> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/core/mcp/how-tos/solving-a-multi-binary-challenge-with-ida-mcp.md).

# Solving a multi-binary challenge with IDA MCP

This brief tutorial demonstrates the capability of the [Hex-Rays IDA MCP Server](/core/mcp.md) in action, especially the multi-binary coordination.

To demonstrate the IDA MCP, we prepared a simple challenge that involves multiple files called `ParcelDesk`. The idea of the challenge is that you need to enter a parcel identifier and the corresponding collection code to open the door. In our case, we need to obtain the collection code for parcel `ZX-4815`.

If you're new to IDA MCP, see the [Overview](/core/mcp/overview.md) and [Getting Started](/core/mcp/getting-started.md) first.

## Prerequisites

* IDA MCP [installed](/core/mcp/getting-started.md)
* The [challenge files](https://github.com/HexRaysSA/ida-mcp/releases/download/v2026.915.3/ida-mcp-parceldesk-demo.zip) downloaded

## 1. Get started and extract the files

To get started, extract the challenge files into a new folder and open a coding agent there (we used Claude Code with Sonnet 5 for this demonstration). Then ask with an example prompt:

> *Can you obtain the collection code for parcel ZX-4815 in ParcelDesk.exe?*

## 2. Review the agent's findings

The agent will work for a few minutes, independently calling `open_database` and `execute_python` on the relevant binaries. It should come back with an answer like this:

> **Collection code for parcel ZX-4815: `NORTH-7F29`**
>
> How it was derived (small crackme in `/tmp/parcel-desk`):
>
> 1. `ParcelDesk.exe` hashes the parcel ID with `DeriveRouteSeed` (`route_math.dll`) — an FNV-1a-style hash over the UTF-16LE bytes, then `rol(x^0x6D3A91E7, 7) + 0x13579BDF` → seed `0x894a8a98` for "**ZX-4815**".
> 2. Since the parcel ID doesn't start with `OLD-`, it loads `manifest_codec.dll` and reads its embedded RCDATA resource (ID 201/0xC9), a 46-byte encrypted blob.
> 3. `DecodeManifest` XORs that blob with an xorshift32 keystream seeded by `seed ^ 0xC0DEC0DE` (plus an incrementing counter starting at 71, step 29).
> 4. Decoding yields the plaintext manifest: `PDM1|parcel=ZX-4815|locker=17|code=NORTH-7F29|`.
> 5. Verified live against the actual binary via Wine — it printed `ACCESS GRANTED`.

{% hint style="info" %}
In this scenario, none of the binaries have been opened in the IDA GUI, but this makes no difference from the agent's perspective. Calling `open_database` on a file that is already open in IDA will reuse that instance instead of spawning a headless `idalib` worker.
{% endhint %}

## What's next?

See [Multiplexing](/core/mcp/concepts/multiplexing.md) to understand how it made this multi-binary coordination possible.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.hex-rays.com/core/mcp/how-tos/solving-a-multi-binary-challenge-with-ida-mcp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.