0xeb

Analyze binaries with ghidrasql using safe, high-signal query patterns.

Apply persistent ghidrasql annotations such as names, comments, signatures, and local-variable edits.

Connect to ghidrasql sources, verify live access, and route to the right analysis skill.

Query strings, bytes, data items, memory blocks, and relocations through ghidrasql.

Manage breakpoints and patch bytes through ghidrasql — the breakpoints table and bytes single-byte UPDATE.

Decompile functions with ghidrasql and work with pseudocode, locals, parameters, and ctree pattern views safely.

Inspect code structure through ghidrasql tables for functions, instructions, blocks, CFG, loops, switches, dominators, and tail calls.

Reference ghidrasql SQL functions and choose the right helper for a task.

Connect to Binary Ninja databases and bootstrap sessions. Use when starting analysis, routing to other skills, or setting up CLI/HTTP/MCP connections.

Query Binary Ninja strings, bytes, and binary patterns. Use search_bytes() for native fast pattern search.

Complete bnsql SQL function reference catalog.

BNSQL analysis workflows: triage, security audit, crypto/network detection, multi-table queries.

Edit Binary Ninja databases: comments, renames, types, patches. Mutations require SELECT save() to persist (explicit-save model, v0.0.9+).

Decompile Binary Ninja functions via HLIL: pseudocode text, local variables, call sites. Always filter by func_addr.

Query Binary Ninja disassembly: functions, segments, instructions, blocks. Use for code-level analysis and instruction inspection.

Binary Ninja type system via SQL: structs, unions, enums, typedefs, function signatures. All writable; remember SELECT save().