> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/add-ons/malware/how-tos/emulate-code-from-idalib.md).

# Emulate Code from an idalib Script

This how-to shows how to run [Isolated System Emulation](/add-ons/malware/concepts/isolated-system-emulation.md) headlessly from an [idalib](/core/idalib.md) script and read a decrypted stack string from memory.

{% hint style="info" %}
This how-to uses `d77e3ce835fdc84c8f286736309a1130008d39a03a7043ca078ca9ad4ac1f3e5` (`xorstr-nopdb.exe`), a non-malicious test executable, to demonstrate the feature.
{% endhint %}

## Prerequisites

* IDA Pro 9.5 or later with the Malware Analysis add-on installed. See [Getting Started](/add-ons/malware/getting-started.md).
* [HCLI](https://hcli.docs.hex-rays.com/getting-started/installation/) installed, to run the script.
* [idalib](/core/idalib/getting-started.md#option-3-automatically) set up for your IDA installation. The IDA installer can do this for you.
* Download the sample to follow along:

{% file src="/files/OqMJYpZNJ1fsFyAIeUAS" %}

## Recover the string with a script

1. Save the following script as `stack-string-idalib.py`. It performs the same steps as [Recover a Stack String](/add-ons/malware/how-tos/recover-a-stack-string.md), using [idalib](/core/idalib/overview.md):

   ```python
   import idapro
   import ida_auto
   import ida_dbg
   import idc

   def wait_until_suspended():
       while ida_dbg.get_process_state() != ida_dbg.DSTATE_SUSP:
           ida_dbg.wait_for_next_event(ida_dbg.WFNE_ANY | ida_dbg.WFNE_SUSP, 1)

   # Open the database
   idapro.open_database("xorstr-nopdb.exe", True)
   ida_auto.auto_wait()

   # Start Isolated System Emulation
   assert idc.eval_idc('start_emulator_with_backend("speakeasy")') == 1
   try:
       # The session stops at the entry point; jump straight to main like 'Set IP' does.
       wait_until_suspended()
       assert ida_dbg.set_reg_val("RIP", 0x140001000) # main
       assert ida_dbg.run_to(0x1400010E0) # puts call
       wait_until_suspended()
       print(f"stopped at {hex(ida_dbg.get_ip_val())}")

       buffer_ea = ida_dbg.get_reg_val("RBP") - 0x30
       print("0x%x: %r" % (buffer_ea, idc.get_strlit_contents(buffer_ea, -1, idc.STRTYPE_C).decode()))
   finally:
       ida_dbg.exit_process()
       idapro.close_database(False)
   ```
2. Run the script in IDAPython's environment through [HCLI](https://hcli.docs.hex-rays.com/). You see the following output:

   ```bash
   % hcli ida python exec stack-string-idalib.py
   stopped at 0x1400010e0
   0x12fff78: 'Secret encrypted message'
   ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.hex-rays.com/add-ons/malware/how-tos/emulate-code-from-idalib.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.