBuffers",
"module": "KERNEL32"
},
{
"address": "0x10013e20",
"imported_name": "FreeEnvironmentStringsW",
"module": "KERNEL32"
},
{
"address": "0x10013e24",
"imported_name": "FreeLibrary",
"module": "KERNEL32"
},
{
"address": "0x10013e28",
"imported_name": "GetACP",
"module": "KERNEL32"
},
{
"address": "0x10013e2c",
"imported_name": "GetCPInfo",
"module": "KERNEL32"
},
{
"address": "0x10013e30",
"imported_name": "GetCommandLineA",
"module": "KERNEL32"
},
{
"address": "0x10013e34",
"imported_name": "GetCommandLineW",
"module": "KERNEL32"
},
{
"address": "0x10013e38",
"imported_name": "GetConsoleMode",
"module": "KERNEL32"
},
{
"address": "0x10013e3c",
"imported_name": "GetConsoleOutputCP",
"module": "KERNEL32"
},
{
"address": "0x10013e40",
"imported_name": "GetCurrentProcess",
"module": "KERNEL32"
},
{
"address": "0x10013e44",
"imported_name": "GetCurrentProcessId",
"module": "KERNEL32"
},
{
"address": "0x10013e48",
"imported_name": "GetCurrentThreadId",
"module": "KERNEL32"
},
{
"address": "0x10013e4c",
"imported_name": "GetEnvironmentStringsW",
"module": "KERNEL32"
},
{
"address": "0x10013e50",
"imported_name": "GetFileType",
"module": "KERNEL32"
},
{
"address": "0x10013e54",
"imported_name": "GetLastError",
"module": "KERNEL32"
},
{
"address": "0x10013e58",
"imported_name": "GetModuleFileNameA",
"module": "KERNEL32"
},
{
"address": "0x10013e5c",
"imported_name": "GetModuleFileNameW",
"module": "KERNEL32"
},
{
"address": "0x10013e60",
"imported_name": "GetModuleHandleA",
"module": "KERNEL32"
},
{
"address": "0x10013e64",
"imported_name": "GetModuleHandleExW",
"module": "KERNEL32"
},
{
"address": "0x10013e68",
"imported_name": "GetModuleHandleW",
"module": "KERNEL32"
},
{
"address": "0x10013e6c",
"imported_name": "GetOEMCP",
"module": "KERNEL32"
},
{
"address": "0x10013e70",
"imported_name": "GetProcAddress",
"module": "KERNEL32"
},
{
"address": "0x10013e74",
"imported_name": "GetProcessHeap",
"module": "KERNEL32"
},
{
"address": "0x10013e78",
"imported_name": "GetStartupInfoW",
"module": "KERNEL32"
},
{
"address": "0x10013e7c",
"imported_name": "GetStdHandle",
"module": "KERNEL32"
},
{
"address": "0x10013e80",
"imported_name": "GetStringTypeW",
"module": "KERNEL32"
},
{
"address": "0x10013e84",
"imported_name": "GetSystemTimeAsFileTime",
"module": "KERNEL32"
},
{
"address": "0x10013e88",
"imported_name": "HeapAlloc",
"module": "KERNEL32"
},
{
"address": "0x10013e8c",
"imported_name": "HeapFree",
"module": "KERNEL32"
},
{
"address": "0x10013e90",
"imported_name": "HeapReAlloc",
"module": "KERNEL32"
},
{
"address": "0x10013e94",
"imported_name": "HeapSize",
"module": "KERNEL32"
},
{
"address": "0x10013e98",
"imported_name": "InitializeCriticalSectionAndSpinCount",
"module": "KERNEL32"
},
{
"address": "0x10013e9c",
"imported_name": "InitializeSListHead",
"module": "KERNEL32"
},
{
"address": "0x10013ea0",
"imported_name": "InterlockedFlushSList",
"module": "KERNEL32"
},
{
"address": "0x10013ea4",
"imported_name": "IsDebuggerPresent",
"module": "KERNEL32"
},
{
"address": "0x10013ea8",
