disassembly

name	disassembly
description	Query Binary Ninja disassembly: functions, segments, instructions, blocks. Use for code-level analysis and instruction inspection.
allowed-tools	["Bash","Read","Glob","Grep"]

Disassembly

Query Binary Ninja's disassembly: functions, segments, basic blocks, and per-instruction rows.

Tables

Table	Description	Required filter
funcs	All detected functions	none
segments	Memory segments	none
blocks	Basic blocks inside functions	func_ea = X for perf
instructions	One row per instruction	func_addr = X for perf
entries	Entry points	none

Quick patterns

Top functions by size

SELECT hex(address) AS addr, name, size
FROM funcs
ORDER BY size DESC
LIMIT 10;

Segment layout

SELECT name, hex(start) AS start, hex(end) AS end,
       perm, class
FROM segments
ORDER BY start;

Basic-block CFG of one function

SELECT hex(start_ea) AS bb_start, hex(end_ea) AS bb_end
FROM blocks
WHERE func_ea = 0x401000
ORDER BY start_ea;

Disassembly listing

-- Single-address view
SELECT disasm(0x401000);

-- Per-instruction rows inside a function (constrained!)
SELECT hex(address) AS addr, mnemonic, operand
FROM instructions
WHERE func_addr = 0x401000
ORDER BY address;

Performance

instructions and blocks are high-cost when scanned unconstrained — they walk every function in the database. Always pass func_addr = X (instructions) or func_ea = X (blocks).

Related skills

• xrefs for call-graph and reference analysis (use the callers/callees views, not func_start())
• decompiler for HLIL pseudocode
• data for search_bytes() binary pattern search

Canonical reference

For exhaustive table column shapes and SQL function signatures, see prompts/bnsql_agent.md in the bnsql repo. Use PRAGMA table_xinfo(<table>) to confirm any column you're uncertain about.