Most analysis bridges stop at reading. This one renames functions, variables and data labels, sets comments and prototypes, declares C types and retypes variables, so an hour spent working through a stripped binary leaves the .bndb better than it found it. patch_bytes goes further and writes to the binary itself, with save_to_file deciding whether that reaches disk, so it is worth knowing which binary select_binary has active before you use it.
A bridge to a running Binary Ninja instance: 54 tools covering the analysis views, the cross-reference graph, the type system and the write-back operations of a reverse-engineering session.
- The same function in three forms — decompiled C, IL in the hlil, mlil or llil view with optional SSA form, and assembly mnemonics
- Cross references to an address, and also to a named struct field, struct, union, enum or type, which is the lookup a decompiler listing does not give you
- Renames that persist into the database: functions, single variables, batches of local variables in one call, and data labels, plus comments at an address or on a function
- Type recovery — define types from a C string, declare or update a local type, retype a variable, set a function prototype, and resolve a type name to its members and enum values
- The orientation pass on a new sample: entry points, imports, exports, segments, sections, namespaces, paginated or filtered strings, and hexdumps of a data symbol
- Patching: write bytes at an address with the option to save to file, and create a function at an address the analysis missed
- Several open binaries known to one server, selected by ordinal, view id, full path or basename
A Binary Ninja installation with the binary loaded — every tool acts on the view that Binary Ninja already has open. No credentials. Licensed GPL-3.0, which constrains how you redistribute anything built on it.
One command — npx -y binary-ninja-mcp