Class |
Description |
|---|---|
|
|
|
|
|
|
A simple framework for writing line-oriented command interpreters. |
Bases: object
Activity in Binary Ninja represents an individual analysis or action to be performed on a
BinaryView or Function object.
Activities are the fundamental units of execution within a Workflow. Each Activity encapsulates
a specific task and defines its own behavior, dependencies, and eligibility criteria. Activities are
executed in the context of an AnalysisContext, which provides access to binary data, analysis
state, and utility functions.
Bases: object
AnalysisContext is a proxy object that provides access to the current analysis context,
including the associated BinaryView, Function, and intermediate language (IL)
representations. It provides APIs to retrieve and modify the in-progress analysis state and allows
users to notify the analysis system of any changes or updates.
Get all backed address ranges from the cached memory map.
Get the end address from the cached memory map.
End address
Get all mapped address ranges from the cached memory map.
Get the next backed address after the given address from the cached memory map.
Get the next mapped address after the given address from the cached memory map.
Get the next valid offset after the given offset from the cached memory map.
Get a section by name from the cached section map.
Get all sections containing the given address from the cached section map.
Get the segment containing the given address from the cached memory map.
Get a 64-bit signed integer setting from the cached settings.
Get a string list setting from the cached settings.
Get a 64-bit unsigned integer setting from the cached settings.
Get the start address from the cached memory map.
Start address
Check if an offset is backed by the file in the cached memory map.
Check if an offset has code semantics in the cached section map.
Check if an offset is executable in the cached memory map.
Check if an offset has external semantics in the cached section map.
Check if an offset is readable in the cached memory map.
Check if an offset has read-only semantics in the cached section map.
Check if an offset is writable in the cached memory map.
Check if an offset has writable semantics in the cached section map.
Set the Medium Level IL function in the current analysis, giving updated Low Level IL (SSA) to Medium Level IL instruction and expression mappings. :param new_func: New MLIL function :param llil_ssa_to_mlil_instr_map: Mapping from every LLIL SSA instruction to every MLIL instruction :param llil_ssa_to_mlil_expr_map: Mapping from every LLIL SSA expression to one or more MLIL expressions (first expression will be the primary)
new_func (MediumLevelILFunction) –
llil_ssa_to_mlil_instr_map (mediumlevelil.LLILSSAToMLILInstructionMapping | None) –
llil_ssa_to_mlil_expr_map (mediumlevelil.LLILSSAToMLILExpressionMapping | None) –
None
function.BasicBlockList of BasicBlocks in the current function (writable)
HighLevelILFunction used to represent High Level IL (writable)
LowLevelILFunction used to represent lifted IL (writable)
LowLevelILFunction used to represent Low Level IL (writable)
MediumLevelILFunction used to represent Medium Level IL (writable)
BinaryView for the current AnalysisContext (writable)
Bases: object
class Workflowin Binary Ninja defines the set of analyses to perform on a binary, including their dependencies and execution order.Workflows are represented as Directed Acyclic Graphs (DAGs), where each node corresponds to an
Activity(an individual analysis or action). Workflows are used to tailor the analysis process forBinaryVieworFunctionobjects, providing granular control over analysis tasks at module or function levels.A Workflow starts in an unregistered state, either by creating a new empty Workflow or by cloning an existing one. While unregistered, it is possible to add and remove
Activityobjects, as well as modify the execution strategy. To apply a Workflow to a binary, it must be registered. Once registered, the Workflow becomes immutable and is available for use.
- Example:
# Define the custom activity configuration
configuration = json.dumps({
"name": "analysis.plugins.xorStringDecoder",
"title": "XOR String Decoder",
"description": "This analysis step transforms XOR-encoded strings within the current function.",
"eligibility": {
"auto": {
"default": False
}
}
})
# Clone the meta function workflow for customization
workflow = Workflow("core.function.metaAnalysis").clone()
# Register a new activity
workflow.register_activity(Activity(
configuration,
action=lambda analysis_context: log_warn(
f"Decoder running for function: {hex(analysis_context.function.start)}"
# Insert decoder logic here :P
)
))
# Insert the new activity before the "generateHighLevelIL" step
workflow.insert("core.function.generateHighLevelIL", ["analysis.plugins.xorStringDecoder"])
# Register the modified meta function workflow
workflow.register()
activity_roots Retrieve the list of activity roots for the Workflow, or if specified just for the given activity.
assign_subactivities Assign the list of activities as the new set of children for the specified activity.
clear Remove all Activity nodes from this Workflow.
True on success, False otherwise
clone Clone a new Workflow, copying all Activities and the execution strategy.
configuration Retrieve the configuration as an adjacency list in JSON for the Workflow, or if specified just for the given activity.
activity (ActivityType) – if specified, return the configuration for the activity
an adjacency list representation of the configuration in JSON
contains Determine if an Activity exists in this Workflow.
activity (ActivityType) – the Activity name
True if the Activity exists, False otherwise
eligibility_settings Retrieve the list of eligibility settings for the Workflow.
get_activity Retrieve the Activity object for the specified activity.
graph Generate a FlowGraph object for the current Workflow and optionally show it in the UI.
FlowGraph object on success, None on failure
insert Insert the list of activities before the specified activity and at the same level.
insert_after Insert the list of activities after the specified activity and at the same level.
register Register this Workflow, making it immutable and available for use.
register_activity Register an Activity with this Workflow.
replace Replace the specified activity.
subactivities Retrieve the list of all activities, or optionally a filtered list.
Bases: object
handle (LP_BNFunction | LP_BNBinaryView | None) –
Bases: Cmd
Instantiate a line-oriented interpreter framework.
The optional argument ‘completekey’ is the readline name of a completion key; it defaults to the Tab key. If completekey is not None and the readline module is available, command completion is done automatically. The optional arguments stdin and stdout specify alternate input and output file objects; if not specified, sys.stdin and sys.stdout are used.
machine (WorkflowMachine) –
Run the workflow machine and generate a default configuration if the workflow is not configured.
Hook method executed just before the command line is interpreted, but after the input prompt is generated and issued.