394 lines
182 KiB
JSON
394 lines
182 KiB
JSON
|
{
|
||
|
"docs": [
|
||
|
{
|
||
|
"location": "/index.html",
|
||
|
"text": "Binary Ninja\n\n\nA new kind of reverse engineering platform\n\n\n\n\nBinary Ninja\n is a reverse engineering platform. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on a custom IL to quickly adapt to a variety of architectures, platforms, and compilers.",
|
||
|
"title": "Home"
|
||
|
},
|
||
|
{
|
||
|
"location": "/index.html#binary-ninja",
|
||
|
"text": "A new kind of reverse engineering platform Binary Ninja is a reverse engineering platform. It focuses on a clean and easy to use interface with a powerful multithreaded analysis built on a custom IL to quickly adapt to a variety of architectures, platforms, and compilers.",
|
||
|
"title": "Binary Ninja"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html",
|
||
|
"text": "Getting Started\n\n\nWelcome to Binary Ninja. This introduction document is meant to quickly guide you over some of the most common uses of Binary Ninja.\n\n\nDirectories\n\n\nBinary Ninja uses two main locations. The first is the install path of the binary itself and the second is the user folders for user-installed content.\n\n\nBinary Path\n\n\nBinaries are installed in the following locations by default:\n\n\n\n\nOS X: \n/Applications/Binary Ninja.app\n\n\nWindows: \nC:\\Program Files\\Vector35\\BinaryNinja\n\n\nLinux: Wherever you extract it! (No standard location)\n\n\n\n\n\n\nWarning\n\n\nDo not put any user content in the install-path of Binary Ninja. The auto-update process of Binary Ninja may replace any files included in these folders. \n\n\n\n\nUser Folder\n\n\nThe base locations of user folders are: \n\n\n\n\nOS X: \n~/Library/Application Support/Binary Ninja\n\n\nLinux: \n~/.binaryninja\n\n\nWindows: \n%APPDATA%\\Binary Ninja\n\n\n\n\nContents of the user folder includes:\n\n\n\n\nlastrun\n: A text file containing the directory of the last BinaryNinja binary path -- very useful for plugins to resolve the install locations in non-default settings or on linux.\n\n\nlicense.dat\n: License file\n\n\nplugins/\n: Folder containing all manually installed user plugins\n\n\nrepositories/\n: Folder containing files and plugins managed by the \nPlugin Manager API\n\n\nsettings.json\n: Advanced settings (see \nsettings\n)\n\n\n\n\n\n\nLicense\n\n\nWhen you first run Binary Ninja, it will prompt you for your license key. You should have received your license key via email after your purchase. If not, please contact \nsupport\n.\n\n\nOnce the license key is installed, you can change it, back it up, or otherwise inspect it simply by looking inside the base of the user folder for \nlicense.dat\n.\n\n\nLinux Setup\n\n\nBecause linux install locations can vary widely, we do not assume a Binary Ninja has been installed in any particular folder on linux. Rather, you can simply run \nbinaryninja/scripts/linux-setup.sh\n after extracting the zip and various file associations, icons, and other settings will be set up. Run it with \n-h\n to see the customization options.\n\n\nLoading Files\n\n\nYou can load files in many ways:\n\n\n\n\nDrag-and-drop a file onto the Binary Ninja window\n\n\nUse the \nFile/Open\n menu or \nOpen\n button on the start screen\n\n\nClicking an item in the recent files list\n\n\nRunning Binary Ninja with an optional command-line parameter\n\n\nOpening a file from a URL via the \n\u2318-l\n or \n\u2303-l\n hotkey\n\n\nOpening a file using the binaryninja: url handler. For security reasons, the url handler requires you to confirm a warning before opening a file via the url handler. The url handler can open remote URLs like: \nbinaryninja:https://captf.com/2015/plaidctf/pwnable/datastore_7e64104f876f0aa3f8330a409d9b9924.elf\n, or even local files like \nbinarynina://bin/ls\n in cases where you wish to script up Binary Ninja from a local webapp.\n\n\n\n\n\n\nAnalysis\n\n\n\n\nAs soon as you open a file, Binary Ninja begins its auto-analysis.\n\n\nEven while Binary Ninja is analyzing a binary, the UI should be responsive. Not only that, but because the analysis prioritizes user-requested analysis, you can start navigating a binary immediately and any functions you select will be added to the top of the analysis queue. The current progress through a binary is shown in the status bar, but note that the total number of items left to analyze will go up as well as the binary is processed and more items are discovered that require analysis.\n\n\nErrors or warnings during the load of the binary are also shown in the status bar, along with an icon (in the case of the image above, a large number of warnings were shown). The most common warnings are from incomplete lifting and can be safely ignored. If the warnings include a message like \nData flow for function at 0x41414141 did not terminate\n, then please report the binary to the [bug database][issues].\n\n\nInteracting\n\n\nNavigating\n\n\nNav
|
||
|
"title": "Getting Started Guide"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#getting-started",
|
||
|
"text": "Welcome to Binary Ninja. This introduction document is meant to quickly guide you over some of the most common uses of Binary Ninja.",
|
||
|
"title": "Getting Started"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#directories",
|
||
|
"text": "Binary Ninja uses two main locations. The first is the install path of the binary itself and the second is the user folders for user-installed content.",
|
||
|
"title": "Directories"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#binary-path",
|
||
|
"text": "Binaries are installed in the following locations by default: OS X: /Applications/Binary Ninja.app Windows: C:\\Program Files\\Vector35\\BinaryNinja Linux: Wherever you extract it! (No standard location) Warning Do not put any user content in the install-path of Binary Ninja. The auto-update process of Binary Ninja may replace any files included in these folders.",
|
||
|
"title": "Binary Path"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#user-folder",
|
||
|
"text": "The base locations of user folders are: OS X: ~/Library/Application Support/Binary Ninja Linux: ~/.binaryninja Windows: %APPDATA%\\Binary Ninja Contents of the user folder includes: lastrun : A text file containing the directory of the last BinaryNinja binary path -- very useful for plugins to resolve the install locations in non-default settings or on linux. license.dat : License file plugins/ : Folder containing all manually installed user plugins repositories/ : Folder containing files and plugins managed by the Plugin Manager API settings.json : Advanced settings (see settings )",
|
||
|
"title": "User Folder"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#license",
|
||
|
"text": "When you first run Binary Ninja, it will prompt you for your license key. You should have received your license key via email after your purchase. If not, please contact support . Once the license key is installed, you can change it, back it up, or otherwise inspect it simply by looking inside the base of the user folder for license.dat .",
|
||
|
"title": "License"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#linux-setup",
|
||
|
"text": "Because linux install locations can vary widely, we do not assume a Binary Ninja has been installed in any particular folder on linux. Rather, you can simply run binaryninja/scripts/linux-setup.sh after extracting the zip and various file associations, icons, and other settings will be set up. Run it with -h to see the customization options.",
|
||
|
"title": "Linux Setup"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#loading-files",
|
||
|
"text": "You can load files in many ways: Drag-and-drop a file onto the Binary Ninja window Use the File/Open menu or Open button on the start screen Clicking an item in the recent files list Running Binary Ninja with an optional command-line parameter Opening a file from a URL via the \u2318-l or \u2303-l hotkey Opening a file using the binaryninja: url handler. For security reasons, the url handler requires you to confirm a warning before opening a file via the url handler. The url handler can open remote URLs like: binaryninja:https://captf.com/2015/plaidctf/pwnable/datastore_7e64104f876f0aa3f8330a409d9b9924.elf , or even local files like binarynina://bin/ls in cases where you wish to script up Binary Ninja from a local webapp.",
|
||
|
"title": "Loading Files"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#analysis",
|
||
|
"text": "As soon as you open a file, Binary Ninja begins its auto-analysis. Even while Binary Ninja is analyzing a binary, the UI should be responsive. Not only that, but because the analysis prioritizes user-requested analysis, you can start navigating a binary immediately and any functions you select will be added to the top of the analysis queue. The current progress through a binary is shown in the status bar, but note that the total number of items left to analyze will go up as well as the binary is processed and more items are discovered that require analysis. Errors or warnings during the load of the binary are also shown in the status bar, along with an icon (in the case of the image above, a large number of warnings were shown). The most common warnings are from incomplete lifting and can be safely ignored. If the warnings include a message like Data flow for function at 0x41414141 did not terminate , then please report the binary to the [bug database][issues].",
|
||
|
"title": "Analysis"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#interacting",
|
||
|
"text": "",
|
||
|
"title": "Interacting"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#navigating",
|
||
|
"text": "Navigating code in Binary Ninja is usually a case of just double-clicking where you want to go. Addresses, references, functions, jmp edges, etc, can all be double-clicked to navigate. Additionally, The g hotkey can navigate to a specific address in the current view. Switching views happens multiple ways. In some instances, it's automatic (clicking a data reference from graph view will navigate to linear view as data is not shown in the graph view), and there are multiple ways to manually change views as well. While navigating, you can use the view hotkeys (see below) to switch to a specific view at the same location as the current selection. Alternatively, the view menu in the bottom-right can be used to change views without navigating to any given location.",
|
||
|
"title": "Navigating"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#hotkeys",
|
||
|
"text": "h : Switch to hex view p : Create a function [ESC] : Navigate backward [CMD] [ (OS X) : Navigate backward [CMD] ] (OS X) : Navigate forward [CTRL] [ (Windows/Linux) : Navigate backward [CTRL] ] (Windows/Linux) : Navigate forward [SPACE] : Toggle between linear view and graph view g : Go To Address dialog n : Name a symbol u : Undefine a symbol e : Edits an instruction (by modifying the original binary -- currently only enabled for x86, and x64) x : Focuses the cross-reference pane ; : Adds a comment i : Cycles between disassembly, low-level il, and medium-level il in graph view y : Change type a : Change the data type to an ASCII string [1248] : Change type directly to a data variable of the indicated widths a : Change the data type to an ASCII string d : Switches between data variables of various widths r : Change the data type to single ASCII character o : Create a pointer data type [CMD-SHIFT] + (OS X) : Graph view zoom in [CMD-SHIFT] - (OS X) : Graph view zoom out [CTRL-SHIFT] + (Windows/Linux) : Graph view zoom in [CTRL-SHIFT] - (Windows/Linux) : Graph view zoom out",
|
||
|
"title": "Hotkeys"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#graph-view",
|
||
|
"text": "The default view in Binary Ninja when opening a binary is a graph view that groups the basic blocks of disassembly into visually distinct blocks with edges showing control flow between them. Features of the graph view include: Ability to double click edges to quickly jump between locations Zoom (CTRL-mouse wheel) Vertical Scrolling (Side scroll bar as well as mouse wheel) Horizontal Scrolling (Bottom scroll bar as well as SHIFT-mouse wheel) Individual highlighting of arguments, addresses, immediate values Edge colors indicate whether the path is the true or false case of a conditional jump (a color-blind option in the preferences is useful for those with red-green color blindness) Context menu that can trigger some function-wide actions as well as some specific to the highlighted instruction (such as inverting branch logic or replacing a specific function with a NOP)",
|
||
|
"title": "Graph View"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#view-options",
|
||
|
"text": "Each of the views (Hex, Graph, Linear) have a variety of options configurable in the bottom-right of the UI. Current options include: Hex Background highlight None Column Byte value Color highlight None ASCII and printable Modification Contrast Normal Medium Highlight Graph Show address Show opcode bytes Assembly Lifted IL Show IL flag usage (if showing Lifted IL) Low Level IL Show basic block register state (if showing Low Level IL) Linear Show address Show opcode bytes",
