Quickstart

This quickstart guide will get you analyzing binaries in minutes using the Binary Ninja API.

Choose your language

Python
C++
Rust

Python quickstart

Python is the fastest way to get started with the Binary Ninja API.

Set up Python path

Add Binary Ninja’s Python API to your PYTHONPATH:

macOS

export PYTHONPATH="/Applications/Binary Ninja.app/Contents/Resources/python"

Linux

export PYTHONPATH="$HOME/binaryninja/python"

Windows

set PYTHONPATH=C:\Program Files\Vector35\BinaryNinja\python

Write your first script

Create analyze.py:

analyze.py

from binaryninja import BinaryViewType

# Load a binary
bv = BinaryViewType.get_view_of_file("/bin/ls")

print(f"Analyzing: {bv.file.filename}")
print(f"Architecture: {bv.arch.name}")
print(f"Entry point: {hex(bv.entry_point)}")

# List functions
print(f"\nFound {len(bv.functions)} functions:")
for func in list(bv.functions)[:5]:
    print(f"  {hex(func.start)}: {func.name}")

# Find strings
print(f"\nStrings ({len(bv.strings)} total):")
for string in list(bv.strings)[:5]:
    print(f"  {hex(string.start)}: {string.value!r}")

Run it

python analyze.py

Output:

Analyzing: ls
Architecture: x86_64
Entry point: 0x100001b40

Found 157 functions:
  0x100001b40: _start
  0x100001b68: entry
  0x100002f90: _main
  ...

For headless operation outside the GUI, you need a license with headless support.

C++ quickstart

Clone the API

git clone https://github.com/Vector35/binaryninja-api.git
cd binaryninja-api
git submodule update --init --recursive

Build the API

cmake -S . -B build -DBN_API_BUILD_EXAMPLES=ON
cmake --build build -j8

If Binary Ninja is not in the default location, add: -DBN_INSTALL_DIR=/path/to/binaryninja

Write a program

Create analyze.cpp:

analyze.cpp

#include "binaryninjaapi.h"
using namespace BinaryNinja;

int main(int argc, char** argv) {
    if (argc != 2) {
        printf("Usage: %s <binary>\\n", argv[0]);
        return 1;
    }

    // Load binary
    Ref<BinaryData> bd = new BinaryData(new FileMetadata(), argv[1]);
    Ref<BinaryView> bv = bd->GetViewOfType("ELF");  // or "PE", "Mach-O"

    if (!bv) {
        printf("Failed to load binary\\n");
        return 1;
    }

    printf("Analyzing: %s\\n", bv->GetFile()->GetFilename().c_str());
    printf("Architecture: %s\\n", bv->GetDefaultArchitecture()->GetName().c_str());

    // List functions
    auto functions = bv->GetAnalysisFunctionList();
    printf("\\nFunctions: %zu\\n", functions.size());
    for (size_t i = 0; i < std::min(functions.size(), (size_t)5); i++) {
        auto func = functions[i];
        printf("  %llx: %s\\n", func->GetStart(), 
            func->GetSymbol()->GetFullName().c_str());
    }

    return 0;
}

Compile and run

g++ analyze.cpp -o analyze \\
  -I binaryninja-api \\
  -L /Applications/Binary\\ Ninja.app/Contents/MacOS \\
  -lbinaryninjacore \\
  -std=c++17

./analyze /bin/ls

Rust quickstart

Create a new project

cargo new bn-analyze
cd bn-analyze

Add dependencies

Edit Cargo.toml:

Cargo.toml

[dependencies]
binaryninja = { git = "https://github.com/Vector35/binaryninja-api.git", branch = "dev" }
binaryninjacore-sys = { git = "https://github.com/Vector35/binaryninja-api.git", branch = "dev" }

Create build.rs:

build.rs

fn main() {
    let link_path = std::env::var_os("DEP_BINARYNINJACORE_PATH")
        .expect("DEP_BINARYNINJACORE_PATH not specified");
    
    println!("cargo::rustc-link-lib=dylib=binaryninjacore");
    println!("cargo::rustc-link-search={}", link_path.to_str().unwrap());
    
    #[cfg(target_os = "linux")]
    {
        println!("cargo::rustc-link-arg=-Wl,-rpath,{0},-L{0}",
            link_path.to_string_lossy());
    }
}

Write the code

Edit src/main.rs:

src/main.rs

use binaryninja::headless::Session;
use binaryninja::binary_view::{BinaryViewBase, BinaryViewExt};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let session = Session::new()?;
    let bv = session.load("/bin/ls")?;

    println!("File: {}", bv.file().filename());
    println!("Arch: {}", bv.arch().name());
    println!("Functions: {}", bv.functions().len());

    println!("\nFirst 5 functions:");
    for func in bv.functions().iter().take(5) {
        println!("  {:#x}: {}", 
            func.start(), 
            func.symbol().full_name()
        );
    }

    Ok(())
}

Run it

cargo run --release

Next steps

Core concepts

Learn about binary views, architectures, and IL

Examples

See complete examples and patterns

Plugin development

Create plugins to extend Binary Ninja

API reference

Explore the complete API documentation

Common patterns

Iterate through all instructions

for func in bv.functions:
    for block in func.basic_blocks:
        for instr in block:
            print(f"{hex(instr[0])}: {instr[1]}")

Find function calls

for func in bv.functions:
    for ref in func.call_sites:
        print(f"{hex(ref.address)}: calls {ref.function.name}")

Analyze IL

func = bv.get_function_at(0x1000)
for block in func.hlil:
    for instr in block:
        print(instr)

Export decompiled code

for func in bv.functions:
    if func.hlil:
        print(f"// {func.name}")
        for line in func.hlil.root.lines:
            print(line)

Getting Started

Core Concepts

Plugin Development

Guides

Choose your language

Python quickstart

C++ quickstart

Rust quickstart

Next steps

Core concepts

Examples

Plugin development

API reference

Common patterns

Build docs developers (and LLMs) love

Getting Started

Core Concepts

Plugin Development

Guides

​Choose your language

​Python quickstart

​C++ quickstart

​Rust quickstart

​Next steps

Core concepts

Examples

Plugin development

API reference

​Common patterns

Build docs developers (and LLMs) love

Choose your language

Python quickstart

C++ quickstart

Rust quickstart

Next steps

Common patterns