"imported_name": "IsProcessorFeaturePresent",
"module": "KERNEL32"
},
{
"address": "0x10013eac",
"imported_name": "IsValidCodePage",
"module": "KERNEL32"
},
{
"address": "0x10013eb0",
"imported_name": "LCMapStringW",
"module": "KERNEL32"
},
{
"address": "0x10013eb4",
"imported_name": "LeaveCriticalSection",
"module": "KERNEL32"
},
{
"address": "0x10013eb8",
"imported_name": "LoadLibraryExW",
"module": "KERNEL32"
},
{
"address": "0x10013ebc",
"imported_name": "MultiByteToWideChar",
"module": "KERNEL32"
},
{
"address": "0x10013ec0",
"imported_name": "QueryPerformanceCounter",
"module": "KERNEL32"
},
{
"address": "0x10013ec4",
"imported_name": "RaiseException",
"module": "KERNEL32"
},
{
"address": "0x10013ec8",
"imported_name": "ReadConsoleW",
"module": "KERNEL32"
},
{
"address": "0x10013ecc",
"imported_name": "ReadFile",
"module": "KERNEL32"
},
{
"address": "0x10013ed0",
"imported_name": "RtlUnwind",
"module": "KERNEL32"
},
{
"address": "0x10013ed4",
"imported_name": "SetCurrentDirectoryA",
"module": "KERNEL32"
},
{
"address": "0x10013ed8",
"imported_name": "SetEndOfFile",
"module": "KERNEL32"
},
{
"address": "0x10013edc",
"imported_name": "SetFilePointerEx",
"module": "KERNEL32"
},
{
"address": "0x10013ee0",
"imported_name": "SetLastError",
"module": "KERNEL32"
},
{
"address": "0x10013ee4",
"imported_name": "SetStdHandle",
"module": "KERNEL32"
},
{
"address": "0x10013ee8",
"imported_name": "SetUnhandledExceptionFilter",
"module": "KERNEL32"
},
{
"address": "0x10013eec",
"imported_name": "Sleep",
"module": "KERNEL32"
},
{
"address": "0x10013ef0",
"imported_name": "TerminateProcess",
"module": "KERNEL32"
},
{
"address": "0x10013ef4",
"imported_name": "TlsAlloc",
"module": "KERNEL32"
},
{
"address": "0x10013ef8",
"imported_name": "TlsFree",
"module": "KERNEL32"
},
{
"address": "0x10013efc",
"imported_name": "TlsGetValue",
"module": "KERNEL32"
},
{
"address": "0x10013f00",
"imported_name": "TlsSetValue",
"module": "KERNEL32"
},
{
"address": "0x10013f04",
"imported_name": "UnhandledExceptionFilter",
"module": "KERNEL32"
},
{
"address": "0x10013f08",
"imported_name": "VirtualAlloc",
"module": "KERNEL32"
},
{
"address": "0x10013f0c",
"imported_name": "VirtualProtect",
"module": "KERNEL32"
},
{
"address": "0x10013f10",
"imported_name": "WideCharToMultiByte",
"module": "KERNEL32"
},
{
"address": "0x10013f14",
"imported_name": "WriteConsoleW",
"module": "KERNEL32"
},
{
"address": "0x10013f18",
"imported_name": "WriteFile",
"module": "KERNEL32"
}
],
"next_offset": null
}
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:11:30.277Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<use_mcp_tool>
<server_name>github.com/mrexodia/ida-pro-mcp</server_name>
<tool_name>get_xrefs_to</tool_name>
<arguments>
{
"address": "0x10013dfc"
}
</arguments>
</use_mcp_tool>
---
**User:**
[use_mcp_tool for 'github.com/mrexodia/ida-pro-mcp'] Result:
{
"address": "0x1000135f",
"type": "code",
"function": {
"address": "0x1000135f",
"name": "_DllMain@12",
"size": "0x40e"
}
}
{
"address": "0x1000135f",
"type": "data",