|
||
|
"title": "View Options"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#hex-view",
|
||
|
"text": "The hexadecimal view is useful for view raw binary files that may or may not even be executable binaries. The hex view is particularly good for transforming data in various ways via the Copy as , Transform , and Paste from menus. Note that Transform menu options will transform the data in-place, and that these options will only work when the Hex View is in the Raw mode as opposd to any of the binary views (such as \"ELF\", \"Mach-O\", or \"PE\"). Note that any changes made in the Hex view will take effect immediately in any other views open into the same file (new views can be created via the Split to new tab , or Split to new window options under View .). This can, however, cause large amounts of re-analysis so be warned before making large edits or transformations in a large binary file.",
|
||
|
"title": "Hex View"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#xrefs-view",
|
||
|
"text": "The xrefs view in the lower-left shows all cross-references to a given location or reference. Note that the cross-references pane will change depending on whether an entire line is selected (all cross-references to that address are shown), or whether a specific token within the line is selected. One fun trick that the xrefs view has up its sleeve: when in Hex View , a large range of memory addresses can be selected and the xrefs pane will show all xrefs to any location within that range of data.",
|
||
|
"title": "Xrefs View"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#linear-view",
|
||
|
"text": "Linear view is a hybrid view between a graph-based disassembly window and the raw hex view. It lists the entire binary's memory in a linear fashion and is especially useful when trying to find sections of a binary that were not properly identified as code or even just examining data. Linear view is most commonly used for identifying and adding type information for unknown data. To this end,",
|
||
|
"title": "Linear View"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#function-list",
|
||
|
"text": "The function list in Binary Ninja shows the list of functions currently identified. As large binaries are analyzed, the list may grow during analysis. The function list starts with known functions such as the entry point, exports, or using other features of the binary file format and explores from there to identify other functions. The function list also highlights imports, and functions identified with symbols in different colors to make them easier to identify. Tip To search in the function list, just click to make sure it's focused and start typing!",
|
||
|
"title": "Function List"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#script-python-console",
|
||
|
"text": "The integrated script console is useful for small scripts that aren't worth writing as full plugins. To trigger the console, either use CTRL - BACKTICK , or use the View / Script console menu. Once loaded, the script console can be docked in different locations or popped out into a stand-alone window. Note that at this time window locations are not saved on restart. Multi-line input is possible just by doing what you'd normally do in python. If you leave a trailing : at the end of a line, the box will automatically turn into a multi-line edit box, complete with a command-history. To submit that multi-line input, use CTRL - ENTER By default the interactive python prompt has a number of convenient helper functions and variables built in: here / current_address : address of the current selection bv / current_view / : the current BinaryView current_function : the current Function current_basic_block : the current BasicBlock current_llil : the current LowLevelILFunction current_mlil : the current MediumLevelILFunction current_selection : a tuple of the start and end addresses of the current selection write_at_cursor(data) : function that writes data to the start of the current selection get_selected_data() : function that returns the data in the current selection Note The current script console only supports Python at the moment, but it's fully extensible for other programming languages for advanced users who wish to implement their own bindings.",
|
||
|
"title": "Script (Python) Console"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#using-plugins",
|
||
|
"text": "Plugins can be installed by one of two methods. First, they can be manually installed by adding the plugin (either a .py file or a folder implementing a python module with a __init__.py file) to the appropriate path: OS X: ~/Library/Application Support/Binary Ninja/plugins/ Linux: ~/.binaryninja/plugins/ Windows: %APPDATA%\\Binary Ninja\\plugins Alternatively, plugins can be installed with the new pluginmanager API. For more detailed information, see the plugin guide .",
|
||
|
"title": "Using Plugins"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#pdb-plugin",
|
||
|
"text": "Binary Ninja supports loading PDB files through the built in PDB plugin. When selected from the plugin menu it attempts to find where the corresponding PDB file is located using the following search order: Look for in the same directory as the opened file/bndb (e.g. If you ahve c:\\foo.exe or c:\\foo.bndb open the pdb plugin looks for c:\\foo.pdb ) Look in the local symbol store. This is the directory specified by the settings: local-store-relative or local-store-absolute . The format of this directory is foo.pdb\\ guid \\foo.pdb . Attempt to connect and download the PDB from the list of symbol servers specified in setting symbol-server-list . Prompt the user for the pdb.",
|
||
|
"title": "PDB Plugin"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#preferencesupdates",
|
||
|
"text": "Binary Ninja automatically updates itself by default. This functionality can be disabled in the preferences by turning off the Update to latest version automatically option. Updates are silently downloaded in the background and when complete an option to restart is displayed in the status bar. Whenever Binary Ninja restarts next, it will replace itself with the new version as it launches. On windows, this is achieved through a separate launcher that loads first and replaces the installation before launching the new version. On OS X and Linux, the original installation is overwritten after the update occurs as these operating systems allow files to be replaced while running. The update on restart is thus immediate.",
|
||
|
"title": "Preferences/Updates"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#settings",
|
||
|
"text": "Settings are stored in the user directory in the file settings.json . Each top level object in this file is represents a different plugin. As of build 860 the following settings are available: Plugin Setting Type Default Description analysis max-function-size integer 65536 Any functions over this size will not be automatically analyzed and require manual override core linux_ca_bundle string \"\" Certificate authority (.pem or .crt) file to be used for secure downloads core linux_ca_dir string \"\" Certificate authority directory (for distributions without a CA bundle) ui activeContent boolean True Allow Binary Ninja to connect to the web to check for updates ui colorblind boolean True Choose colors that are visible to those with red/green colorblind ui debug boolean False Enable developer debugging features (Additional views: Lifted IL, and SSA forms) ui recent-file-limit integer 10 Specify limit for number of recent files pdb local-store-absolute string \"\" Absolute path specifying where the pdb symbol store exists on this machine, overrides relative path pdb local-store-relative string \"symbols\" Path relative to the binaryninja user directory, sepcifying the pdb symbol store pdb auto-download-pdb boolean True Automatically download pdb files from specified symbol servers pdb symbol-server-list list(string) [\"http://msdl.microsoft.com/download/symbols\"] List of servers to query for pdb symbols. python interpreter string \"python27.{dylib,dll,so.1}\" Python interpreter to load if one is not already present when plugins are loaded Below is an example settings.json setting various options: {\n ui :\n {\n activeContent : false,\n colorblind : false,\n debug : true\n recent-file-limit : 10\n }\n pdb :\n {\n local-store-absolute : C:\\Symbols ,\n local-store-relative : ,\n symbol-server-list : [ http://mysymbolserver.company.lan ]\n }\n}",
|
||
|
"title": "Settings"
|
||
|
},
|
||
|
{
|
||
|
"location": "/getting-started/index.html#getting-support",
|
||
|
"text": "Vector 35 offers a number of ways to get Binary Ninja support .",
|
||
|
"title": "Getting Support"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html",
|
||
|
"text": "Plugins\n\n\nPlugins really show off the power of Binary Ninja. This guide should help give you an overview of both using and writing plugins.\n\n\nThe most common Binary Ninja plugins are Python which we are covering here. That said, there are some C++ plugins which must be built for the appropriate native architecture and will usually include build instructions for each platform. Several \nC++ examples\n are included in the API repository. \n\n\nUsing Plugins\n\n\nPlugins are loaded from the user's plugin folder: \n\n\n\n\nOS X: \n~/Library/Application Support/Binary Ninja/plugins/\n\n\nLinux: \n~/.binaryninja/plugins/\n\n\nWindows: \n%APPDATA%\\Binary Ninja\\plugins\n\n\n\n\nNote that plugins installed via the \nPluginManager API\n are installed in the \nrepositories\n folder in the same path as the previous \nplugin\n folder listed above. You should not need to manually touch anything in that folder, but should access them via the API instead. \n\n\nManual installation\n\n\nYou can manually install a plugin either by adding a folder which contains it (the plugin folder must contain an \n__init__.py\n at the top of the folder, or a python file can be included directly in the plugin folder though this is not recommended).\n\n\nNote, if manually cloning the \napi repository\n, make sure to:\n\n\ngit submodule update --init --recursive\n\n\n\n\n\nafter cloning or else the submodules will not actually be downloaded. \n\n\nInstalling via the API\n\n\nBinary Ninja now offers a \nPluginManager API\n which can simplify the process of finding and installing plugins. From the console:\n\n\n mgr = RepositoryManager()\n\n dir(mgr)\n[\n__class__\n, \n__delattr__\n, \n__dict__\n, \n__doc__\n, \n__format__\n, \n__getattribute__\n, \n__hash__\n, \n__init__\n, \n__module__\n, \n__new__\n, \n__reduce__\n, \n__reduce_ex__\n, \n__repr__\n, \n__setattr__\n, \n__sizeof__\n, \n__str__\n, \n__subclasshook__\n, \n__weakref__\n, \nadd_repository\n, \ncheck_for_updates\n, \ndefault_repository\n, \ndisable_plugin\n, \nenable_plugin\n, \nhandle\n, \ninstall_plugin\n, \nplugins\n, \nrepositories\n, \nuninstall_plugin\n, \nupdate_plugin\n]\n\n mgr.plugins\n{\ndefault\n: [\nbinaryninja-bookmarks not-installed/disabled\n, \nbinaryninja-msp430 not-installed/disabled\n, \nbinaryninja-radare2 not-installed/disabled\n, \nbinaryninja-spu not-installed/disabled\n, \nbinja-avr not-installed/disabled\n, \nbinja_smali not-installed/disabled\n, \nbinjatron not-installed/disabled\n, \nbinoculars not-installed/disabled\n, \neasypatch not-installed/disabled\n, \nliil installed/enabled\n, \nlist_comments not-installed/disabled\n, \nx64dbgbinja not-installed/disabled\n]}\n\n mgr.install_plugin(\neasypatch\n)\nTrue\n\n mgr.enable_plugin(\neasypatch\n)\nTrue\n\n\n\n\n\nThen just restart, and your plugin will be loaded. \n\n\nInstalling Prerequisites\n\n\nBecause Windows ships with an embedded version of Python, if you want to install plugins inside that Python, you'll need to either adjust your \nsys.path\n to include the locations for the other libraries (making sure they're compatible with the built-in version), or else install them directly in the environment via:\n\n\nimport\n \npip\n\n\npip\n.\nmain\n([\ninstall\n,\n \n--quiet\n,\n \npackagename\n])\n\n\n\n\n\n\n--quiet is required to minimize some of the normal output of pip that doesn't work within the context of our scripting console\n\n\nFor both OS X and Linux, Binary Ninja can utilize the built in system Python so any installed packages should be available there via whatever typical mechanism you use.\n\n\nTroubleshooting\n\n\nTroubleshooting many Binary Ninja problems is helped by enabling debug logs and logging the output to a file. Just launch Binary Ninja with \n\n\n/Applications/Binary\\ Ninja.app/Contents/MacOS/binaryninja -d -l /tmp/bnlog.txt\n\n\n\n\n\nAnd check \n/tmp/bnlog.txt\n when you're done. \n\n\nWriting Plugins\n\n\nFirst, take a look at some of the \nexample\n plugins, or some of the \ncommunity\n plugins to get a feel for different APIs you might be interested in.
