Menu
Complete bnsql SQL function reference catalog.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Connect to Binary Ninja databases and bootstrap sessions. Use when starting analysis, routing to other skills, or setting up CLI/HTTP/MCP connections.
Query Binary Ninja strings, bytes, and binary patterns. Use search_bytes() for native fast pattern search.
BNSQL analysis workflows: triage, security audit, crypto/network detection, multi-table queries.
Edit Binary Ninja databases: comments, renames, types, patches. Mutations require SELECT save() to persist (explicit-save model, v0.0.9+).
Decompile Binary Ninja functions via HLIL: pseudocode text, local variables, call sites. Always filter by func_addr.
Query Binary Ninja disassembly: functions, segments, instructions, blocks. Use for code-level analysis and instruction inspection.
| name | functions |
| description | Complete bnsql SQL function reference catalog. |
| allowed-tools | ["Bash","Read","Glob","Grep"] |
Use SELECT name FROM pragma_function_list for the live function list. The
catalog below is canonical for v0.0.9 but verify against the runtime when in
doubt.
| Class | Cost | Examples | Use case |
|---|---|---|---|
| Fast (pure SQL) | µs | hex, printf, json_* | Anywhere |
| Moderate | ms | disasm(addr) | Small result sets |
| Slow (one BN API call per row) | ms × N | func_start, func_at, func_end, name_at, xrefs_to, xrefs_from | Single-address lookups only |
| Very slow (decompiles function) | seconds | decompile(addr) | Single function only |
Rule: Don't put slow UDFs inside bulk SELECTs over many rows. Use
pre-computed views (callers, callees) or pre-computed columns
(xrefs.from_func) instead.
| Function | Description |
|---|---|
disasm(addr) | Single-instruction disassembly text |
mnemonic(addr) | Instruction mnemonic only |
Byte reads use the bytes table:
SELECT hex(blob_concat(value)) FROM (SELECT value FROM bytes WHERE start_address = X AND n = N ORDER BY address)
(or blob_concat(value) for BLOB).
| Function | Description |
|---|---|
search_bytes(pattern) | All matches; returns JSON array |
search_bytes(pattern, start, end) | Search within range |
search_first(pattern) | First match address (or NULL) |
See the data skill for pattern syntax (?? wildcards, regex).
| Function | Description |
|---|---|
name_at(addr) | Name at address (or NULL) |
func_at(addr) | Function name containing address |
func_start(addr) | Start of containing function |
func_end(addr) | End of containing function |
func_qty() | Total function count |
func_at_index(n) | Function address at index n |
| Function | Description |
|---|---|
xrefs_to(addr) | JSON array of xrefs TO address |
xrefs_from(addr) | JSON array of xrefs FROM address |
For bulk xref work, query the xrefs table or callers / callees views
directly — these UDFs are for single-address lookups.
| Function | Description |
|---|---|
next_head(addr) | Next defined item |
prev_head(addr) | Previous defined item |
segment_at(addr) | Segment name at address |
| Function | Description |
|---|---|
comment_at(addr) | Get comment at address |
set_comment(addr, text) | Set comment (requires save() to persist) |
| Function | Description |
|---|---|
set_name(addr, name) | Set name at address |
save() | Persist in-memory edits to disk (explicit-save model) |
| Function | Description |
|---|---|
decompile(addr) | Full-function HLIL text |
decompile(addr, limit) | Limit-aware variant |
| Function | Description |
|---|---|
hex(val) | Format integer as hex string |
printf(fmt, ...) | Standard SQLite printf |