"function": {
"address": "0x1000135f",
"name": "_DllMain@12",
"size": "0x40e"
}
}
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:21:27.962Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<use_mcp_tool>
<server_name>github.com/mrexodia/ida-pro-mcp</server_name>
<tool_name>disassemble_function</tool_name>
<arguments>
{
"start_address": "0x1000135f"
}
</arguments>
</use_mcp_tool>
---
**User:**
[use_mcp_tool for 'github.com/mrexodia/ida-pro-mcp'] Result:
Error:
Error executing tool disassemble_function: JSON-RPC error -32603: Internal error (please report a bug)
Traceback (most recent call last):
File "C:/Users/OS/AppData/Roaming/Hex-Rays/IDA Pro/plugins/mcp-plugin.py", line 144, in do_POST
result = rpc_registry.dispatch(request["method"], request.get("params", []))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:/Users/OS/AppData/Roaming/Hex-Rays/IDA Pro/plugins/mcp-plugin.py", line 58, in dispatch
return func(*converted_params)
^^^^^^^^^^^^^^^^^^^^^^^
File "C:/Users/OS/AppData/Roaming/Hex-Rays/IDA Pro/plugins/mcp-plugin.py", line 377, in wrapper
return sync_wrapper(ff, idaapi.MFF_READ)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:/Users/OS/AppData/Roaming/Hex-Rays/IDA Pro/plugins/mcp-plugin.py", line 351, in sync_wrapper
raise res
File "C:/Users/OS/AppData/Roaming/Hex-Rays/IDA Pro/plugins/mcp-plugin.py", line 341, in runned
res_container.put(ff())
^^^^
File "C:/Users/OS/AppData/Roaming/Hex-Rays/IDA Pro/plugins/mcp-plugin.py", line 931, in disassemble_function
ida_kernwin.parse_tagged_line_sections(tls, raw_instruction)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'ida_kernwin' has no attribute 'parse_tagged_line_sections'
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:22:03.568Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<use_mcp_tool>
<server_name>github.com/mrexodia/ida-pro-mcp</server_name>
<tool_name>decompile_function</tool_name>
<arguments>
{
"address": "0x1000135f"
}
</arguments>
</use_mcp_tool>
---
**User:**
[use_mcp_tool for 'github.com/mrexodia/ida-pro-mcp'] Result:
/* line: 0, address: 0x10001010 */ BOOL __stdcall DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
/* line: 1 */ {
/* line: 2 */ int v3; // ebx
/* line: 3 */ int v4; // esi
/* line: 4 */ int v5; // eax
/* line: 5 */ HMODULE ModuleHandleA; // edi
/* line: 6 */ int v8; // [esp-4h] [ebp-148h] BYREF
/* line: 7 */ CHAR Filename[260]; // [esp+0h] [ebp-144h] BYREF
/* line: 8 */ char *v10; // [esp+104h] [ebp-40h]
/* line: 9 */ DWORD LastError; // [esp+108h] [ebp-3Ch]
/* line: 10 */ HANDLE MutexA; // [esp+10Ch] [ebp-38h]
/* line: 11 */ PDWORD v13; // [esp+110h] [ebp-34h]
/* line: 12 */ SIZE_T dwSize; // [esp+114h] [ebp-30h]
/* line: 13 */ CHAR *v15; // [esp+118h] [ebp-2Ch]
/* line: 14 */ int v16; // [esp+11Ch] [ebp-28h]
/* line: 15 */ LPVOID lpAddress; // [esp+120h] [ebp-24h]
/* line: 16 */ int v18; // [esp+124h] [ebp-20h]
/* line: 17 */ void *Buffer; // [esp+128h] [ebp-1Ch]
/* line: 18 */ PDWORD lpflOldProtect; // [esp+12Ch] [ebp-18h]
/* line: 19 */ FILE *Stream; // [esp+130h] [ebp-14h]