|
||
|
"title": "Using and Writing Plugins"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#plugins",
|
||
|
"text": "Plugins really show off the power of Binary Ninja. This guide should help give you an overview of both using and writing plugins. The most common Binary Ninja plugins are Python which we are covering here. That said, there are some C++ plugins which must be built for the appropriate native architecture and will usually include build instructions for each platform. Several C++ examples are included in the API repository.",
|
||
|
"title": "Plugins"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#using-plugins",
|
||
|
"text": "Plugins are loaded from the user's plugin folder: OS X: ~/Library/Application Support/Binary Ninja/plugins/ Linux: ~/.binaryninja/plugins/ Windows: %APPDATA%\\Binary Ninja\\plugins Note that plugins installed via the PluginManager API are installed in the repositories folder in the same path as the previous plugin folder listed above. You should not need to manually touch anything in that folder, but should access them via the API instead.",
|
||
|
"title": "Using Plugins"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#manual-installation",
|
||
|
"text": "You can manually install a plugin either by adding a folder which contains it (the plugin folder must contain an __init__.py at the top of the folder, or a python file can be included directly in the plugin folder though this is not recommended). Note, if manually cloning the api repository , make sure to: git submodule update --init --recursive after cloning or else the submodules will not actually be downloaded.",
|
||
|
"title": "Manual installation"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#installing-via-the-api",
|
||
|
"text": "Binary Ninja now offers a PluginManager API which can simplify the process of finding and installing plugins. From the console: mgr = RepositoryManager() dir(mgr)\n[ __class__ , __delattr__ , __dict__ , __doc__ , __format__ , __getattribute__ , __hash__ , __init__ , __module__ , __new__ , __reduce__ , __reduce_ex__ , __repr__ , __setattr__ , __sizeof__ , __str__ , __subclasshook__ , __weakref__ , add_repository , check_for_updates , default_repository , disable_plugin , enable_plugin , handle , install_plugin , plugins , repositories , uninstall_plugin , update_plugin ] mgr.plugins\n{ default : [ binaryninja-bookmarks not-installed/disabled , binaryninja-msp430 not-installed/disabled , binaryninja-radare2 not-installed/disabled , binaryninja-spu not-installed/disabled , binja-avr not-installed/disabled , binja_smali not-installed/disabled , binjatron not-installed/disabled , binoculars not-installed/disabled , easypatch not-installed/disabled , liil installed/enabled , list_comments not-installed/disabled , x64dbgbinja not-installed/disabled ]} mgr.install_plugin( easypatch )\nTrue mgr.enable_plugin( easypatch )\nTrue Then just restart, and your plugin will be loaded.",
|
||
|
"title": "Installing via the API"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#installing-prerequisites",
|
||
|
"text": "Because Windows ships with an embedded version of Python, if you want to install plugins inside that Python, you'll need to either adjust your sys.path to include the locations for the other libraries (making sure they're compatible with the built-in version), or else install them directly in the environment via: import pip pip . main ([ install , --quiet , packagename ]) --quiet is required to minimize some of the normal output of pip that doesn't work within the context of our scripting console For both OS X and Linux, Binary Ninja can utilize the built in system Python so any installed packages should be available there via whatever typical mechanism you use.",
|
||
|
"title": "Installing Prerequisites"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#troubleshooting",
|
||
|
"text": "Troubleshooting many Binary Ninja problems is helped by enabling debug logs and logging the output to a file. Just launch Binary Ninja with /Applications/Binary\\ Ninja.app/Contents/MacOS/binaryninja -d -l /tmp/bnlog.txt And check /tmp/bnlog.txt when you're done.",
|
||
|
"title": "Troubleshooting"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#writing-plugins",
|
||
|
"text": "First, take a look at some of the example plugins, or some of the community plugins to get a feel for different APIs you might be interested in. Of course, the full API docs are online and available offline via the Help / Open API Reference... . To start, we suggest you download the sample plugin as a template since it contains all of the elements you're likely to need. Begin by editing the plugin.json file Next, update the LICENSE For small scripts, you can include all the code inside of __init__.py , though we recommend for most larger scripts that init just act as an initializer and call into functions organized appropriately in other files.",
|
||
|
"title": "Writing Plugins"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#ui-elements",
|
||
|
"text": "While it is possible to use Qt to directly create UI enhancements to Binary Ninja, we don't recommend it. First, there's a chance that we'll change UI platforms in the future (in particular because Qt's QWidget performance is actually getting worse with newer versions and they're trying to move everyone to QTQuick which might as well be Electron). Secondly, it is much more difficult for other users to install your plugin given the much more complicated dependencies and cross-platform headache of setup. The officially supported mechanism (until the 1.2 release which will include much more featureful UI API enhancements) are available from the interaction API and shown off in the angr and nampa plugins.",
|
||
|
"title": "UI Elements"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/plugins/index.html#testing",
|
||
|
"text": "It's useful to be able to reload your plugin during testing. On the Commercial edition of Binary Ninja, this is easily accomplished with a stand-alone headless install using import binaryninja after installing the API . (install_api.py is included in every install in the installation folder) For the Personal edition, we recommend simply commenting out the register_ function normally used to register the plugin via whatever mechanism it uses and instead simply using the built-in Python console along with the python reload function to load new changes and test them by directly calling functions in the module. This work-around unfortunately is not supported for Binary View or Architecture plugins which unfortunately do require a restart to test if not running on Commercial.",
|
||
|
"title": "Testing"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html",
|
||
|
"text": "Troubleshooting\n\n\nBasics\n\n\n\n\nHave you searched \nknown issues\n?\n\n\nHave you tried rebooting? (Kidding!)\n\n\nDid you read all the items on this page?\n\n\nThen you should contact \nsupport\n!\n\n\n\n\nBug Reproduction\n\n\nRunning Binary Ninja with debug logging will make your bug report more useful.\n\n\n./binaryninja --debug --stderr-log\n\n\n\n\n\nAlternatively, it might be easier to save debug logs to a file instead:\n\n\n./binaryninja -d -l logfile.txt\n\n\n\n\n\n(note that both long and short-form of the command-line arguments are demonstrated in the above examples)\n\n\nPlugin Troubleshooting\n\n\nWhile third party plugins are not officially supported, there are a number of troubleshooting tips that can help identify the cause. The most important is to enable debug logging as suggested in the previous section. This will often highlight problems with python paths or any other issues that prevent plugins from running.\n\n\nAdditionally, if you're having trouble running a plugin in headless mode (without a GUI calling directly into the core), make sure you'er running the Commercial version of Binary Ninja as the Student/Non-Commercial edition does not support headless processing.\n\n\nNext, if running a python plugin, make sure the python requirements are met by your existing installation. Note that on windows, the bundled python is used and python requirements should be installed either by manually copying the modules to the \nplugins\n \nfolder\n.\n\n\nLicense Problems\n\n\n\n\nIf experiencing problems with Windows UAC permissions during an update, the easiest fix is to completely un-install and \nrecover\n the latest installer and license. Preferences are saved outside the installation folder and are preserved, though you might want to remove your \nlicense\n.\n\n\nIf you need to change the email address on your license, contact \nsupport\n.\n\n\n\n\nOS X\n\n\nWhile OS X is generally the most trouble-free environment for Binary Ninja, very old versions may have problems with the RPATH for our binaries and libraries. There are two solutions. First, run Binary Ninja with: \n\n\nDYLD_LIBRARY_PATH=\n/Applications/Binary Ninja.app/Contents/MacOS\n /Applications/Binary\\ Ninja.app/Contents/MacOS/binaryninja\n\n\n\n\n\nOr second, modify the binary itself using the \ninstall_name_tool\n.\n\n\nLinux\n\n\nGiven the diversity of Linux distributions, some work-arounds are required to run Binary Ninja on platforms that are not \nofficially supported\n.\n\n\nHeadless Ubuntu\n\n\nIf you're having trouble getting Binary Ninja installed in a headless server install where you want to be able to X-Forward the GUI on a remote machine, the following should meet requiremetns (for at least 14.04 LTS):\n\n\napt-get install libgl1-mesa-glx libfontconfig1 libxrender1 libegl1-mesa libxi6 libnspr4 libsm6\n\n\n\n\n\nArch Linux\n\n\n\n\nInstall python2 from the \nofficial repositories\n (\nsudo pacman -S python2\n) and create a sym link: \nsudo ln -s /usr/lib/libpython2.7.so.1.0 /usr/lib/libpython2.7.so.1\n\n\nInstall the \nlibcurl-compat\n library with \nsudo pacman -S libcurl-compat\n, and run Binary Ninja via \nLD_PRELOAD=libcurl.so.3 ~/binaryninja/binaryninja\n\n\n\n\nKDE\n\n\nTo run Binary Ninja in a KDE based environment, set the \nQT_PLUGIN_PATH\n to the \nQT\n sub-folder:\n\n\ncd ~/binaryninja\nQT_PLUGIN_PATH=./qt ./binaryninja\n\n\n\n\n\nDebian\n\n\nFor Debian variants that (Kali, eg) don't match packages with Ubuntu LTS or the latest stable, the following might fix problems with libssl and libcrypto:\n\n\n$ \ncd\n binaryninja\n$ ln -s plugins/libssl.so libssl.so.1.0.0\n$ ln -s plugins/libcrypto.so libcrypto.so.1.0.0\n\n\n\n\n\nAlternatively, you might need to (as root):\n\n\napt-get install libssl-dev\nln -s /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0\nln -s /usr/lib/x86_64-linux-gnu/libssl.so.1.0.2 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0\n\n\n\n\n\nGentoo\n\n\nOne Gentoo user \nreported\n a failed SSL certificate when trying to update. The solution was
|
||
|
"title": "Troubleshooting"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#troubleshooting",
|
||
|
"text": "",
|
||
|
"title": "Troubleshooting"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#basics",
|
||
|
"text": "Have you searched known issues ? Have you tried rebooting? (Kidding!) Did you read all the items on this page? Then you should contact support !",
|
||
|
"title": "Basics"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#bug-reproduction",
|
||
|
"text": "Running Binary Ninja with debug logging will make your bug report more useful. ./binaryninja --debug --stderr-log Alternatively, it might be easier to save debug logs to a file instead: ./binaryninja -d -l logfile.txt (note that both long and short-form of the command-line arguments are demonstrated in the above examples)",
|
||
|
"title": "Bug Reproduction"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#plugin-troubleshooting",
|
||
|
