Memory tools: read and write IDB addresses and data

Memory tools provide direct access to the IDB’s virtual address space. You can read raw bytes or typed integers at any address, decode null-terminated strings, retrieve the compile-time value of global variables by name or address, and write bytes or integers back — including support for endian selection and all standard integer widths.

get_bytes

Read raw bytes from one or more addresses and return them as space-separated hex values.

regions

MemoryRead | MemoryRead[]

required

A single read request or a list of them.

Show MemoryRead fields

addr

string

required

Address to read from — hex (0x401000) or decimal, or a symbol name.

size

number

required

Number of bytes to read.

Returns BytesReadResult[]

Show BytesReadResult fields

addr

string

Input address, echoed back.

data

string | null

Space-separated hex bytes, e.g. "0x48 0x8b 0x05 0x00". null on error.

error

string

Present only on failure.

{
  "addr": "0x401000",
  "size": 8
}

get_int

Read a typed integer value from memory. Supports all standard widths and both byte orders.

queries

IntRead | IntRead[]

required

Show IntRead fields

addr

string

required

Address to read from.

string

required

Integer type specifier. Format: [i|u][8|16|32|64][le|be]

Specifier	Meaning
`i8`	Signed 8-bit (little-endian implied)
`u8`	Unsigned 8-bit
`i16` / `i16le`	Signed 16-bit little-endian
`i16be`	Signed 16-bit big-endian
`u32`	Unsigned 32-bit little-endian
`i64`	Signed 64-bit little-endian
`u64be`	Unsigned 64-bit big-endian

Returns IntReadResult[]

Show IntReadResult fields

addr

string

Input address.

string

Normalized type specifier (always includes endian suffix).

value

integer | null

Decoded integer, or null on error.

error

string

Present only on failure.

{
  "addr": "0x404020",
  "ty": "u32"
}

get_string

Read a null-terminated string from one or more addresses.

addrs

string | string[]

required

One or more addresses or symbol names to read strings from.

Returns StringReadResult[]

Show StringReadResult fields

addr

string

Input address.

value

string | null

Decoded UTF-8 string (with replacement characters for invalid bytes), or null when no string literal was found.

error

string

Present only on failure.

Read strings at two addresses

["0x402000", "0x402040"]

get_global_value

Read the compile-time value of a global variable by address or symbol name. The format of the returned value adapts to the variable’s type: integers are returned as hex, arrays of char as quoted strings, and larger blobs as hex byte sequences.

queries

string | string[]

required

Global variable addresses (hex or decimal) or symbol names.

Returns GlobalValueResult[]

Show GlobalValueResult fields

query

string

The input query string, echoed back.

value

string | null

Formatted value:

Scalars (1/2/4/8 bytes): "0x1234"
Char arrays: "\"hello world\""
Other blobs: space-separated hex bytes
null on error.

error

string

Present only on failure.

["g_version", "g_config_flags"]

get_global_value automatically detects whether the input looks like an address or a symbol name. Address-like strings (hex or numeric) are tried as addresses first; everything else is resolved as a name.

patch

Write raw bytes to one or more addresses. The data field is a plain hex string (no spaces required, though spaces are accepted in some contexts — use a contiguous hex string to be safe).

patches

MemoryPatch | MemoryPatch[]

required

Show MemoryPatch fields

addr

string

required

Target address.

data

string

required

Contiguous hex string, e.g. "9090" for two NOPs or "deadbeef" for four bytes.

Returns PatchResult[]

Show PatchResult fields

addr

string | null

Patched address.

size

number

Number of bytes written (0 on error).

error

string

Present only on failure.

patch operates directly on the IDB. There is no automatic undo. Use IDA’s Edit → Patch program → Restore original byte to revert individual bytes if needed.

Overwrite four bytes with NOPs

{
  "addr": "0x401045",
  "data": "90909090"
}

For assembly-level patching, see patch_asm in the Modification tools.

put_int

Write a typed integer value to one or more addresses. Values are expressed as strings to support hex input and negatives for signed types.

items

IntWrite | IntWrite[]

required

Show IntWrite fields

addr

string

required

Target address.

string

required

Integer type specifier — same format as get_int (e.g., u32, i16be, u64).

value

string

required

Integer value as a string. Supports decimal, 0x hex, and negative values for signed types.

Returns IntWriteResult[]

Show IntWriteResult fields

addr

string

Target address.

string

Normalized type specifier.

value

string | null

Echoed value string, or null on error.

error

string

Present only on failure — includes overflow detection.

{
  "addr": "0x404020",
  "ty": "u32",
  "value": "0xDEADBEEF"
}

Core & Analysis

Modification

Advanced

Memory tools: read and write IDB addresses and data

get_bytes

get_int

get_string

get_global_value

patch

put_int

Build docs developers (and LLMs) love

Core & Analysis

Modification

Advanced

Documentation Index

​get_bytes

​get_int

​get_string

​get_global_value

​patch

​put_int

Build docs developers (and LLMs) love

get_bytes

get_int

get_string

get_global_value

patch

put_int