P1: Search (bytes/string/instruction) + imports for the decompiler CLI

[mahaloz]

What & why

Without these, agents fall back to nm, strings, objdump, readelf. This brings byte/string/instruction search and import enumeration into the CLI.

New capabilities

• decompiler search bytes|string|instruction
  • bytes — native byte-pattern search: IDA find_bytes, Ghidra Memory.findBytes, Binary Ninja find_all_data. (angr has no byte-search API → exit 2.)
  • string — the string's bytes via the same path.
  • instruction — regex over each function's disassembly, client-side, so it works on every backend (bounded by --max).
• decompiler imports — imported symbols: IDA import modules, angr cle loader, Binary Ninja imported-function symbols. (Ghidra → not implemented for now.)
• Interface search_bytes/list_imports (base raises NotImplementedError) with per-backend overrides + client proxies.

Example

$ decompiler search bytes "7f454c46"
0x0
$ decompiler search string "SOSNEAKY" --json
{"pattern_hex": "534f534e45414b59", "count": 1, "matches": [{"addr": 2098, "addr_hex": "0x832"}]}
$ decompiler search instruction "call.*authenticate" --max 20
0x71d   main    call    authenticate
$ decompiler imports --filter 'puts|read'
0x201018   puts  [libc]
0x201028   read  [libc]

Tests

Backend-parametrized: test_search_bytes_elf_magic, test_search_string, test_search_instruction, test_imports_list.

• IDA: 4/4. Ghidra: search 3/3 pass (findBytes), imports skips (unsupported). angr: instruction + imports pass, byte-search skips.

Support matrix

	IDA	Ghidra	Binary Ninja	angr
search bytes/string	✅	✅	✅	—
search instruction	✅	✅	✅	✅
imports	✅	—	✅	✅

---

Fifth PR in the IDALib-parity series. Based on feat/cli-typed-reads (#207).

🤖 Generated with Claude Code

https://claude.ai/code/session_01HfZHdprXg38re1XyKxzGg5

[mahaloz]

Integrated into main as commit a8fc60b. The stack got tangled when the bottom PRs (#204/#205) were squash-merged (#205 landed on feat/cli-persistence instead of main), so I reconciled by cherry-picking the whole series onto main linearly. The exact reviewed content of this PR is on main — closing this stacked PR as its changes are shipped.