"text": "While third party plugins are not officially supported, there are a number of troubleshooting tips that can help identify the cause. The most important is to enable debug logging as suggested in the previous section. This will often highlight problems with python paths or any other issues that prevent plugins from running. Additionally, if you're having trouble running a plugin in headless mode (without a GUI calling directly into the core), make sure you'er running the Commercial version of Binary Ninja as the Student/Non-Commercial edition does not support headless processing. Next, if running a python plugin, make sure the python requirements are met by your existing installation. Note that on windows, the bundled python is used and python requirements should be installed either by manually copying the modules to the plugins folder .",
|
||
|
"title": "Plugin Troubleshooting"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#license-problems",
|
||
|
"text": "If experiencing problems with Windows UAC permissions during an update, the easiest fix is to completely un-install and recover the latest installer and license. Preferences are saved outside the installation folder and are preserved, though you might want to remove your license . If you need to change the email address on your license, contact support .",
|
||
|
"title": "License Problems"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#os-x",
|
||
|
"text": "While OS X is generally the most trouble-free environment for Binary Ninja, very old versions may have problems with the RPATH for our binaries and libraries. There are two solutions. First, run Binary Ninja with: DYLD_LIBRARY_PATH= /Applications/Binary Ninja.app/Contents/MacOS /Applications/Binary\\ Ninja.app/Contents/MacOS/binaryninja Or second, modify the binary itself using the install_name_tool .",
|
||
|
"title": "OS X"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#linux",
|
||
|
"text": "Given the diversity of Linux distributions, some work-arounds are required to run Binary Ninja on platforms that are not officially supported .",
|
||
|
"title": "Linux"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#headless-ubuntu",
|
||
|
"text": "If you're having trouble getting Binary Ninja installed in a headless server install where you want to be able to X-Forward the GUI on a remote machine, the following should meet requiremetns (for at least 14.04 LTS): apt-get install libgl1-mesa-glx libfontconfig1 libxrender1 libegl1-mesa libxi6 libnspr4 libsm6",
|
||
|
"title": "Headless Ubuntu"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#arch-linux",
|
||
|
"text": "Install python2 from the official repositories ( sudo pacman -S python2 ) and create a sym link: sudo ln -s /usr/lib/libpython2.7.so.1.0 /usr/lib/libpython2.7.so.1 Install the libcurl-compat library with sudo pacman -S libcurl-compat , and run Binary Ninja via LD_PRELOAD=libcurl.so.3 ~/binaryninja/binaryninja",
|
||
|
"title": "Arch Linux"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#kde",
|
||
|
"text": "To run Binary Ninja in a KDE based environment, set the QT_PLUGIN_PATH to the QT sub-folder: cd ~/binaryninja\nQT_PLUGIN_PATH=./qt ./binaryninja",
|
||
|
"title": "KDE"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#debian",
|
||
|
"text": "For Debian variants that (Kali, eg) don't match packages with Ubuntu LTS or the latest stable, the following might fix problems with libssl and libcrypto: $ cd binaryninja\n$ ln -s plugins/libssl.so libssl.so.1.0.0\n$ ln -s plugins/libcrypto.so libcrypto.so.1.0.0 Alternatively, you might need to (as root): apt-get install libssl-dev\nln -s /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0\nln -s /usr/lib/x86_64-linux-gnu/libssl.so.1.0.2 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0",
|
||
|
"title": "Debian"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#gentoo",
|
||
|
"text": "One Gentoo user reported a failed SSL certificate when trying to update. The solution was to copy over /etc/ssl/certs/ca-certificates.crt from another Linux distribution.",
|
||
|
"title": "Gentoo"
|
||
|
},
|
||
|
{
|
||
|
"location": "/guide/troubleshooting/index.html#api",
|
||
|
"text": "If the GUI launches but the license file is not valid when launched from the command-line, check that you're using the right version of Python. Only a 64-bit Python 2.7 is supported at this time. Additionally, the personal edition does not support headless operation.",
|
||
|
"title": "API"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/documentation/index.html",
|
||
|
"text": "Building Documentation\n\n\nCLA\n\n\nTo contribute to the Binary Ninja documentation, first sign the \ncontribution license agreement\n and send it to \nVector 35\n.\n\n\nPrerequisites\n\n\n\n\nsphinx\n\n\nbreathe\n (note that on windows, breathe needs a small \nfix\n)\n\n\nmkdocs\n\n\ndoxygen\n\n\n\n\nBuilding\n\n\ngit clone https://github.com/Vector35/binaryninja-api/\ncd binaryninja-api\ncd api\nmkdocs build\necho User documentation available in site/\ncd api-docs\nmake html\necho API documentation available in build/html\n\n\n\n\n\nChanging\n\n\nChanging documentation for the API itself is fairly straight forward. Use \ndoxygen style comment blocks\n in C++ and C, and \nrestructured text blocks\n for python for the source. The user documentation is located in the \napi/docs/\n folder and the API documentation is generated from the config in the \napi/api-docs\n folder.\n\n\n\n\nTip\n\n\nWhen updating user documentation, the \nmkdoc serve\n feature is particularly helpful.",
|
||
|
"title": "Contributing Documentation"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/documentation/index.html#building-documentation",
|
||
|
"text": "",
|
||
|
"title": "Building Documentation"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/documentation/index.html#cla",
|
||
|
"text": "To contribute to the Binary Ninja documentation, first sign the contribution license agreement and send it to Vector 35 .",
|
||
|
"title": "CLA"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/documentation/index.html#prerequisites",
|
||
|
"text": "sphinx breathe (note that on windows, breathe needs a small fix ) mkdocs doxygen",
|
||
|
"title": "Prerequisites"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/documentation/index.html#building",
|
||
|
"text": "git clone https://github.com/Vector35/binaryninja-api/\ncd binaryninja-api\ncd api\nmkdocs build\necho User documentation available in site/\ncd api-docs\nmake html\necho API documentation available in build/html",
|
||
|
"title": "Building"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/documentation/index.html#changing",
|
||
|
"text": "Changing documentation for the API itself is fairly straight forward. Use doxygen style comment blocks in C++ and C, and restructured text blocks for python for the source. The user documentation is located in the api/docs/ folder and the API documentation is generated from the config in the api/api-docs folder. Tip When updating user documentation, the mkdoc serve feature is particularly helpful.",
|
||
|
"title": "Changing"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html",
|
||
|
"text": "Binary Ninja Intermediate Language Series, Part 1: Low Level IL\n\n\nThe Binary Ninja Intermediate Language (BNIL) is a semantic representation of the assembly language instructions for a native architecture in Binary Ninja. BNIL is actually a family of intermediate languages that work together to provide functionality at different abstraction layers. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family. \n\n\n\n\nThe Lifted IL is very similar to the LLIL and is primarily of interest for Architecture plugin authors. If you're writing an analysis plugin, you'll always want to be working at LLIL or higher. During each stage of the lifting process a number of transformations take place, and each layer of IL can have different instructions. Because of this, you can not rely on an instruction from one layer existing in another.\n\n\nIntroduction by example\n\n\nSince doing is the easiest way to learn lets start with a simple example binary and step through analyzing it using the python console. \n\n\n\n\n\n\nDownload \nchal1\n and open it with Binary Ninja\n\n\nNext, bring up the \nLow Level IL\n view by clicking in the options pane at the bottom of the screen\n (or alternatively, use the \ni\n key)\n\n\nNavigate to main (\ng\n, then \"main\", or double-click it in the function list)\n\n\nFinally, bring up the python console using: \n~\n\n\n\n\nNext, enter the following in the console:\n\n\n for block in current_function.low_level_il:\n... for instr in block:\n... print instr.address, instr.instr_index, instr\n... \n4196422 0 push(rbp)\n4196423 1 rbp = rsp {var_8}\n4196426 2 rsp = rsp - 0x110\n4196433 3 rax = rbp - 0xc0 {var_c8}\n...\n\n\n\n\n\nThis will print out all the LLIL instructions in the current function. How does this code work? \n\n\nFirst we use the global magic variable \ncurrent_function\n which gives us the python object \nfunction.Function\n for whatever function is currently selected in the UI. The variable is only usable from the python console, and shouldn't be used for headless plugins. In a script you can either use the function that was passed in if you \nregistered your plugin\n to handle functions, or you can compute the function based on \na specific address\n, or maybe even just iterate over all the functions in a BinaryView (\nfor func in bv.functions:\n).\n\n\nNext we get the \nlowlevelil.LowLevelILFunction\n from the \nFunction\n class: \ncurrent_function.low_level_il\n. Iterating over the \nLowLevelILFunction\n class provides access to the \nlowlevelil.LowLevelILBasicBlock\n classes for this function. Inside the loop we can now iterate over the \nLowLevelILBasicBlock\n class which provides access to the individual \nlowlevelil.LowLevelILInstruction\n classes.\n\n\nFinally, we can print out the attributes of the instruction. We first print out \naddress\n which is the address of the corresponding assembly language instruction. Next, we print the \ninstr_index\n, this you can think of as the address of the IL instruction. Since translating assembly language is a many-to-many relationship we may see multiple IL instructions needed to represent a single assembly language instruction, and thus each IL instruction needs to have its own index separate from its address. Finally, we print out the instruction text.\n\n\nIn python, iterating over a class is a distinct operation from subscripting. This separation is used in the \nLowLevelILFunction\n class. If you iterate over a \nLowLevelILFunction\n you get a list of \nLowLevelILBasicBlocks\n, however if you subscript a \nLowLevelILFunction\n you actually get the \nLowLevelILInstruction\n whose \ninstr_index\n corresponds to the subscript:\n\n\n \nlist\n(\ncurrent_function\n.\nlow_level_il\n)\n\n\n[\nblock\n:\n \nx86_64\n@0x0\n-\n0x3f\n,\n \nblock\n:\n \nx86_64\n@0x3f\n-\n0x45\n,\n \nblock\n:\n \nx86_64\n@0x45\n-\n0x47\n,\n\n \nblock\n:\n \nx86_64\n@0x47\n-\n0x53\n,\n \nblock\n:\n \nx86_64\n@0x53\n-\n0x57\n,\n \nblock\n:\n \nx86_64\n@0x57\n-\
|
||
|
"title": "BNIL Guide: LLIL"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#binary-ninja-intermediate-language-series-part-1-low-level-il",
|
||
|
"text": "The Binary Ninja Intermediate Language (BNIL) is a semantic representation of the assembly language instructions for a native architecture in Binary Ninja. BNIL is actually a family of intermediate languages that work together to provide functionality at different abstraction layers. This developer guide is intended to cover some of the mechanics of the LLIL to distinguish it from the other ILs in the BNIL family. The Lifted IL is very similar to the LLIL and is primarily of interest for Architecture plugin authors. If you're writing an analysis plugin, you'll always want to be working at LLIL or higher. During each stage of the lifting process a number of transformations take place, and each layer of IL can have different instructions. Because of this, you can not rely on an instruction from one layer existing in another.",
|
||
|
"title": "Binary Ninja Intermediate Language Series, Part 1: Low Level IL"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#introduction-by-example",
|
||
|
