binaryninja

# View → Linear Disassembly (classic view)
# View → Graph (CFG of function)
# View → High Level IL (HLIL — C-like)
# View → Medium Level IL (MLIL — SSA)
# View → Low Level IL (LLIL — near assembly)
# View → Lifted IL (raw lift)

# Sidebar panels:
# Symbols — all named functions/vars
# Cross References — xrefs panel
# Types — struct/type editor
# Strings — all found strings
# Tags — bookmarks

# Python console: Ctrl+\  (most powerful)
# Access current binary via: bv (BinaryView)
# Access current function:   current_function
# Access current address:    here

# In Binja Python console (Ctrl+\):
bv                          # current BinaryView
here                        # current address (int)
current_function            # Function at cursor
current_basic_block         # BasicBlock at cursor

# BinaryView basics
bv.file.filename            # file path
bv.arch                     # architecture
bv.start                    # start address
bv.entry_point              # entry point
list(bv.functions)          # all functions
list(bv.symbols.values())   # all symbols
bv.get_symbol_by_raw_name('main')
bv.get_function_at(0x401234)

import binaryninja as bn

# Open binary
bv = bn.open_view('./challenge')
bv.update_analysis_and_wait()  # ensure fully analyzed

# Find function by name
func = bv.get_functions_by_name('main')[0]

# Find function at address
func = bv.get_function_at(0x401234)

# Iterate all functions
for func in bv.functions:
    print(func.name, hex(func.start))

# Close properly
bv.file.close()

# Headless mode (no GUI)
with bn.open_view('./challenge') as bv:
    bv.update_analysis_and_wait()
    # ... analyze ...

func = bv.get_function_at(0x401234)

# Basic info
func.name                   # 'check_password'
func.start                  # 0x401234
func.parameter_vars         # list of params
func.vars                   # all local vars
func.stack_layout           # stack frame layout
func.basic_blocks           # list of BasicBlock
func.callees                # functions this calls
func.callers                # functions that call this

# Rename
func.name = 'win_function'

# Iterate HLIL instructions
for block in func.hlil:
    for instr in block:
        print(instr.operation, instr)

# Find specific HLIL operations
from binaryninja.highlevelil import HighLevelILOperation
for instr in func.hlil.instructions:
    if instr.operation == HighLevelILOperation.HLIL_CALL:
        print('call at', hex(instr.address), instr)

# Variables
for var in func.vars:
    print(var.name, var.type)

# Rename variable
var = func.vars[0]
func.create_user_var(var.storage, var.type, 'new_name')

# Change type
from binaryninja import Type
func.create_user_var(var.storage, Type.int(4), 'my_int')

# Define struct type
s = bn.Structure()
s.append(bn.Type.int(4), 'field1')
s.append(bn.Type.pointer(bv.arch, bn.Type.char()), 'name')
bv.define_user_type('MyStruct', bn.Type.structure_type(s))

# Apply type to variable
t = bv.get_type_by_name('MyStruct')
func.create_user_var(var.storage, bn.Type.pointer(bv.arch, t), 'obj')

# Find string in binary data
for s in bv.strings:
    if 'flag' in s.value.lower():
        print(hex(s.start), s.value)

# Find bytes pattern
results = bv.find_all_data(bv.start, bv.end,
    bn.DataBuffer(bytes.fromhex('5fc3')))  # pop rdi; ret
for addr, _, _ in results:
    print(hex(addr))

# Find disassembly text
results = bv.find_all_text(bv.start, bv.end, 'strcmp')
for addr, _, _ in results:
    print(hex(addr))

# Find HLIL expression
results = bv.find_all_constant(bv.start, bv.end, 0x1337)
for addr, _, _ in results:
    print(hex(addr))

# All code references TO an address
for xref in bv.get_code_refs(0x401234):
    print(hex(xref.address), xref.function.name)

# All data references TO an address
for xref in bv.get_data_refs(0x404060):
    print(hex(xref))

# Code refs FROM an address
for xref in bv.get_code_refs_from(0x401234):
    print(hex(xref))

# Callees of a function (who does it call?)
for callee in func.callees:
    print(callee.name)

# Callers of a function (who calls it?)
for caller in bv.get_callers(func.start):
    print(hex(caller))

# Write raw bytes
bv.write(0x401234, b'\x90\x90')         # NOP NOP
bv.write(0x401234, bytes.fromhex('9090'))

# Always patch (even read-only sections)
bv.write(0x401234, b'\xeb\x0a')          # JMP +10

# Assemble and write
from binaryninja import Architecture
arch = bv.arch
asm, _ = arch.assemble('nop; nop')
bv.write(0x401234, asm)

# Save patched binary
bv.save_auto_snapshot()
bv.file.save_with_options('./patched', None)

# Export patched binary
with open('./patched', 'wb') as f:
    f.write(bytes(bv[bv.start:bv.end]))

# Read raw bytes
data = bv.read(0x401234, 16)     # 16 bytes
print(data.hex())

# Read integer
val = bv.read_int(0x404060, 8, False)  # 8 bytes, unsigned

# Check segment permissions
seg = bv.get_segment_at(0x401234)
seg.readable
seg.writable
seg.executable

# List all segments
for seg in bv.segments:
    print(hex(seg.start), hex(seg.end),
          'r' if seg.readable else '-',
          'w' if seg.writable else '-',
          'x' if seg.executable else '-')