/* line: 20 */ bool v22; // [esp+134h] [ebp-10h]
/* line: 21 */ bool v23; // [esp+135h] [ebp-Fh]
/* line: 22 */ bool v24; // [esp+136h] [ebp-Eh]
/* line: 23 */ bool v25; // [esp+137h] [ebp-Dh]
/* line: 24 */
/* line: 25, address: 0x1000101c */ v5 = -59812664;
/* line: 26, address: 0x1000122e */ while ( 1 )
/* line: 27 */ {
/* line: 28, address: 0x100010d5 */ while ( 1 )
/* line: 29 */ {
/* line: 30, address: 0x1000103c */ while ( 1 )
/* line: 31 */ {
/* line: 32, address: 0x10001035 */ while ( 1 )
/* line: 33 */ {
/* line: 34, address: 0x10001035 */ while ( v5 <= 441339541 )
/* line: 35 */ {
/* line: 36, address: 0x10001085 */ if ( v5 <= -160800107 )
/* line: 37 */ {
/* line: 38, address: 0x10001115 */ if ( v5 <= -1488728540 )
/* line: 39 */ {
/* line: 40, address: 0x1000125a */ if ( v5 == -2053413363 )
/* line: 41 */ {
/* line: 42, address: 0x100013e2 */ v5 = -157045621;
/* line: 43, address: 0x100013e7 */ v3 = 1;
/* line: 44 */ }
/* line: 45 */ else
/* line: 46 */ {
/* line: 47, address: 0x10001265 */ if ( v5 != -1823888645 )
/* line: 48, address: 0x1000140b */ ExitProcess(0);
/* line: 49, address: 0x10001273 */ v23 = LastError == 183;
/* line: 50, address: 0x10001277 */ v5 = 999569743;
/* line: 51 */ }
/* line: 52 */ }
/* line: 53, address: 0x10001120 */ else if ( v5 == -1488728539 )
/* line: 54 */ {
/* line: 55, address: 0x10001309 */ Stream = fopen("config.ini", "rb");
/* line: 56, address: 0x10001310 */ v22 = Stream != 0;
/* line: 57, address: 0x10001314 */ v5 = 1828317264;
/* line: 58 */ }
/* line: 59, address: 0x1000112b */ else if ( v5 == -1418684022 )
/* line: 60 */ {
/* line: 61, address: 0x10001329 */ dwSize = ftell(Stream);
/* line: 62, address: 0x1000133e */ Buffer = VirtualAlloc(0, dwSize, 0x1000u, 0x40u);
/* line: 63, address: 0x10001341 */ v5 = 270182103;
/* line: 64 */ }
/* line: 65 */ else
/* line: 66 */ {
/* line: 67, address: 0x10001141 */ Sleep(0xBB8u);
/* line: 68, address: 0x1000114e */ fseek(Stream, 0, 0);
/* line: 69, address: 0x10001161 */ fread(Buffer, 1u, dwSize, Stream);
/* line: 70, address: 0x1000116c */ fclose(Stream);
/* line: 71, address: 0x1000117c */ ModuleHandleA = GetModuleHandleA(0);
/* line: 72, address: 0x1000118b */ GetModuleFileNameA(ModuleHandleA, Filename, 0x104u);
/* line: 73, address: 0x1000119c */ v18 = *(_DWORD *)((char *)ModuleHandleA + *((_DWORD *)ModuleHandleA + 15) + 40)
/* line: 74 */ + *(_DWORD *)((char *)ModuleHandleA + *((_DWORD *)ModuleHandleA + 15) + 52);
/* line: 75, address: 0x100011a2 */ v13 = lpflOldProtect;
/* line: 76, address: 0x100011ae */ v10 = (char *)Buffer - v18;
/* line: 77, address: 0x100011b1 */ v5 = -34705640;
/* line: 78 */ }
/* line: 79 */ }
/* line: 80, address: 0x10001090 */ else if ( v5 > -34705641 )
/* line: 81 */ {
/* line: 82, address: 0x100011f7 */ if ( v5 == -34705640 )
/* line: 83 */ {
/* line: 84, address: 0x10001393 */ lpAddress = (LPVOID)v18;
/* line: 85, address: 0x10001396 */ v5 = 790773586;
/* line: 86 */ }
/* line: 87, address: 0x10001202 */ else if ( v5 == 77338369 )
/* line: 88 */ {