"text": "Since doing is the easiest way to learn lets start with a simple example binary and step through analyzing it using the python console. Download chal1 and open it with Binary Ninja Next, bring up the Low Level IL view by clicking in the options pane at the bottom of the screen\n (or alternatively, use the i key) Navigate to main ( g , then \"main\", or double-click it in the function list) Finally, bring up the python console using: ~ Next, enter the following in the console: for block in current_function.low_level_il:\n... for instr in block:\n... print instr.address, instr.instr_index, instr\n... \n4196422 0 push(rbp)\n4196423 1 rbp = rsp {var_8}\n4196426 2 rsp = rsp - 0x110\n4196433 3 rax = rbp - 0xc0 {var_c8}\n... This will print out all the LLIL instructions in the current function. How does this code work? First we use the global magic variable current_function which gives us the python object function.Function for whatever function is currently selected in the UI. The variable is only usable from the python console, and shouldn't be used for headless plugins. In a script you can either use the function that was passed in if you registered your plugin to handle functions, or you can compute the function based on a specific address , or maybe even just iterate over all the functions in a BinaryView ( for func in bv.functions: ). Next we get the lowlevelil.LowLevelILFunction from the Function class: current_function.low_level_il . Iterating over the LowLevelILFunction class provides access to the lowlevelil.LowLevelILBasicBlock classes for this function. Inside the loop we can now iterate over the LowLevelILBasicBlock class which provides access to the individual lowlevelil.LowLevelILInstruction classes. Finally, we can print out the attributes of the instruction. We first print out address which is the address of the corresponding assembly language instruction. Next, we print the instr_index , this you can think of as the address of the IL instruction. Since translating assembly language is a many-to-many relationship we may see multiple IL instructions needed to represent a single assembly language instruction, and thus each IL instruction needs to have its own index separate from its address. Finally, we print out the instruction text. In python, iterating over a class is a distinct operation from subscripting. This separation is used in the LowLevelILFunction class. If you iterate over a LowLevelILFunction you get a list of LowLevelILBasicBlocks , however if you subscript a LowLevelILFunction you actually get the LowLevelILInstruction whose instr_index corresponds to the subscript: list ( current_function . low_level_il ) [ block : x86_64 @0x0 - 0x3f , block : x86_64 @0x3f - 0x45 , block : x86_64 @0x45 - 0x47 , \n block : x86_64 @0x47 - 0x53 , block : x86_64 @0x53 - 0x57 , block : x86_64 @0x57 - 0x5a ] type ( current_function . low_level_il [ 0 ]) class binaryninja . lowlevelil . LowLevelILInstruction current_function . low_level_il [ 0 ] il : push ( rbp )",
|
||
|
"title": "Introduction by example"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#low-level-il-instructions",
|
||
|
"text": "Now that we've established how to access LLIL Functions, Blocks, and Instructions, lets focus in on the instructions themselves. LLIL instructions are infinite length and structured as an expression tree. An expression tree means that instruction operands can be composed of operation. Thus we can have an IL instruction like this: eax = eax + ecx * 4 The tree for such an instruction would look like: =\n / \\\neax +\n / \\\n eax *\n / \\\n ecx 4 There are quite a few reasons that we chose to use expression trees that we won't go into in detail here, but suffice it to say lifting to this form and reading this form are both much easier than other forms. Now lets get back to the examples. First let's pick an instruction to work with: instr = current_function.low_level_il[2] instr il: rsp = rsp - 0x110 For the above instruction, we have a few operations we can perform: address - returns the virtual address hex(instr.address) 0x40084aL dest - returns the destination operand instr.dest rsp function - returns the containing function instr.function binaryninja.lowlevelil.LowLevelILFunction object at 0x111c79810 instr_index - returns the LLIL index instr.instr_index\n2 operands - returns a list of all operands. instr.operands\n[ rsp , il: rsp - 0x110 ] operation - returns the enumeration value of the current operation instr.operation LowLevelILOperation.LLIL_SET_REG: 1 src - returns the source operand instr.src il: rsp - 0x110 dest - returns the destination operand instr.dest rsp size - returns the size of the operation in bytes (in this case we have an 8 byte assigment) instr.size\n8L Now with some knowledge of the LowLevelIL class lets try to do something with it. Lets say our goal is to find all the times the register rdx is written to in the current function. This code is straight forward: for block in current_function.low_level_il:\n... for instr in block:\n... if instr.operation == LowLevelILOperation.LLIL_SET_REG and instr.dest == rdx :\n... print instr.address, instr.instr_index, instr\n... \n4196490 14 rdx = [rax].q\n4196500 16 rdx = [rax + 8].q\n4196511 18 rdx = [rax + 0x10].q\n4196522 20 rdx = [rax + 0x18].q\n4196533 22 rdx = [rax + 0x20].q\n4196544 24 rdx = [rax + 0x28].q\n4196798 77 rdx = [0x602090].q",
|
||
|
"title": "Low Level IL Instructions"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#the-instructions",
|
||
|
"text": "Going into gross detail on all the instructions is out of scope of the this article, but we'll go over the different instructions types and speak generally about how they are used.",
|
||
|
"title": "The Instructions"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#registers-constants-flags",
|
||
|
"text": "When parsing an instruction tree the terminals are registers, constants and flags. This provide the basis from which all instructions are built. LLIL_REG - A register, terminal LLIL_CONST - A constant integer value, terminal LLIL_SET_REG - Sets a register to the results of the of the IL operation in src attribute. LLIL_SET_REG_SPLIT - Uses a pair of registers as one double sized register, setting both registers at once. LLIL_SET_FLAG - Sets the specified flag to the IL operation in src attribute.",
|
||
|
"title": "Registers, Constants & Flags"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#memory-load-store",
|
||
|
"text": "Reading and writing memory is accomplished through the following instructions. LLIL_LOAD - Load a value from memory. LLIL_STORE - Store a value to memory. LLIL_PUSH - Store value to stack adjusting stack pointer by sizeof(value) after the store. LLIL_POP - Load value from stack adjusting stack pointer by sizeof(value) after the store.",
|
||
|
"title": "Memory Load & Store"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#control-flow-conditionals",
|
||
|
"text": "Control flow transfering instructions and comparison instructions are straight forward enough, but one instruction that deserves more attention is the if instruction. To understand the if instruction we need to first understand the concept of labels. Labels function much like they do in C code. They can be put anywhere in the emitted IL and serve as a destination for the if and goto instructions. Labels are required because one assembly language instruction can translate to multiple IL instructions, and you need to be able to branch to any of the emitted IL instructions. Lets consider the following x86 instruction cmove (Conditional move if equal flag is set): test eax, eax\ncmove eax, ebx To translate this instruction to IL we have to first create true and false labels. Then we emit the if instruction, passing it the proper conditional and labels. Next we emit the true label, then we emit the set register instruction and a goto false label instruction. This results in the following output: 0 @ 00000002 if (eax == 0) then 1 else 3\n1 @ 00000002 eax = ebx\n2 @ 00000002 goto 3 As you can see from the above code labels are really just used internaly and aren't explicitly marked. In addition to if and goto , the jump_to IL instruction is the only other instruction that operates on labels. The rest of the IL control flow instructions operate on addresses rather than labels, much like actual assembly language instructions. Note that an architecture plugin author should not be emitting jump_to IL instructions as those are generated by the analysis automatically. LLIL_JUMP - Branch execution to the result of the IL operation. LLIL_JUMP_TO - Jump table construct, contains an expression and list of possible targets. LLIL_CALL - Branch execution to the result of the IL operation. LLIL_RET - Return execution to the caller. LLIL_NORET - Instruction emitted automatically after syscall or call instruction which cause the program to terminate. LLIL_IF - If provides conditional execution. If cond is true execution branches to the true label and false label otherwise. LLIL_GOTO - Goto is used to branch to an IL label, this is different than jump since jump can only jump to addresses. LLIL_FLAG_COND - Returns the flag condition expression for the specified flag condition. LLIL_CMP_E - equality LLIL_CMP_NE - not equal LLIL_CMP_SLT - signed less than LLIL_CMP_ULT - unsigned less than LLIL_CMP_SLE - signed less than or equal LLIL_CMP_ULE - unsigned less than or equal LLIL_CMP_SGE - signed greater than or equal LLIL_CMP_UGE - unsigned greater than or equal LLIL_CMP_SGT - signed greater than LLIL_CMP_UGT - unsigned greater than",
|
||
|
"title": "Control Flow & Conditionals"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#the-arithmetic-logical-instructions",
|
||
|
"text": "LLIL implements the most common arithmetic as well as a host of more complicated instruction which make translating from assembly much easier. Most arithmetic and logical instruction contain left and right attributes which can themselves be other IL instructions. The double precision instruction multiply, divide, modulus instructions are particularly helpful for instruction sets like x86 whose output/input can be double the size of the input/output. LLIL_ADD - Add LLIL_ADC - Add with carry LLIL_SUB - Subtract LLIL_SBB - Subtract with borrow LLIL_AND - Bitwise and LLIL_OR - Bitwise or LLIL_XOR - Exclusive or LLIL_LSL - Logical shift left LLIL_LSR - Logical shift right LLIL_ASR - Arithmetic shift right LLIL_ROL - Rotate left LLIL_RLC - Rotate left with carry LLIL_ROR - Rotate right LLIL_RRC - Rotate right with carry LLIL_MUL - Multiply single precision LLIL_MULU_DP - Unsigned multiply double precision LLIL_MULS_DP - Signed multiply double precision LLIL_DIVU - Unsigned divide single precision LLIL_DIVU_DP - Unsigned divide double precision LLIL_DIVS - Signed divide single precision LLIL_DIVS_DP - Signed divide double precision LLIL_MODU - Unsigned modulus single precision LLIL_MODU_DP - Unsigned modulus double precision LLIL_MODS - Signed modulus single precision LLIL_MODS_DP - Signed modulus double precision LLIL_NEG - Sign negation LLIL_NOT - Bitwise complement",
|
||
|
"title": "The Arithmetic & Logical Instructions"
|
||
|
},
|
||
|
{
|
||
|
"location": "/dev/bnil-llil/index.html#special-instructions",
|
||
|
"text": "The rest of the instructions are pretty much self explanitory to anyone with familiarity with assembly languages. LLIL_NOP - No operation LLIL_SX - Sign extend LLIL_ZX - Zero extend LLIL_SYSCALL - System call instruction LLIL_BP - Breakpoint instruction LLIL_TRAP - Trap instruction LLIL_UNDEF - Undefined instruction LLIL_UNIMPL - Unimplemented instruction LLIL_UNIMPL_MEM - Unimplemented memory access instruction",
|
||
|
"title": "Special instructions"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html",
|
||
|
