Back to Details

binary-ninja-reverse

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Binary Ninja reverse engineering

Binary Ninja逆向工程

Use Binary Ninja when the user explicitly selects it, when its ILs materially help data-flow analysis, or when IDA/Ghidra/radare2 results need an independent cross-check.
当用户明确选择Binary Ninja、其IL对数据流分析有实质性帮助，或需要对IDA/Ghidra/radare2的结果进行独立交叉验证时，使用Binary Ninja。

Start safely

安全启动

  1. Confirm the repository case scope is ready before acting on a target.
  2. Check 
    skills/tool-index.md
    for 
    binaryninja
    ; Binary Ninja is commercial software and must be installed manually with a valid Vector 35 license.
  3. Work on a copy when applying patches or saving database changes.
  4. Record imports/exports, entry points, architecture, and file hash before promoting findings.
  1. 在对目标进行操作前，确认仓库案例范围已准备就绪。
  2. 查看
    skills/tool-index.md
    中的
    binaryninja
    条目；Binary Ninja是商业软件，必须手动安装并拥有有效的Vector 35许可证。
  3. 应用补丁或保存数据库更改时，操作副本文件。
  4. 在提交发现结果前，记录导入/导出、入口点、架构和文件哈希值。

Choose the integration

选择集成方式

  • GUI or Python API: preferred when Binary Ninja is already open or the user wants direct interactive analysis.
  • Community MCP bridge: use only when explicitly requested and after reviewing the third-party plugin boundary. Keep the Binary Ninja HTTP listener on 
    127.0.0.1:9009
    ; do not enable network exposure by default.
  • Fallback: use 
    ghidra-reverse
    , 
    ida-reverse
    , or 
    radare2
    when Binary Ninja is unavailable or its license/API cannot open the target.
The reviewed community integration is 
fosdickio/binary_ninja_mcp
, GPL-3.0, plugin metadata version 
1.1.0
, minimum Binary Ninja build 
4000
. The repository is not an official Vector 35 component. This skill was checked against commit 
8c5134ee46e2bf44f9a4d846bd971c3e39b3e306
on 2026-09-03.
Install the Binary Ninja side through its Plugin Manager or from the reviewed source. For the MCP stdio bridge, pin the published bridge version rather than using an unbounded package:
text
npx -y binary-ninja-mcp@1.0.0 --host 127.0.0.1 --port 9009
Register that command only in the MCP client the user selected. The bridge is not ready until Binary Ninja is running, a binary is open, and the localhost plugin endpoint responds.
  • GUI或Python API：当Binary Ninja已打开，或用户需要直接交互式分析时优先使用。
  • 社区MCP桥接：仅在明确请求时使用，且需先审查第三方插件边界。将Binary Ninja HTTP监听器保持在
    127.0.0.1:9009
    ；默认情况下不要启用网络暴露。
  • 备选方案：当Binary Ninja不可用，或其许可证/API无法打开目标文件时，使用
    ghidra-reverse
    、
    ida-reverse
    或
    radare2
    。
经审核的社区集成是
fosdickio/binary_ninja_mcp
，采用GPL-3.0许可证，插件元数据版本
1.1.0
，最低Binary Ninja版本
4000
。该仓库并非Vector 35的官方组件。本技能已针对2026年9月3日的提交
8c5134ee46e2bf44f9a4d846bd971c3e39b3e306
进行验证。
通过Binary Ninja的插件管理器或经审核的源代码安装Binary Ninja端组件。对于MCP标准输入输出桥接，固定使用已发布的桥接版本，而非无限制的包：
text
npx -y binary-ninja-mcp@1.0.0 --host 127.0.0.1 --port 9009
仅在用户选择的MCP客户端中注册该命令。只有当Binary Ninja运行、二进制文件已打开且本地插件端点响应时，桥接才准备就绪。

Analysis workflow

分析工作流

  1. Enumerate open binaries and select the intended view.
  2. Capture binary status, entry points, segments, imports, exports, and representative strings.
  3. Follow call sites and cross-references before interpreting a function in isolation.
  4. Use HLIL for readable logic, MLIL SSA for data flow, and LLIL/disassembly when lifting loses instruction-level behavior.
  5. Apply names, comments, and types incrementally; keep the original addresses in evidence.
  6. Treat byte patches, prototype changes, and saved-file writes as mutations. Perform them only when requested and preserve the original artifact.
  7. Cross-check high-impact conclusions with a second evidence source or another disassembler.
Useful MCP capability families include binary/view selection, 
list_imports
, 
list_exports
, 
list_strings
, 
decompile_function
, 
get_il
, callers/callees, cross-references, types, comments, renames, and byte patching. Discover the live tool list instead of assuming every upstream function is present.
  1. 枚举已打开的二进制文件并选择目标视图。
  2. 捕获二进制文件状态、入口点、段、导入、导出和代表性字符串。
  3. 在单独解读函数前，跟踪调用站点和交叉引用。
  4. 使用HLIL获取可读逻辑，使用MLIL SSA进行数据流分析，当反汇编丢失指令级行为时使用LLIL/反汇编代码。
  5. 逐步应用名称、注释和类型；保留原始地址作为证据。
  6. 将字节补丁、原型更改和保存文件写入视为修改操作。仅在请求时执行，并保留原始工件。
  7. 使用第二个证据来源或另一个反汇编器交叉验证高影响结论。
实用的MCP功能类别包括二进制/视图选择、
list_imports
、
list_exports
、
list_strings
、
decompile_function
、
get_il
、调用者/被调用者、交叉引用、类型、注释、重命名和字节补丁。查看实时工具列表，而非假设所有上游功能都可用。

Output

输出

Report concrete addresses, function names, IL level, supporting strings/imports, confidence, and reproduction steps. Keep the Evidence → Finding → Path chain used by the rest of the repository.
报告具体地址、函数名称、IL级别、支持的字符串/导入、置信度和重现步骤。遵循仓库其余部分使用的“证据→发现→路径”链条。