/* line: 89, address: 0x10001023 */ v5 = 661849492;
/* line: 90, address: 0x10001028 */ v16 = 1;
/* line: 91 */ }
/* line: 92 */ else
/* line: 93 */ {
/* line: 94, address: 0x10001217 */ v5 = -1386097209;
/* line: 95, address: 0x10001221 */ if ( !Buffer )
/* line: 96, address: 0x10001221 */ v5 = -2053413363;
/* line: 97 */ }
/* line: 98 */ }
/* line: 99, address: 0x1000109b */ else if ( v5 == -160800106 )
/* line: 100 */ {
/* line: 101, address: 0x100012b4 */ fseek(Stream, 0, 2);
/* line: 102, address: 0x100012bc */ v5 = -1418684022;
/* line: 103 */ }
/* line: 104, address: 0x100010a6 */ else if ( v5 == -157045621 )
/* line: 105 */ {
/* line: 106, address: 0x100012c6 */ v5 = 1705069352;
/* line: 107, address: 0x100012cb */ v4 = v3;
/* line: 108 */ }
/* line: 109 */ else
/* line: 110 */ {
/* line: 111, address: 0x100010b7 */ v8 = -59812664;
/* line: 112, address: 0x100010be */ lpflOldProtect = (PDWORD)&v8;
/* line: 113, address: 0x100010c1 */ v25 = fdwReason == 1;
/* line: 114, address: 0x100010c5 */ v5 = 1370360240;
/* line: 115 */ }
/* line: 116 */ }
/* line: 117, address: 0x1000103c */ if ( v5 <= 1087384558 )
/* line: 118, address: 0x1000103c */ break;
/* line: 119, address: 0x10001047 */ if ( v5 > 1622942616 )
/* line: 120 */ {
/* line: 121, address: 0x100011c0 */ if ( v5 == 1622942617 )
/* line: 122 */ {
/* line: 123, address: 0x10001350 */ SetCurrentDirectoryA("c:\\programdata");
/* line: 124, address: 0x10001365 */ MutexA = CreateMutexA(0, 0, "alibaba666");
/* line: 125, address: 0x10001368 */ v5 = 619575440;
/* line: 126 */ }
/* line: 127, address: 0x100011cb */ else if ( v5 == 1705069352 )
/* line: 128 */ {
/* line: 129, address: 0x10001377 */ v5 = 661849492;
/* line: 130, address: 0x10001381 */ if ( !v4 )
/* line: 131, address: 0x10001381 */ v5 = 77338369;
/* line: 132, address: 0x10001384 */ v16 = -1;
/* line: 133 */ }
/* line: 134 */ else
/* line: 135 */ {
/* line: 136, address: 0x100011e0 */ v5 = 441339542;
/* line: 137, address: 0x100011ea */ if ( v22 )
/* line: 138, address: 0x100011ea */ v5 = -160800106;
/* line: 139 */ }
/* line: 140 */ }
/* line: 141, address: 0x10001052 */ else if ( v5 == 1087384559 )
/* line: 142 */ {
/* line: 143, address: 0x10001285 */ v5 = 481587248;
/* line: 144, address: 0x1000128f */ if ( v24 )
/* line: 145, address: 0x1000128f */ v5 = 1376053299;
/* line: 146 */ }
/* line: 147, address: 0x1000105d */ else if ( v5 == 1370360240 )
/* line: 148 */ {
/* line: 149, address: 0x1000129b */ v5 = 77338369;
/* line: 150, address: 0x100012a5 */ if ( v25 )
/* line: 151, address: 0x100012a5 */ v5 = 1622942617;
/* line: 152 */ }
/* line: 153 */ else
/* line: 154 */ {
/* line: 155, address: 0x10001070 */ LastError = GetLastError();
/* line: 156, address: 0x10001073 */ v5 = -1823888645;
/* line: 157 */ }
/* line: 158 */ }
/* line: 159, address: 0x100010d5 */ if ( v5 > 661849491 )
/* line: 160, address: 0x100010d5 */ break;
/* line: 161, address: 0x100010e0 */ if ( v5 == 441339542 )
/* line: 162 */ {
/* line: 163, address: 0x100012d2 */ v5 = 1705069352;
