data

Search strings, byte sequences, and binary patterns in IDA Pro databases.

38|7|Updated Mar 1, 2026
One-click install
npx skills add https://github.com/allthingsida/idasql-skills --skill data-allthingsida
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: data
Source: https://github.com/allthingsida/idasql-skills/tree/main/plugins/idasql/skills/data
Command: npx skills add https://github.com/allthingsida/idasql-skills --skill data-allthingsida

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you quickly find specific strings, byte sequences, or binary patterns within an IDA Pro database, enabling rapid identification of indicators of compromise, constants, or code artifacts.

Core Features & Use Cases

  • String Searching: Locate literal strings, including ASCII and UTF-16, within the binary.
  • Byte Pattern Matching: Search for exact byte sequences or patterns with wildcards.
  • Use Case: You suspect a malware sample contains a specific network indicator. Use this Skill to search for that indicator's byte pattern or associated string to pinpoint its location and context in the binary.

Quick Start

Search for all occurrences of the byte pattern '48 8B ? 00' within the database.

Frequently Asked Questions about data

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search for specific byte sequences and strings in an IDA Pro database?

To search for byte sequences and strings in an IDA Pro database, use native SQL functions like `strings`, `search_bytes`, and `bytes` to locate specific data artifacts and match binary patterns efficiently.

Can I use wildcard patterns when searching for binary data in IDA Pro?

Yes, you can use wildcard patterns when searching for binary data in IDA Pro. The Skill supports searching for exact byte sequences or patterns with wildcards to locate specific code constants or indicators of compromise.

How does string searching work for malware analysis in a binary database?

String searching for malware analysis works by locating literal strings, including ASCII and UTF-16 formats, within the binary database. This facilitates rapid identification of network indicators and associated strings to pinpoint their context.

Do I need IDA Pro to search for indicators of compromise in a binary?

Yes, you need IDA Pro to search for indicators of compromise in a binary. This Skill leverages native IDA SQL functions to search within the IDA Pro database for specific data artifacts, IOCs, and code-related constants.

What is the best way to find network indicators of compromise during reverse engineering?

The best way to find network indicators of compromise during reverse engineering is to search for the indicator's byte pattern or associated string within the IDA Pro database to pinpoint its location and context in the binary.

Are there limitations when matching binary patterns with wildcards in IDA Pro?

When matching binary patterns with wildcards in IDA Pro, limitations depend on the native `search_bytes` function's capabilities. The Skill facilitates pattern matching but operates within the constraints of IDA's SQL data retrieval functions.