"text": "License\n\n\nBinary Ninja comes in different versions. Depending on the terms under which you purchased it, a different license below may apply.\n\n\nNon-commercial / Student License (NAMED)\n\n\nBINARY NINJA SOFTWARE LICENSE AGREEMENT\n\n\n(Non-commercial License)\n\n\nIMPORTANT! BE SURE TO CAREFULLY READ AND UNDERSTAND ALL OF THE TERMS SET FORTH IN THIS LICENSE AGREEMENT (\u201dLICENSE\u201d). BY CLICKING THE \"I ACCEPT\" BUTTON OR OTHERWISE ACCEPTING THIS LICENSE THROUGH AN ORDERING DOCUMENT THAT INCORPORATES THIS LICENSE, YOU AGREE TO FOLLOW AND BE BOUND BY THE TERMS AND CONDITIONS OF THIS LICENSE. IF YOU DO NOT AGREE TO ALL THE TERMS AND CONDITIONS IN THIS LICENSE, YOU MUST SELECT THE \"I DECLINE\" BUTTON AND MAY NOT USE THE SOFTWARE.\n\n\nThis License is entered into by and between you (\u201cyou\u201d or \u201cyour\u201d) and Vector 35 LLC, a Florida limited liability company (\u201cus,\u201d \u201cwe\u201d or \u201cour\u201d).\n\n\nWe will license Binary Ninja\u2122, a software application (the \u201cSoftware\u201d), to you under the mutual terms and conditions in this License. By installing the Software, you agree to be bound by the terms of this License. If you do not agree to the terms of this License, please do not install or attempt to use the Software.\n\n\n\n\n\n\nNon-Exclusive License Grant for Non-commercial Use. Under the terms of this License, the Software is licensed on a non-exclusive basis and is not sold. This License is for non- commercial purposes only. This means that you may not exercise any of the rights granted to you under this License in any manner that is intended for or directed toward commercial advantage or private monetary gain such as (a) activities undertaken for profit, or (b) activities intended to produce works, services, or data for commercial use, or (c) activities conducted, or funded, by a person or an entity engaged in the commercial use, application or exploitation of works similar to the Software. If you have any question regarding a particular use, please feel free to contact us regarding your particular circumstances. Please note, the Software under this non-commercial license is a different version than the standard version of Binary Ninja\u2122. There is a fee to upgrade to the standard version of Binary Ninja\u2122. This License grants you the rights a single user license that allows a copy of the Software to be installed and used by you on other computers you own as a single designated person. In other words, you may install the Software on more than one computer owned by you as long as there is only one physical computer running the Software at any time and as long as it is only used by you. This License does not permit any concurrent use. If other users will use the Software on any of the computers that the application will be installed on, then you are required to obtain additional licenses for each user who plans to use the Software. If your needs require concurrent use, please contact us for alternative licensing arrangements. We reserve all rights not expressly granted in this License.\n\n\n\n\n\n\nLicense Fee. Prices are subject to change without prior notice and the price of a License today does not guarantee a similar price in the future.\n\n\n\n\n\n\nTermination. Your license to the Software automatically terminates if you fail to comply with the terms of this License. Upon termination of this License, all licenses granted in Section 1 will terminate and you are required to stop using the Software and delete all copies in your possession or control. The following provisions will survive termination of this License: (i) your obligation to pay for services rendered before termination; (ii) Sections 6 through 14; and (iii) any other provision of this License that must survive termination to fulfill its essential purpose.\n\n\n\n\n\n\nModification and Upgrades. We may, from time to time, and in certain cases for a fee, replace, modify or upgrade the Software. The license fee includes one year of free upgrades. When accepted by you, any suc
|
||
|
"title": "License"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html#license",
|
||
|
"text": "Binary Ninja comes in different versions. Depending on the terms under which you purchased it, a different license below may apply.",
|
||
|
"title": "License"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html#non-commercial-student-license-named",
|
||
|
"text": "BINARY NINJA SOFTWARE LICENSE AGREEMENT (Non-commercial License) IMPORTANT! BE SURE TO CAREFULLY READ AND UNDERSTAND ALL OF THE TERMS SET FORTH IN THIS LICENSE AGREEMENT (\u201dLICENSE\u201d). BY CLICKING THE \"I ACCEPT\" BUTTON OR OTHERWISE ACCEPTING THIS LICENSE THROUGH AN ORDERING DOCUMENT THAT INCORPORATES THIS LICENSE, YOU AGREE TO FOLLOW AND BE BOUND BY THE TERMS AND CONDITIONS OF THIS LICENSE. IF YOU DO NOT AGREE TO ALL THE TERMS AND CONDITIONS IN THIS LICENSE, YOU MUST SELECT THE \"I DECLINE\" BUTTON AND MAY NOT USE THE SOFTWARE. This License is entered into by and between you (\u201cyou\u201d or \u201cyour\u201d) and Vector 35 LLC, a Florida limited liability company (\u201cus,\u201d \u201cwe\u201d or \u201cour\u201d). We will license Binary Ninja\u2122, a software application (the \u201cSoftware\u201d), to you under the mutual terms and conditions in this License. By installing the Software, you agree to be bound by the terms of this License. If you do not agree to the terms of this License, please do not install or attempt to use the Software. Non-Exclusive License Grant for Non-commercial Use. Under the terms of this License, the Software is licensed on a non-exclusive basis and is not sold. This License is for non- commercial purposes only. This means that you may not exercise any of the rights granted to you under this License in any manner that is intended for or directed toward commercial advantage or private monetary gain such as (a) activities undertaken for profit, or (b) activities intended to produce works, services, or data for commercial use, or (c) activities conducted, or funded, by a person or an entity engaged in the commercial use, application or exploitation of works similar to the Software. If you have any question regarding a particular use, please feel free to contact us regarding your particular circumstances. Please note, the Software under this non-commercial license is a different version than the standard version of Binary Ninja\u2122. There is a fee to upgrade to the standard version of Binary Ninja\u2122. This License grants you the rights a single user license that allows a copy of the Software to be installed and used by you on other computers you own as a single designated person. In other words, you may install the Software on more than one computer owned by you as long as there is only one physical computer running the Software at any time and as long as it is only used by you. This License does not permit any concurrent use. If other users will use the Software on any of the computers that the application will be installed on, then you are required to obtain additional licenses for each user who plans to use the Software. If your needs require concurrent use, please contact us for alternative licensing arrangements. We reserve all rights not expressly granted in this License. License Fee. Prices are subject to change without prior notice and the price of a License today does not guarantee a similar price in the future. Termination. Your license to the Software automatically terminates if you fail to comply with the terms of this License. Upon termination of this License, all licenses granted in Section 1 will terminate and you are required to stop using the Software and delete all copies in your possession or control. The following provisions will survive termination of this License: (i) your obligation to pay for services rendered before termination; (ii) Sections 6 through 14; and (iii) any other provision of this License that must survive termination to fulfill its essential purpose. Modification and Upgrades. We may, from time to time, and in certain cases for a fee, replace, modify or upgrade the Software. The license fee includes one year of free upgrades. When accepted by you, any such replacement or modified Software code or upgrade to the Software will be considered part of the Software and subject to the terms of this License (unless this License is superseded by a further License accompanying such replacement or modified versio
|
||
|
"title": "Non-commercial / Student License (NAMED)"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html#commercial-license-named",
|
||
|
"text": "BINARY NINJA SOFTWARE LICENSE AGREEMENT IMPORTANT! BE SURE TO CAREFULLY READ AND UNDERSTAND ALL OF THE TERMS SET FORTH IN THIS LICENSE AGREEMENT (\"LICENSE\"). BY CLICKING THE \"I ACCEPT\" BUTTON OR OTHERWISE ACCEPTING THIS LICENSE THROUGH AN ORDERING DOCUMENT THAT INCORPORATES THIS LICENSE, YOU AGREE TO FOLLOW AND BE BOUND BY THE TERMS AND CONDITIONS OF THIS LICENSE. IF YOU ARE ENTERING INTO THIS LICENSE ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY TO THE TERMS AND CONDITIONS OF THIS LICENSE AND, IN SUCH EVENT, \"YOU\" AND \"YOUR\" AS USED IN THIS LICENSE SHALL REFER TO SUCH ENTITY, IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE TO ALL THE TERMS AND CONDITIONS IN THIS LICENSE, YOU MUST SELECT THE \"I DECLINE\" BUTTON AND MAY NOT USE THE SOFTWARE. This License is entered into by and between you (\"you\" or \"your\") and Vector 35 LLC, a Florida limited liability company (\"us\", \"we\" or \"our\"). We will license Binary Ninja\u2122, a software application (the \"Software\"), to you under the mutual terms and conditions in this License. By installing the Software, you agree to be bound by the terms of this License. If you do not agree to the terms of this License, please do not install or attempt to use the Software. Non-Exclusive License Grant. Under the terms of this License, the Software is licensed on a non-exclusive basis and is not sold. You receive no title to or ownership of the Software itself. This License grants you the rights a single user license that allows a copy of the Software to be installed and used by you on other computers you own as a single designated person. In other words, you may install the Software on more than one computer owned by you as long as there is only one physical computer running the Software at any time and as long as it is only used by you. This License does not permit any concurrent use. If other users will use the Software on any of the computers that the application will be installed on, then you are required to obtain additional licenses for each user who plans to use the Software. If your needs require concurrent use, please contact us for alternative licensing arrangements. If other users will use the Software, then you are required to obtain additional licenses for each user who plans to use the Software. All rights not expressly granted herein reserved by us. License Fee. Prices are subject to change without prior notice and the price of a License today does not guarantee a similar price in the future. Termination. Your license to the Software automatically terminates if you fail to comply with the terms of this License. Upon termination of this License, all licenses granted in Section 1 will terminate and you are required to stop using the Software and delete all copies in your possession or control. The following provisions will survive termination of this License: (i) your obligation to pay for services rendered before termination; (ii) Sections 6 through 14; and (iii) any other provision of this License that must survive termination to fulfill its essential purpose. Modification and Upgrades. We may, from time to time, and in certain cases for a fee, replace, modify or upgrade the Software. The license fee includes one year of free upgrades. When accepted by you, any such replacement or modified Software code or upgrade to the Software will be considered part of the Software and subject to the terms of this License (unless this License is superseded by a further License accompanying such replacement or modified version of or upgrade to the Software). Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with others.
