Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
b1518f1
Changed "include" to "including" (grammar) and "non" to "none (typo)
ashvika-creator May 12, 2026
4435464
fixed typo in the word "analyzing"
ashvika-creator May 12, 2026
9087190
Changed from "IL Hierarch" to "IL Hierarchy" (typo)
ashvika-creator May 12, 2026
646ce2b
changed "expresses" to "expressions" (typo) and added comma (grammar)
ashvika-creator May 12, 2026
2494ee2
changed "it's" to "its" (grammar)
ashvika-creator May 12, 2026
7ea82b2
there was a random j floating on screen - removed that
ashvika-creator May 12, 2026
6e6d271
changed "straight forward" to "straightforward" (one word)
ashvika-creator May 12, 2026
9ba27ea
changed "api" to "API" (capitalization)
ashvika-creator May 12, 2026
0bc3c25
changed to exclamation point ..
ashvika-creator May 12, 2026
a3d9f65
fixed formatting - changed [CTRL + 9] to [CTRL] + 9 to match the rest…
ashvika-creator May 13, 2026
7263dba
Descrption did not match diagram so fixed that
ashvika-creator May 13, 2026
918a8f7
changed "on" to "one" (typo)
ashvika-creator May 13, 2026
e5c7981
changed "tn" to "in" (typo)
ashvika-creator May 13, 2026
6f9bf8d
changed "much" to "must" (typo)
ashvika-creator May 13, 2026
ab7d3d6
changed "existing" to "exist" (grammar)
ashvika-creator May 13, 2026
72ba095
changed "basis" to "basic" (typo)
ashvika-creator May 13, 2026
8f7f11c
changed from "corresponds the" to "corresponds to the" (grammar)
ashvika-creator May 13, 2026
d6f03ff
changed "Inheritence" to "Inheritance" (spelling error)
ashvika-creator May 13, 2026
670f5d8
changed "There's" to "There are" (grammar)
ashvika-creator May 13, 2026
bdf484e
Updated Edit Function Properties dialog + screenshot
ashvika-creator May 26, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/dev/annotation.md
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ The tags API has been reworked in 3.4 to be easier to use and understand.

### TagTypes

A [TagType](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.TagType) is the object that represents the "type" of tag something is. By default, a binary view starts off with several tag types, include "Bugs," "Crashes," "Important," and so on.
A [TagType](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.TagType) is the object that represents the "type" of tag something is. By default, a binary view starts off with several tag types, including "Bugs," "Crashes," "Important," and so on.

Before you can create a tag of a type that's not already in the BinaryView, you need to create the tag type.

Expand Down Expand Up @@ -481,7 +481,7 @@ current_function.parameter_vars[0].type = Type.pointer(bv.arch, Type.char())
>>> bv.get_data_var_at(here).type = Type.char()
```

#### Applying a type where non exists yet
#### Applying a type where none exists yet

In some instances you may need to first create a `DataVariable` before you can set the type at a given location:

Expand Down
2 changes: 1 addition & 1 deletion docs/dev/batch.md
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ If using a floating license, you can use the [example code](https://api.binary.n

### In-Memory License

For many applications it might be helpful to avoid having a license file on disk. Whether because the environment will be used to analyze malware, or because a docker image might be saved somewhere that the license file needs to be kept secret. (Note: this does not obfuscate the serial number as it can be extracted from memory or even via the API -- an informed attacker can still leak it and network isolation is recommended for analzying malicious applications)
For many applications it might be helpful to avoid having a license file on disk. Whether because the environment will be used to analyze malware, or because a docker image might be saved somewhere that the license file needs to be kept secret. (Note: this does not obfuscate the serial number as it can be extracted from memory or even via the API -- an informed attacker can still leak it and network isolation is recommended for analyzing malicious applications)

To use this API, copy the contents of your license file into a string and pass it as an argument to [`core_set_license`](https://api.binary.ninja/#binaryninja.core_set_license)

Expand Down
2 changes: 1 addition & 1 deletion docs/dev/bnil-overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ It represents the lower 32-bits of variable `rax_2`, sign-extended into a 64-bit

## Using the API with ILs

When you want to use the API to access BNIL instructions, here are a few tips that will help you with the task. First, if you want to learn what properties different instructions have, instead of manually using `dir()` or looking in the documentation ([1](https://docs.binary.ninja/dev/bnil-llil.html#the-instructions), [2](https://docs.binary.ninja/dev/bnil-mlil.html#the-instruction-set)) lists is to use the [BNIL Graph](https://github.com/Vector35/community-plugins#:~:text=BNIL%20Instruction%20Graph) plugin. Another very useful plugin is the [IL Hierarch](https://github.com/Vector35/community-plugins#:~:text=into%20Binary%20Ninja.-,ilhierarchy,-Fabian%20Freyer) plugin. This plugin is extremely useful for showing the _structure_ of IL instructions relative to one another. You can use several APIs ([1](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILInstruction.show_llil_hierarchy), [2](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction.show_mlil_hierarchy), [3](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction.show_hlil_hierarchy)) to see this overall structure, but the IL Hierarchy plugin lets you select a single IL instruction and see visually which categories of IL instructions it is in.