/* line: 164, address: 0x100012d7 */ v4 = 1;
/* line: 165 */ }
/* line: 166, address: 0x100010eb */ else if ( v5 == 481587248 )
/* line: 167 */ {
/* line: 168, address: 0x100012e7 */ v15 = Filename;
/* line: 169, address: 0x100012ed */ v5 = -1488728539;
/* line: 170 */ }
/* line: 171 */ else
/* line: 172 */ {
/* line: 173, address: 0x10001100 */ v24 = MutexA != 0;
/* line: 174, address: 0x10001104 */ v5 = 1087384559;
/* line: 175 */ }
/* line: 176 */ }
/* line: 177, address: 0x1000122e */ if ( v5 != 790773586 )
/* line: 178, address: 0x1000122e */ break;
/* line: 179, address: 0x100013b0 */ VirtualProtect(lpAddress, 0x10u, 4u, lpflOldProtect);
/* line: 180, address: 0x100013b5 */ *(_BYTE *)lpAddress = -23;
/* line: 181, address: 0x100013c1 */ *(_DWORD *)(v18 + 1) = v10 - 5;
/* line: 182, address: 0x100013d1 */ VirtualProtect(lpAddress, 0x10u, *lpflOldProtect, lpflOldProtect);
/* line: 183, address: 0x100013d6 */ v5 = -157045621;
/* line: 184, address: 0x100013db */ v3 = 0;
/* line: 185 */ }
/* line: 186, address: 0x10001239 */ if ( v5 != 999569743 )
/* line: 187, address: 0x10001239 */ break;
/* line: 188, address: 0x10001243 */ v5 = 481587248;
/* line: 189, address: 0x1000124d */ if ( v23 )
/* line: 190, address: 0x1000124d */ v5 = -2005312565;
/* line: 191 */ }
/* line: 192, address: 0x10001414 */ return v16;
/* line: 193 */ }
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:23:53.254Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<attempt_completion>
程序在运行时创建的互斥锁名称为：alibaba666
在反编译的DllMain函数中发现了以下关键代码：
CreateMutexA(0, 0, "alibaba666")
这表明程序在启动时会创建名为"alibaba666"的互斥锁。根据Windows API的CreateMutexA函数原型，第三个参数即为互斥锁的名称。该名称符合Windows互斥锁命名规范，且在反编译代码中直接作为字符串常量出现，因此可以确定这就是程序创建的互斥锁名称。
</attempt_completion>
[Response interrupted by a tool use result. Only one tool may be used at a time and should be placed at the end of the message.]
---
**User:**
[attempt_completion] Result:
The tool execution failed with the following error:
<error>
Missing value for required parameter 'result'. Please retry with complete response.
# Reminder: Instructions for Tool Use
Tool uses are formatted using XML-style tags. The tool name itself becomes the XML tag name. Each parameter is enclosed within its own set of tags. Here's the structure:
<actual_tool_name>
<parameter1_name>value1</parameter1_name>
<parameter2_name>value2</parameter2_name>
...
</actual_tool_name>
For example, to use the attempt_completion tool:
<attempt_completion>
<result>
I have completed the task...
</result>
</attempt_completion>
Always use the actual tool name as the XML tag name for proper parsing and execution.
</error>
<environment_details>
# VSCode Visible Files
# VSCode Open Tabs
# Current Time
Current time in ISO 8601 UTC format: 2025-07-22T15:27:20.679Z
User time zone: Asia/Shanghai, UTC+8:00
# Current Cost
$0.00
# Current Mode
<slug>de</slug>
<name>逆向</name>
<model>Qwen3-30B-A3B-Q4_K_M.gguf</model>
You have not created a todo list yet. Create one with `update_todo_list` if your task is complicated or involves multiple steps.