|
||
|
"title": "Commercial License (NAMED)"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html#non-commercial-student-license-computer",
|
||
|
"text": "BINARY NINJA SOFTWARE LICENSE AGREEMENT (Non-commercial Computer License) IMPORTANT! BE SURE TO CAREFULLY READ AND UNDERSTAND ALL OF THE TERMS SET FORTH IN THIS LICENSE AGREEMENT (\u201dLICENSE\u201d). BY CLICKING THE \"I ACCEPT\" BUTTON OR OTHERWISE ACCEPTING THIS LICENSE THROUGH AN ORDERING DOCUMENT THAT INCORPORATES THIS LICENSE, YOU AGREE TO FOLLOW AND BE BOUND BY THE TERMS AND CONDITIONS OF THIS LICENSE. IF YOU DO NOT AGREE TO ALL THE TERMS AND CONDITIONS IN THIS LICENSE, YOU MUST SELECT THE \"I DECLINE\" BUTTON AND MAY NOT USE THE SOFTWARE. This License is entered into by and between you (\u201cyou\u201d or \u201cyour\u201d) and Vector 35 LLC, a Florida limited liability company (\u201cus,\u201d \u201cwe\u201d or \u201cour\u201d). We will license Binary Ninja\u2122, a software application (the \u201cSoftware\u201d), to you under the mutual terms and conditions in this License. By installing the Software, you agree to be bound by the terms of this License. If you do not agree to the terms of this License, please do not install or attempt to use the Software. Non-Exclusive License Grant for Non-commercial Use. Under the terms of this License, the Software is licensed on a non-exclusive basis and is not sold. This License is for non- commercial purposes only. This means that you may not exercise any of the rights granted to you under this License in any manner that is intended for or directed toward commercial advantage or private monetary gain such as (a) activities undertaken for profit, or (b) activities intended to produce works, services, or data for commercial use, or (c) activities conducted, or funded, by a person or an entity engaged in the commercial use, application or exploitation of works similar to the Software. If you have any question regarding a particular use, please feel free to contact us regarding your particular circumstances. Please note, the Software under this non-commercial license is a different version than the standard version of Binary Ninja\u2122. There is a fee to upgrade to the standard version of Binary Ninja\u2122. This License grants you the rights to a computer license that allows a copy of the Software to be installed and used by you on a particular single computer you own (the \u201cDesignated Computer\u201d) which Designated Computer may be used by any user as long as it is used for non-commercial purposes. In other words, you may install the Software only on one computer owned by you but you may allow multiple users to use the Software on such Designated Computer as long as the Designated Computer is the only physical computer running the Software at any time and it is used for non-commercial purposes. This License does not permit any concurrent use. If you will use the Software on any computers other than the Designated Computer that the application will be installed on, then you are required to obtain additional licenses for each such computer upon which the Software will be installed. If your needs require concurrent use, please contact us for alternative licensing arrangements. We reserve all rights not expressly granted in this License. License Fee. Prices are subject to change without prior notice and the price of a License today does not guarantee a similar price in the future. Termination. Your license to the Software automatically terminates if you fail to comply with the terms of this License. Upon termination of this License, all licenses granted in Section 1 will terminate and you are required to stop using the Software and delete all copies in your possession or control. The following provisions will survive termination of this License: (i) your obligation to pay for services rendered before termination; (ii) Sections 6 through 14; and (iii) any other provision of this License that must survive termination to fulfill its essential purpose. Modification and Upgrades. We may, from time to time, and in certain cases for a fee, replace, modify or upgrade the Software. The license fee includes one year of free upgrades. When accept
|
||
|
"title": "Non-commercial / Student License (COMPUTER)"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html#commercial-license-computer",
|
||
|
"text": "BINARY NINJA SOFTWARE LICENSE AGREEMENT IMPORTANT! BE SURE TO CAREFULLY READ AND UNDERSTAND ALL OF THE TERMS SET FORTH IN THIS LICENSE AGREEMENT (\"LICENSE\"). BY CLICKING THE \"I ACCEPT\" BUTTON OR OTHERWISE ACCEPTING THIS LICENSE THROUGH AN ORDERING DOCUMENT THAT INCORPORATES THIS LICENSE, YOU AGREE TO FOLLOW AND BE BOUND BY THE TERMS AND CONDITIONS OF THIS LICENSE. IF YOU ARE ENTERING INTO THIS LICENSE ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY TO THE TERMS AND CONDITIONS OF THIS LICENSE AND, IN SUCH EVENT, \"YOU\" AND \"YOUR\" AS USED IN THIS LICENSE SHALL REFER TO SUCH ENTITY, IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE TO ALL THE TERMS AND CONDITIONS IN THIS LICENSE, YOU MUST SELECT THE \"I DECLINE\" BUTTON AND MAY NOT USE THE SOFTWARE. This License is entered into by and between you (\"you\" or \"your\") and Vector 35 LLC, a Florida limited liability company (\"us\", \"we\" or \"our\"). We will license Binary Ninja\u2122, a software application (the \"Software\"), to you under the mutual terms and conditions in this License. By installing the Software, you agree to be bound by the terms of this License. If you do not agree to the terms of this License, please do not install or attempt to use the Software. Non-Exclusive License Grant. Under the terms of this License, the Software is licensed on a non-exclusive basis and is not sold. You receive no title to or ownership of the Software itself. This License grants you the rights to a computer license that allows a copy of the Software to be installed and used by you on a particular single computer you own (the \u201cDesignated Computer\u201d) which Designated Computer may be used by any user. In other words, you may install the Software only on one computer owned by you but you may allow multiple users to use the Software on such Designated Computer as long as the Designated Computer is the only physical computer running the Software at any time. This License does not permit any concurrent use. If you will use the Software on any computers other than the Designated Computer that the application will be installed on, then you are required to obtain additional licenses for each such computer upon which the Software will be installed. If your needs require concurrent use, please contact us for alternative licensing arrangements. All rights not expressly granted herein reserved by us. License Fee. Prices are subject to change without prior notice and the price of a License today does not guarantee a similar price in the future. Termination. Your license to the Software automatically terminates if you fail to comply with the terms of this License. Upon termination of this License, all licenses granted in Section 1 will terminate and you are required to stop using the Software and delete all copies in your possession or control. The following provisions will survive termination of this License: (i) your obligation to pay for services rendered before termination; (ii) Sections 6 through 14; and (iii) any other provision of this License that must survive termination to fulfill its essential purpose. Modification and Upgrades. We may, from time to time, and in certain cases for a fee, replace, modify or upgrade the Software. The license fee includes one year of free upgrades. When accepted by you, any such replacement or modified Software code or upgrade to the Software will be considered part of the Software and subject to the terms of this License (unless this License is superseded by a further License accompanying such replacement or modified version of or upgrade to the Software). Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in
|
||
|
"title": "Commercial License (COMPUTER)"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html#demo-license",
|
||
|