When you want to use the API to access BNIL instructions, here are a few tips that will help you with the task. First, if you want to learn what properties different instructions have, instead of manually using `dir()` or looking in the documentation ([1](https://docs.binary.ninja/dev/bnil-llil.html#the-instructions), [2](https://docs.binary.ninja/dev/bnil-mlil.html#the-instruction-set)) lists is to use the [BNIL Graph](https://github.com/Vector35/community-plugins#:~:text=BNIL%20Instruction%20Graph) plugin. Another very useful plugin is the [IL Hierarchy](https://github.com/Vector35/community-plugins#:~:text=into%20Binary%20Ninja.-,ilhierarchy,-Fabian%20Freyer) plugin. This plugin is extremely useful for showing the _structure_ of IL instructions relative to one another. You can use several APIs ([1](https://api.binary.ninja/binaryninja.lowlevelil-module.html#binaryninja.lowlevelil.LowLevelILInstruction.show_llil_hierarchy), [2](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction.show_mlil_hierarchy), [3](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction.show_hlil_hierarchy)) to see this overall structure, but the IL Hierarchy plugin lets you select a single IL instruction and see visually which categories of IL instructions it is in.

![LLIL Hierarchy](../img/llil-hierarchy.png)

Expand Down
4 changes: 2 additions & 2 deletions docs/dev/concepts.md
Original file line number Diff line number Diff line change
Expand Up @@ -147,13 +147,13 @@ Generally speaking, scripts should operate on ILs. The available information far

### Instruction Index vs Expression Index

It is easy to confuse ExpressionIndex and InstructionIndex properties in the API. While they [are both integers](https://github.com/Vector35/binaryninja-api/blob/dev/python/highlevelil.py#L49-L50) they mean different things and it's important to keep them straight. The Instruction Index is a unique index for that given IL level for that given function. However, because BNIL is [tree-based](bnil-overview.md), when there are nested expresses the expression index may be needed. These indexes are also unique per-function and per-IL level, but they are _distinct_ from instruction indexes even though they may occasionally be similar since they each start at 0 for a given function!
It is easy to confuse ExpressionIndex and InstructionIndex properties in the API. While they [are both integers](https://github.com/Vector35/binaryninja-api/blob/dev/python/highlevelil.py#L49-L50), they mean different things and it's important to keep them straight. The Instruction Index is a unique index for that given IL level for that given function. However, because BNIL is [tree-based](bnil-overview.md), when there are nested expressions the expression index may be needed. These indexes are also unique per-function and per-IL level, but they are _distinct_ from instruction indexes even though they may occasionally be similar since they each start at 0 for a given function!

### Static Single Assignment Basics

Our [BNIL Overview](bnil-overview.md) mentions Static Single Assignment (SSA) without explaining what it is. You can of course always check out [Wikipedia](https://en.wikipedia.org/wiki/Static_single-assignment_form), but here's a quick summary of what it is, why we expose multiple SSA forms of our ILs and how you can use it to improve your plugin writing with BNIL.

