Menú
Complete bnsql SQL function reference catalog.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Connect to Binary Ninja databases and bootstrap sessions. Use when starting analysis, routing to other skills, or setting up CLI/HTTP/MCP connections.
Query Binary Ninja strings, bytes, and binary patterns. Use search_bytes() for native fast pattern search.
BNSQL analysis workflows: triage, security audit, crypto/network detection, multi-table queries.
Edit Binary Ninja databases: comments, renames, types, patches. Mutations require SELECT save() to persist (explicit-save model, v0.0.9+).
Decompile Binary Ninja functions via HLIL: pseudocode text, local variables, call sites. Always filter by func_addr.
Query Binary Ninja disassembly: functions, segments, instructions, blocks. Use for code-level analysis and instruction inspection.
| name | functions |
| description | Complete bnsql SQL function reference catalog. |
| allowed-tools | ["Bash","Read","Glob","Grep"] |
Use SELECT name FROM pragma_function_list for the live function list. The
catalog below is canonical for v0.0.9 but verify against the runtime when in
doubt.
| Class | Cost | Examples | Use case |
|---|---|---|---|
| Fast (pure SQL) | µs | hex, printf, json_* | Anywhere |
| Moderate | ms | disasm(addr) | Small result sets |
| Slow (one BN API call per row) | ms × N | func_start, func_at, func_end, name_at, xrefs_to, xrefs_from | Single-address lookups only |
| Very slow (decompiles function) | seconds | decompile(addr) | Single function only |
Rule: Don't put slow UDFs inside bulk SELECTs over many rows. Use
pre-computed views (callers, callees) or pre-computed columns
(xrefs.from_func) instead.
| Function | Description |
|---|---|
disasm(addr) | Single-instruction disassembly text |
mnemonic(addr) | Instruction mnemonic only |
Byte reads use the bytes table:
SELECT hex(blob_concat(value)) FROM (SELECT value FROM bytes WHERE start_address = X AND n = N ORDER BY address)
(or blob_concat(value) for BLOB).
| Function | Description |
|---|---|
search_bytes(pattern) | All matches; returns JSON array |
search_bytes(pattern, start, end) | Search within range |
search_first(pattern) | First match address (or NULL) |
See the data skill for pattern syntax (?? wildcards, regex).
| Function | Description |
|---|---|
name_at(addr) | Name at address (or NULL) |
func_at(addr) | Function name containing address |
func_start(addr) | Start of containing function |
func_end(addr) | End of containing function |
func_qty() | Total function count |
func_at_index(n) | Function address at index n |
| Function | Description |
|---|---|
xrefs_to(addr) | JSON array of xrefs TO address |
xrefs_from(addr) | JSON array of xrefs FROM address |
For bulk xref work, query the xrefs table or callers / callees views
directly — these UDFs are for single-address lookups.
| Function | Description |
|---|---|
next_head(addr) | Next defined item |
prev_head(addr) | Previous defined item |
segment_at(addr) | Segment name at address |
| Function | Description |
|---|---|
comment_at(addr) | Get comment at address |
set_comment(addr, text) | Set comment (requires save() to persist) |
| Function | Description |
|---|---|
set_name(addr, name) | Set name at address |
save() | Persist in-memory edits to disk (explicit-save model) |
| Function | Description |
|---|---|
decompile(addr) | Full-function HLIL text |
decompile(addr, limit) | Limit-aware variant |
| Function | Description |
|---|---|
hex(val) | Format integer as hex string |
printf(fmt, ...) | Standard SQLite printf |
