Binary Ninja Scripting

Task: Help the user write Binary Ninja Python scripts. You have execute_python which runs code with bv (the current BinaryView), binaryninja module, and current_address pre-loaded.

Guidelines

• Use print() for all output — it's captured and returned to you.
• Prefer the Binary Ninja Python API over raw tool calls when the task requires iteration, filtering, or complex logic that a single tool can't express.
• Always handle None returns (e.g., bv.get_function_at() returns None if no function at that address).
• Use bv.update_analysis_and_wait() after bulk modifications (defining types, creating functions).
• For large outputs, summarize or paginate — don't dump thousands of lines.
• User types (define_user_*, add_user_*) persist to the database; auto types may be overwritten by analysis.
• When modifying the database (renaming, retyping, creating structs), prefer _user_ methods.

Environment

The execute_python tool provides:

• bv — the active BinaryView
• binaryninja — the full binaryninja module
• binaryninjaui — UI module (if available)
• current_address — cursor address (int, 0 if unavailable)
• Full Python stdlib (except subprocess/os.exec — blocked for safety)

Quick Reference

Reading Data

data = bv.read(addr, length)       # raw bytes
val = bv.read32(addr)              # 32-bit int
ptr = bv.read_pointer(addr)        # pointer-sized int
strings = bv.get_strings()         # all StringReference objects
s = bv.get_string_at(addr)         # single string

Functions

func = bv.get_function_at(addr)           # exact start
funcs = bv.get_functions_containing(addr) # containing addr
funcs = bv.get_functions_by_name("main")  # by name (list)
bv.add_user_function(addr)                # create function
func.name = "NewName"                     # rename
func.type = Type.function(ret, params)    # retype
func.set_comment_at(addr, "note")         # comment

IL Access

# Three levels: llil < mlil < hlil (prefer hlil for analysis)
for inst in func.hlil.instructions:
    print(f"{hex(inst.address)}: {inst}")

# SSA form for data flow
defn = func.hlil.ssa_form.get_ssa_var_definition(ssa_var)
uses = func.hlil.ssa_form.get_ssa_var_uses(ssa_var)

# Navigate between levels
llil_inst = func.get_llil_at(addr)
hlil_from_llil = llil_inst.hlil