At it's simplest, SSA forms of an Intermediate Language or Intermediate Representation are those in which variables are read only. They can be set when created, but not modified. Instead of modifying them, when you make a change, a new "version" of the variable is created denoting that the value has changed in some way. While this certainly makes the form less readable to humans, this means it's actually really easy to walk back and see how a variable has been modified by simply looking at the definition site for a given variable or all possible versions before it. Any time the variable is modified, a new version of that variable will be created (you'll see `#` followed by a number indicating that this is a new version).
At its simplest, SSA forms of an Intermediate Language or Intermediate Representation are those in which variables are read only. They can be set when created, but not modified. Instead of modifying them, when you make a change, a new "version" of the variable is created denoting that the value has changed in some way. While this certainly makes the form less readable to humans, this means it's actually really easy to walk back and see how a variable has been modified by simply looking at the definition site for a given variable or all possible versions before it. Any time the variable is modified, a new version of that variable will be created (you'll see `#` followed by a number indicating that this is a new version).

But what if the code takes multiple paths and could have different values depending on the path that was taken? SSA forms use a `Φ` (pronounced either as "fee" or "fi" like "fly" depending on which mathematician or Greek speaker you ask!) function to solve this ambiguity. All a `Φ` function does is aggregate different versions of a variable when entering a basic block with multiple paths. So a basic block with two incoming edges where `eax` is modified might have something like: `eax#3 = Φ(eax#1, eax#2)` denoting that the new version of the variable could have come from either of those sources.

Expand Down
2 changes: 1 addition & 1 deletion docs/dev/cookbook.md
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@ As defined by having the highest sum of incoming and outgoing calls. Adjust acco
```python
max(bv.functions, key=lambda x: len(x.callers + x.callees))
```
j

### Accessing cross references

This recipe is useful for iterating over all of the HLIL cross-references of a given interesting function:
Expand Down
2 changes: 1 addition & 1 deletion docs/dev/documentation.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ To contribute to the Binary Ninja documentation, first sign the [contribution li
echo API documentation available in build/html

## Changing
Changing documentation for the API itself is fairly straight forward. Use [doxygen style comment blocks](https://www.doxygen.nl/manual/docblocks.html) in C++ and C, and [restructured text blocks](https://sphinx-tutorial.readthedocs.io/step-1/) for python for the source. The user documentation is located in the `api/docs/` folder and the API documentation is generated from the config in the `api/api-docs` folder.
Changing documentation for the API itself is fairly straightforward. Use [doxygen style comment blocks](https://www.doxygen.nl/manual/docblocks.html) in C++ and C, and [restructured text blocks](https://sphinx-tutorial.readthedocs.io/step-1/) for python for the source. The user documentation is located in the `api/docs/` folder and the API documentation is generated from the config in the `api/api-docs` folder.

???+ Info "Tip"
When updating user documentation, the `properdocs serve` feature is particularly helpful.
Expand Down
2 changes: 1 addition & 1 deletion docs/getting-started.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ The download links you receive after purchasing expire after 72 hours but as lon

### Linux

Because Linux install locations can vary widely, we do not assume that Binary Ninja has been installed in any particular folder on Linux. Instead, first unzip the installation zip wherever you wish to install Binary Ninja. Next, for paid versions, run `./binaryninja/scripts/linux-setup.sh`. This sets up file associations, icons, and adds Binary Ninja's Python library to your Python path. Adding the library to your path is most helpful for headless functionality in the Commercial and Ultimate editions, but even on the Non-Commercial edition it can help your IDE find the api sources to make plugin development easier. Run the script with `-h` to see customization options.
Because Linux install locations can vary widely, we do not assume that Binary Ninja has been installed in any particular folder on Linux. Instead, first unzip the installation zip wherever you wish to install Binary Ninja. Next, for paid versions, run `./binaryninja/scripts/linux-setup.sh`. This sets up file associations, icons, and adds Binary Ninja's Python library to your Python path. Adding the library to your path is most helpful for headless functionality in the Commercial and Ultimate editions, but even on the Non-Commercial edition it can help your IDE find the API sources to make plugin development easier. Run the script with `-h` to see customization options.

### macOS

Expand Down
Loading