Features
Quokka exports as much information from the disassembler (IDA Pro or Ghidra) as possible. Both backends produce .quokka files with the same protobuf schema, but they differ in a few areas.
Export modes
Quokka supports two export modes that control how much detail is written to the .quokka file:
- Light -- only block-level information is exported. Instructions are decoded at runtime by Capstone from the original binary bytes.
- Full (self-contained) -- instructions, operands, and their string representations are exported directly. The original binary is not strictly required for disassembly at analysis time.
Both modes expose the same Python API.
Warning
The Full export mode is not yet implemented in either backend. The proto schema and Python bindings are ready, but both the IDA plugin and the Ghidra extension currently only produce Light exports. This will be addressed in a future release.
Exported elements
The table below shows what each backend exports in each mode.
| Category | Feature | IDA | Ghidra |
|---|---|---|---|
| Metadata | Binary name | ||
| Architecture / ISA | |||
| Compiler | |||
| Layout | Segments | ||
| Code layout (code/data/gap regions) | |||
| Functions | Name, type, boundaries | ||
| Prototype / calling convention | |||
| Decompiled pseudocode | |||
| Basic Blocks | Address, size, type | ||
| Instruction count | |||
| Instructions | Mnemonic, operands, bytes | ||
| Graphs | Call graph | ||
| CFG (per function) | |||
| Cross-references | Code refs (call, jump) | ||
| Data refs | |||
| Data | Address, type, size, name | ||
| Strings | Address and content | ||
| Symbols | Name, value, type | ||
| Comments | Function and instruction comments | ||
| Data Structures | Structs / unions | ||
| Enumerations | |||
| Arrays, pointers, typedefs | |||
| Type-to-type cross-references |
Note
Even in Light mode, instructions are still available through the Python API -- they are decoded transparently by Capstone when you access them. The "Instructions" row above refers to whether the exporter writes them into the .quokka file.
Note
Decompiled pseudocode requires the Hex-Rays decompiler (IDA only) and must be explicitly enabled with -OQuokkaDecompiled:true or the --decompiled CLI flag.
Other features
To ease Quokka usage in various workflows, the tool also provides several additional features:
- Capstone integration for transparent instruction decoding
- Pypcode integration (optional) for P-code based analysis
- Function annotation and write-back to the disassembler database (
prog.commit(), IDA only for now) - User-defined type injection (
prog.add_type()) - CLI tool (
quokka-cli) for batch export with both backends, with custom output naming via-o