"text": "BINARY NINJA\u2122 TRIAL PERIOD SOFTWARE DEMONSTRATION LICENSE AGREEMENT IMPORTANT! BE SURE TO CAREFULLY READ AND UNDERSTAND ALL OF THE TERMS SET FORTH IN THIS TRIAL PERIOD DEMONSTRATION LICENSE AGREEMENT (\"DEMONSTRATION LICENSE\"). BY CLICKING THE \"I ACCEPT\" BUTTON OR OTHERWISE ACCEPTING THIS DEMONSTRATION LICENSE THROUGH AN ORDERING DOCUMENT THAT INCORPORATES THIS DEMONSTRATION LICENSE, YOU AGREE TO FOLLOW AND BE BOUND BY THE TERMS AND CONDITIONS OF THIS DEMONSTRATION LICENSE. IF YOU ARE ENTERING INTO THIS DEMONSTRATION LICENSE ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY TO THE TERMS AND CONDITIONS OF THIS DEMONSTRATION LICENSE AND, IN SUCH EVENT, \"YOU\" AND \"YOUR\" AS USED IN THIS DEMONSTRATION LICENSE SHALL REFER TO SUCH ENTITY, IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE TO ALL THE TERMS AND CONDITIONS IN THIS DEMONSTRATION LICENSE, YOU MUST SELECT THE \"I DECLINE\" BUTTON AND MAY NOT USE THE SOFTWARE. This Demonstration License is entered into by and between you (\"you\" or \"your\") and Vector 35 LLC, a Florida limited liability company (\"us\", \"we\" or \"our\"). We will license a \u201cfree to use\u201d demonstration version of Binary Ninja\u2122, a software application (the \"Demonstration Software\"), to you under the mutual terms and conditions in this Demonstration License for your internal evaluation purposes only. Notwithstanding anything to the contrary in this Demonstration License, we reserve the right to revoke or terminate the Demonstration Software and this Demonstration License any at any time in our sole discretion. By installing the Demonstration Software, you agree to be bound by the terms of this Demonstration License. If you do not agree to the terms of this Demonstration License, please do not install or attempt to use the Demonstration Software. Non-Exclusive Demonstration License Grant. Under the terms of this Demonstration License, the Demonstration Software is licensed on a non-exclusive basis and is not sold. You receive no title to or ownership of the Demonstration Software itself. This License is for non- commercial purposes only. This Demonstration License grants you the rights a single user license that allows a copy of the Demonstration Software to be installed and used by you on other computers you own as a single designated person. In other words, you may install the Demonstration Software on more than one computer owned by you as long as there is only one physical computer running the Demonstration Software at any time and as long as it is only used by you. This Demonstration License does not permit any concurrent use. If other users will use the Demonstration Software on any of the computers that the application will be installed on, then you are required to obtain additional licenses for each user who plans to use the Demonstration Software. If your needs require concurrent use, please contact us for alternative licensing arrangements. If other users will use the Demonstration Software, then you are required to obtain additional licenses for each user who plans to use the Demonstration Software. All rights not expressly granted herein reserved by us. Free Use Demonstration License. Subject to the terms of this Demonstration License, there is no fee for the use of the Demonstration Software. Upon revocation of the Demonstration License by us, you must obtain a paid end user license for Binary Ninja\u2122 if you intend to continue use. Termination. You may terminate this Demonstration License at any time (i) by destroying all copies of Demonstration Software and related documentation and purging same from memory devices (this is required at the termination of this Demonstration License).\u00a0 Your license to the Demonstration Software automatically terminates if you fail to comply with the terms of this Demonstration License. Upon termination of this Demonstration License, all licenses granted in Section 1 will terminate and you are required to stop using the Dem
|
||
|
"title": "Demo License"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/license/index.html#enterprise-license",
|
||
|
"text": "The enterprise license is forthcoming.",
|
||
|
"title": "Enterprise License"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/open-source/index.html",
|
||
|
"text": "Binary Ninja\n\n\nOpen Source\n\n\nVector 35 is grateful for the following open source packages that are used in Binary Ninja directly or indirectly:\n\n\n\n\nDocumentation\n\n\nbreathe-rtd-theme\n (\nbreathe-rtd-theme license\n - MIT)\n\n\nbreathe\n (\nbreathe license\n - BSD)\n\n\ndoxygen\n (\ndoxygen license\n - GPLv2)\n\n\nmkdocs-material\n (\nmkdocs-material License\n - BSD)\n\n\nmkdocs\n (\nmkdocs license\n - BSD)\n\n\nsphinx\n (\nsphinx license\n - BSD and others)\n\n\n\n\n\n\n\n\nThe previous tools are used in the generation of our documentation, but are not distributed themselves and are merely listed here in acknowledgement for the value they provide.\n\n\n\n\n\n\nUI\n\n\n\n\ndejavusanscode\n (\ndejavusanscode license\n - multiple open licenses)\n\n\nopensans\n (\nopensans license\n - Apache 2.0)\n\n\nqt\n (\nqt license\n - LGPLv3 / note, please see our \nqt build instructions below\n)\n\n\nsourcecodepro\n (\nsourcecodepro license\n - SIL open font license)\n\n\n\n\n\n\n\n\nCore\n\n\n\n\ndiscount\n (\ndiscount license\n - BSD)\n\n\nlibgit2\n (\nlibgit2 license\n - GPLv2 with linking exception)\n\n\nlibmspack\n (\nlibmspack license\n - LGPL, v2)\n\n\nllvm\n (\nllvm license\n - BSD-style)\n\n\nlzf\n (\nlzf license\n - BSD)\n\n\njemalloc\n (\njemalloc license\n - BSD)\n\n\nsqlite\n (\nsqlite license\n - public domain)\n\n\nzlib\n (\nzlib license\n - zlib license)\n\n\n\n\n\n\n\n\nOther\n\n\n\n\nyasm\n (\nyasm license\n - 2-clause BSD) used for assembling x86 and x64\n\n\ncapstone\n (\ncapstone license\n - 3-clause BSD) used in the PPC architecture module as an example of how to wrap an external disassembler\n\n\n\n\n\n\n\n\nUpvector update library\n\n\n\n\ntomcrypt\n (\ntomcrypt license\n - public domain)\n\n\n\n\n\n\n\n\nBuilding Qt\n\n\nBinary Ninja uses \nQt 5.10\n under an LGPLv3 license which requires that we host the original sources used to build Qt for our application along with instructions on how that source may be re-built and can replace the version of Qt shipped with Binary Ninja.\n\n\nPlease note that we offer no support for running Binary Ninja with modified Qt libraries.\n\n\n\n\nFollow the installation requirements on the \nBuilding Qt 5 from Git\n page.\n\n\nDownload the Qt 5.10.1 \ntarball\n from binary.ninja. (Note this is an unmodified 5.10 identical to that available from Qt's source control, but must be hosted locally according to the \nQt 5.10\n terms.)\n\n\nNext, build QT using the aforementioned instructions.\n\n\nOn OS X, you will need to disable the code-signing signature since it would otherwise prevent changes to binaries or shared libraries. We recommend a tool such as \nunsign\n.\n\n\nFinally, replace the built libraries:\n\n\nOn OS X, replace the \nQtCore.framework\n, \nQtDBus.framework\n, \nQtGui.framework\n, \nQtNetwork.framework\n, \nQtPrintSupport.framework\n, \nQtWidgets.framework\n folders inside of \n/Applications/Binary Ninja.app/Contents/Frameworks\n\n\nOn Windows, replace the \nQt5core.dll\n, \nQt5Gui.dll\n, \nQt5Network.dll\n, and \nQt5Widgets.dll\n files in \nC:\\Program Files\\Vector35\\BinaryNinja\\\n\n\nOn Linux, replace the \nlibQt5Core.so.5\n, \nlibQt5DBus.so.5\n, \nlibQt5Gui.so.5\n, \nlibQt5Network.so.5\n, \nlibQt5Widgets.so.5\n, \nlibQt5XcbQpa.so.5\n files wherever Binary Ninja was extracted",
|
||
|
"title": "Open Source"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/open-source/index.html#binary-ninja",
|
||
|
"text": "",
|
||
|
"title": "Binary Ninja"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/open-source/index.html#open-source",
|
||
|
"text": "Vector 35 is grateful for the following open source packages that are used in Binary Ninja directly or indirectly: Documentation breathe-rtd-theme ( breathe-rtd-theme license - MIT) breathe ( breathe license - BSD) doxygen ( doxygen license - GPLv2) mkdocs-material ( mkdocs-material License - BSD) mkdocs ( mkdocs license - BSD) sphinx ( sphinx license - BSD and others) The previous tools are used in the generation of our documentation, but are not distributed themselves and are merely listed here in acknowledgement for the value they provide. UI dejavusanscode ( dejavusanscode license - multiple open licenses) opensans ( opensans license - Apache 2.0) qt ( qt license - LGPLv3 / note, please see our qt build instructions below ) sourcecodepro ( sourcecodepro license - SIL open font license) Core discount ( discount license - BSD) libgit2 ( libgit2 license - GPLv2 with linking exception) libmspack ( libmspack license - LGPL, v2) llvm ( llvm license - BSD-style) lzf ( lzf license - BSD) jemalloc ( jemalloc license - BSD) sqlite ( sqlite license - public domain) zlib ( zlib license - zlib license) Other yasm ( yasm license - 2-clause BSD) used for assembling x86 and x64 capstone ( capstone license - 3-clause BSD) used in the PPC architecture module as an example of how to wrap an external disassembler Upvector update library tomcrypt ( tomcrypt license - public domain)",
|
||
|
"title": "Open Source"
|
||
|
},
|
||
|
{
|
||
|
"location": "/about/open-source/index.html#building-qt",
|
||
|
"text": "Binary Ninja uses Qt 5.10 under an LGPLv3 license which requires that we host the original sources used to build Qt for our application along with instructions on how that source may be re-built and can replace the version of Qt shipped with Binary Ninja. Please note that we offer no support for running Binary Ninja with modified Qt libraries. Follow the installation requirements on the Building Qt 5 from Git page. Download the Qt 5.10.1 tarball from binary.ninja. (Note this is an unmodified 5.10 identical to that available from Qt's source control, but must be hosted locally according to the Qt 5.10 terms.) Next, build QT using the aforementioned instructions. On OS X, you will need to disable the code-signing signature since it would otherwise prevent changes to binaries or shared libraries. We recommend a tool such as unsign . Finally, replace the built libraries: On OS X, replace the QtCore.framework , QtDBus.framework , QtGui.framework , QtNetwork.framework , QtPrintSupport.framework , QtWidgets.framework folders inside of /Applications/Binary Ninja.app/Contents/Frameworks On Windows, replace the Qt5core.dll , Qt5Gui.dll , Qt5Network.dll , and Qt5Widgets.dll files in C:\\Program Files\\Vector35\\BinaryNinja\\ On Linux, replace the libQt5Core.so.5 , libQt5DBus.so.5 , libQt5Gui.so.5 , libQt5Network.so.5 , libQt5Widgets.so.5 , libQt5XcbQpa.so.5 files wherever Binary Ninja was extracted",
|
||
|
"title": "Building Qt"
|
||
|
}
|
||
|
]
|
||
|
}
|