Skip to main content
This example demonstrates how to iterate through all functions in a binary, their basic blocks, and both Low Level IL and machine code instructions.

​
Overview

The instruction_iterator.py example shows how to:
  • Iterate through all functions in a binary
  • Navigate function basic blocks
  • Access Low Level IL (LLIL) instructions
  • Access machine code instructions
  • Use proper logging for analysis output

​
Complete Source Code

#!/usr/bin/env python
import sys
from binaryninja.log import log_info, log_to_stdout
from binaryninja import load, BinaryView
from binaryninja import PluginCommand, LogLevel


def iterate(bv: BinaryView):
    log_info("-------- %s --------" % bv.file.filename)
    log_info("START: 0x%x" % bv.start)
    log_info("ENTRY: 0x%x" % bv.entry_point)
    log_info("ARCH: %s" % bv.arch.name)
    log_info("\n-------- Function List --------")
    
    # Print all the functions, their basic blocks, and their IL instructions
    for func in bv.functions:
        log_info(repr(func))
        for block in func.low_level_il:
            log_info("\t{0}".format(block))

            for insn in block:
                log_info("\t\t{0}".format(insn))
    
    # Print all the functions, their basic blocks, and their machine code instructions
    for func in bv.functions:
        log_info(repr(func))
        for block in func:
            log_info("\t{0}".format(block))

            for insn in block:
                log_info("\t\t{0}".format(insn))


if __name__ == "__main__":
    if len(sys.argv) > 1:
        target = sys.argv[1]
        log_to_stdout(LogLevel.WarningLog)
        with load(target) as bv:
            log_to_stdout(LogLevel.InfoLog)
            iterate(bv)
    else:
        print(f"{sys.argv[0]} <filename>")
else:
    PluginCommand.register("Instruction Iterator", "Iterates Instruction to the log window", iterate)

​
Key Concepts Explained

1
Iterate All Functions
2
for func in bv.functions:
    log_info(repr(func))
3
The bv.functions property returns an iterable of all functions discovered during analysis. Use repr(func) to get a detailed string representation including the function’s address and name.
4
Access Low Level IL Blocks and Instructions
5
for block in func.low_level_il:
    log_info("\t{0}".format(block))
    
    for insn in block:
        log_info("\t\t{0}".format(insn))
6
Low Level IL (LLIL) is Binary Ninja’s first intermediate representation:
7
  • func.low_level_il - Returns the LLIL function object
  • Iterate blocks in the IL control flow graph
  • Each block contains IL instructions that can be further iterated
    • 8
    Access Machine Code Instructions
    9
    for block in func:
    log_info("\t{0}".format(block))
    
    for insn in block:
        log_info("\t\t{0}".format(insn))
    10
    Iterate directly over function objects to access raw disassembly:
    11
  • func is iterable and yields basic blocks
  • Each block yields machine code instructions
  • Instructions are architecture-specific disassembly
    • 12
    Configure Logging
    13
    log_to_stdout(LogLevel.InfoLog)
    14
    Control logging output levels:
    15
  • LogLevel.DebugLog - Verbose debugging information
  • LogLevel.InfoLog - General information
  • LogLevel.WarningLog - Warnings only
  • LogLevel.ErrorLog - Errors only
    • 16
    Use Context Managers for Resource Management
    17
    with load(target) as bv:
    iterate(bv)
    18
    The with statement ensures proper cleanup of BinaryView resources when done.

    ​
    Running the Example

    ​
    Command Line Mode

    python instruction_iterator.py /bin/ls

    ​
    Plugin Mode

    When loaded as a plugin:
    1. Open a binary in Binary Ninja
    2. Run Tools > Instruction Iterator
    3. Check the Log window for output

    ​
    Expected Output

    -------- /bin/ls --------
START: 0x100000000
ENTRY: 0x100001a40
ARCH: aarch64

-------- Function List --------
<func: aarch64@0x100001a40>
    <block: start 0x100001a40, end 0x100001a60>
        <il: 0 @ 0x100001a40> temp0 = sp
        <il: 1 @ 0x100001a40> sp = temp0 - 0x10
        <il: 2 @ 0x100001a44> [temp0 - 0x8].q = x30
        ...
    <block: start 0x100001a60, end 0x100001a80>
        <il: 15 @ 0x100001a60> x0 = 0x0
        ...

<func: aarch64@0x100001a40>
    <block: start 0x100001a40, end 0x100001a60>
        <insn: 0x100001a40> sub sp, sp, #0x10
        <insn: 0x100001a44> str x30, [sp, #0x8]
        ...

    ​
    Understanding the Output

    ​
    LLIL Output Format

    <il: INDEX @ ADDRESS> INSTRUCTION
    • INDEX - IL instruction index within the function
    • ADDRESS - Original address in the binary
    • INSTRUCTION - Human-readable IL operation

    ​
    Machine Code Output Format

    <insn: ADDRESS> DISASSEMBLY
    • ADDRESS - Instruction address in the binary
    • DISASSEMBLY - Architecture-specific assembly instruction

    ​
    Advanced Iteration Patterns

    ​
    Filter Functions by Name

    for func in bv.functions:
    if "main" in func.name:
        # Process only functions with 'main' in name
        for block in func:
            ...

    ​
    Count Instructions per Function

    for func in bv.functions:
    instruction_count = sum(1 for block in func for insn in block)
    log_info(f"{func.name}: {instruction_count} instructions")

    ​
    Access Both IL and Disassembly

    for func in bv.functions:
    llil = func.low_level_il
    for llil_block in llil:
        for llil_insn in llil_block:
            # Get corresponding disassembly
            disasm = func.get_disassembly(llil_insn.address)
            log_info(f"LLIL: {llil_insn} | ASM: {disasm}")

    ​
    Use Cases

    • Static Analysis - Analyze all code paths in a binary
    • Pattern Detection - Search for specific instruction sequences
    • Code Coverage - Map all executable code
    • Metrics Collection - Gather statistics about binary structure
    • IL Learning - Understand Binary Ninja’s IL representations

    Build docs developers (and LLMs) love

    Get started for freeTalk to us