DOCSEARCHbyAlgolia
Submit Docs

Binary Ninja API

repository·dev·Indexed 22 days ago

https://github.com/vector35/binaryninja-api

Source code and documentation for the C++, Python, and Rust APIs used to extend the Binary Ninja reverse engineering platform. Includes implementation and build instructions for architecture plugins such as AArch64, ARMv7, and MIPS, as well as tools for generating ARM PCode parsers and Thumb disassemblers.

Tokens
149.5K
Snippets
229
Records
687
Agent score
66%

What's inside binaryninja-api

  1. Overview of the Triage plugin capabilities

    dev

    The Triage plugin serves as an example of the Binary Ninja UI plugin capability and demonstrates how to adapt core analysis for specific workflows.

    Key features include:

    • UI Integration: Adds a new button to the new page dialog.
    • File Selection: Provides a file choosing UI for rapid selection of large numbers of files.
    • Custom Views:
      • Triage View: Displays high-level summary information.
      • Byte Overview: Shows file contents in a high-density format.
    • Dynamic Analysis: Enables finding cross-references to dynamically loaded functions.

  2. Overview of Binary Ninja Python API Example Types

    dev

    The Python API examples are categorized by how they interact with the Binary Ninja environment:

    Stand-alone

    These run outside the UI (requires commercial license/GUI-less processing):

    • bin_info.py: General binary information.
    • cli_dis.py: Command line disassembly utility.
    • cli_lift.py: Command line IL dumping utility.
    • feature_map.py: Command line generation of the feature map.
    • instruction_iterator.py: Iterates through functions, blocks, and instructions.
    • print_syscalls.py: Extracts syscall numbers from IL.
    • pe_stat.py: PE statistics utility.
    • version_switcher.py: Uses the update API for version management.

    GUI Plugins

    These require the Binary Ninja UI to be running:

    • angr_plugin.py: Demonstrates background threads, UI elements, and highlighting.
    • asm_to_llil_view.py: Custom Flow Graph view showing disassembly and LLIL.
    • breakpoint.py: Demonstrates cross-platform breakpoint overwriting and GUI menu item registration.
    • export_svg.py: Exports function graph views to SVG.
    • helloglobarea.py: Example Global Area UI element.
    • hellopane.py: Example Pane UI element.
    • hellosidebar.py: Example Sidebar UI element.
    • jump_table.py: Heuristic jump table detection.
    • make_code.py: Renders hex as disassembly using a DataRenderer.
    • mapped_view.py: Custom BinaryView showing memory region mapping.
    • ui_notification_callbacks.py: Demonstrates UI notification callbacks.
    • Snippets: Code-editing plugin for managing Python snippets.
    • Kaitai: Hex dump browsing via Kaitai Struct.

    Both (Hybrid)

    These can operate in either the GUI or as stand-alone plugins:

    • arch_hook.py: Modifies built-in architecture behavior via architecture hooks.
    • debug_info.py: Custom debug info implementation (e.g., for DWARF/PDB).
    • nds.py: NDS ROM file loader.
    • nes.py: 6502 CPU architecture and .NES parser.
    • nfs.py: NSF music file loader.
    • notification_callbacks.py: Notification callbacks usable in UI or headless.
    • rust_string.py: Recovers Rust &str strings using StringRecognizer and DataRenderer.
    • typelib_create.py / typelib_dump.py: Examples for Type Library usage.

  4. Access the Binary Ninja API via different language bindings

    dev

    The Binary Ninja API is exposed through several different interfaces depending on your development needs:

    • Python API: The most common interface used for third-party plugins and scripting.
    • C++ API: The most robust and feature-complete interface, used by the Binary Ninja UI itself.
    • Rust API: An experimental interface that currently lacks complete coverage of all core APIs.
    • Core API: A low-level shim designed to be used by other language bindings (like Python or Rust) rather than for building C plugins directly.

  8. Identify First Party Open Source components

    dev

    Several components of Binary Ninja are released under open source licenses by Vector 35. If you are building on top of these specific modules, note their respective licenses:

    • APIs (Python, C, C++) and Documentation: MIT
    • Rust API: Apache License 2.0
    • LIB Files (included with native Windows builds): MIT
    • Views: Apache License 2.0
    • Architectures: Apache License 2.0
    • DWARF Import: MIT
    • DWARF Export: MIT
    • IDB Import: MIT
    • SCC: MIT
    • Ghidra DB FFI: Apache License 2.0

  9. Supported Minidump Types for Binary Ninja Minidump View

    dev

    The Binary Ninja Minidump View plugin is designed to load minidump files generated specifically by the Windows MiniDumpWriteDump API.

    Compatible sources include:

    • WinDbg: Using the .dump command.
    • Binary Ninja Debugger: Using the .dump command for Windows targets.
    • x64dbg: Using the minidump command.
    • Windows System Tools: Creating dumps via right-click actions in Windows Task Manager, Process Hacker, or Sysinternals Process Explorer.

    For best results, it is recommended to generate a full dump rather than a minimal one.

  10. How EFI Resolver works

    dev

    EFI Resolver is a Binary Ninja plugin that automates the resolution of EFI protocol type information for both DXE files and PEI modules.

    Key capabilities include:

    • Type Propagation: It propagates parameter pointers from entry points to system tables (including the main system table, MM system table, boot services, and runtime services) and assigns types to global variables.
    • PEI Support: It can detect processor-specific patterns used to retrieve PEI services pointers.
    • Protocol Identification: It identifies references to boot services, MM protocol functions, and PEI services, applying type information based on the GUIDs passed to these functions.
    • Customization: It supports the core UEFI specification while allowing users to define custom vendor protocols via GUID and type mapping.

  11. What is High Level IL (HLIL)?

    dev

    High Level Intermediate Language (HLIL) is the decompiler output in Binary Ninja. Like LLIL and MLIL, it is a tree-based representation, but it is specifically designed to recover high-level language concepts and fold expressions.

    Key characteristics include:

    • Recovery of high-level language constructs.
    • Expression folding for simplified analysis.
    • A simplified representation consisting of small, discrete operations.
    • Support for source-level queries and analysis.

  12. Overview of Binary Ninja MCP Server variants

    dev

    Binary Ninja exposes analysis data to MCP clients via two server variants depending on your license and desired transport method:

    • GUI MCP server: Uses HTTP transport. It runs inside the Binary Ninja GUI and is included with Binary Ninja Free or Personal editions. It follows the active view currently selected in the UI.
    • Headless MCP server: Uses stdio transport. It runs as a standalone command-line server (binaryninja_mcp) and is included with Binary Ninja Commercial or Ultimate editions. It manages its own active BinaryView via MCP tools.