</environment_details>
---
**Assistant:**
<attempt_completion>
<result>程序在运行时创建的互斥锁名称为：alibaba666</result>
</attempt_completion>
划重点-------提示词（实测cherry和roo code通用）
把提示词丢给mcp客户端，再用ida打开对应的文件，插件中启用mcp，需求丢AI等结果就行
请扮演一位资深IDA逆向分析专家，需具备以下核心能力：精通x86/x64/ARM等多架构二进制逆向工程，擅长恶意软件静态与动态分析、网络协议及加密算法反编译，能以逆向思维精准拆解程序逻辑。
### 工具与信息约束
1. **工具定位**：仅通过MCP工具（ida-pro-mcp）开展逆向分析工作，该工具已加载待逆向程序，提供程序加载、反汇编、调试、伪代码生成等基础功能。
2. **信息来源限制**：所有分析依赖信息（指令集、内存数据、函数调用关系等）均需通过MCP工具API获取，完全忽略本地及外部文件信息。
### MCP工具（ida-pro-mcp）功能清单
#### 核心功能
- **连接与元数据查询**
- check_connection()：检查IDA插件运行状态
- get_metadata()：获取当前IDB的元数据
- **函数操作**
- get_function_by_name(name)：通过函数名获取函数信息
- get_function_by_address(address)：通过地址获取函数信息
- decompile_function(address)：反编译指定地址的函数，生成伪代码
- disassemble_function(start_address)：获取函数的汇编代码（含地址、指令及注释）
- get_xrefs_to(address)：获取指向指定地址的所有交叉引用
- get_xrefs_to_field(struct_name, field_name)：获取指向指定结构体字段的所有交叉引用
- rename_function(function_address, new_name)：重命名指定地址的函数
- set_function_prototype(function_address, prototype)：修改函数原型
- **全局/局部变量与类型操作**
- list_functions(offset, count)：分页列出数据库中所有函数
- list_globals_filter(offset, count, filter)：按条件分页列出全局变量
- list_globals(offset, count)：分页列出所有全局变量
- list_strings_filter(offset, count, filter)：按条件分页列出字符串
- list_strings(offset, count)：分页列出所有字符串
- list_local_types()：列出数据库中所有局部类型
- rename_local_variable(function_address, old_name, new_name)：重命名函数的局部变量
- rename_global_variable(old_name, new_name)：重命名全局变量
- set_global_variable_type(variable_name, new_type)：设置全局变量类型
- set_local_variable_type(function_address, variable_name, new_type)：设置函数局部变量类型
- declare_c_type(c_declaration)：通过C声明创建或更新局部类型
- **程序结构查询**
- get_entry_points()：获取程序所有入口点
- get_current_address()：获取用户当前选中的地址
- get_current_function()：获取用户当前选中的函数
- convert_number(text, size)：转换数字表示形式（十进制、十六进制）
- **注释与标注**
- set_comment(address, comment)：为指定地址设置注释（同步显示在反汇编和伪代码中）
- set_global_variable_type(variable_name, new_type)：设置全局变量类型
#### 不安全功能（需--unsafe flag）
- dbg_get_registers()：调试时获取所有寄存器及其值
- dbg_get_call_stack()：获取当前调用栈
- dbg_list_breakpoints()：列出程序中所有断点
- dbg_start_process()：启动调试器
- dbg_exit_process()：退出调试器
- dbg_continue_process()：继续调试进程
- dbg_run_to(address)：运行调试器至指定地址
- dbg_set_breakpoint(address)：在指定地址设置断点
- dbg_delete_breakpoint(address)：删除指定地址的断点
- dbg_enable_breakpoint(address, enable)：启用或禁用指定地址的断点
请基于上述工具功能，以专业逆向分析逻辑开展工作，分析过程中需明确说明调用的工具函数及操作逻辑，确保分析结论可追溯。cherry配置方法为点击对话上方浅色字体，复制粘贴进去
roo code需要配置低推理量，并配置专有交互模式
这里需要点击左下角模式选择框，并点击设置
然后只需要在角色定义这里丢入提示词即可
更多推荐
8
0- 0
已为社区贡献1条内容
所有评论(0)