data

name	data
description	Query Binary Ninja strings, bytes, and binary patterns. Use search_bytes() for native fast pattern search.
allowed-tools	["Bash","Read","Glob","Grep"]

Data (Strings, Bytes, Binary Pattern Search)

Tables and views

Surface	Description
strings	All discovered strings (content, length, address, type)
string_refs	Strings joined with the functions that reference them

SQL functions

Function	Description
search_bytes(pattern)	Find all matches; returns JSON array
search_bytes(pattern, start, end)	Search within an address range
search_first(pattern)	First match address (or NULL)
hex(val)	Format integer as hex

Byte reads via the bytes table

-- N bytes as uppercase hex
SELECT hex(blob_concat(value)) FROM (
  SELECT value FROM bytes WHERE start_address = X AND n = N ORDER BY address);

-- N bytes as BLOB
SELECT blob_concat(value) FROM (
  SELECT value FROM bytes WHERE start_address = X AND n = N ORDER BY address);

start_address and n are hidden input columns paired for bounded reads. start_address is deliberately distinct from the visible address column so any user predicate on address (e.g. inside a JOIN) stays enforceable by SQLite. Use the patches table for byte patching.

Pattern syntax (Binary Ninja native)

• "48 8B 05" — Exact bytes (hex, space-separated)
• "48 ?? 05" — ?? = any byte wildcard
• "4?" — ? = any nibble (matches 40–4F)
• "[regex]" — Regex patterns supported

Quick patterns

String search

-- Interesting strings
SELECT content, hex(address) AS addr
FROM strings
WHERE length > 10
ORDER BY length DESC
LIMIT 20;

-- Password-related
SELECT content, hex(address) AS addr
FROM strings
WHERE content LIKE '%password%';

String cross-references

SELECT s.content, hex(s.address) AS str_addr,
       sr.func_name, hex(sr.func_addr) AS func_addr
FROM string_refs sr
JOIN strings s ON s.address = sr.string_addr
WHERE s.content LIKE '%error%';

Binary pattern search

-- Find all RDTSC instructions (opcode: 0F 31)
SELECT search_bytes('0F 31');

-- Iterate matches
SELECT json_extract(value, '$.address') AS addr
FROM json_each(search_bytes('48 8B ?? 00'))
LIMIT 10;

-- First match only
SELECT printf('0x%X', search_first('CC CC CC'));

Functions containing a specific instruction

-- Count unique functions using RDTSC
SELECT COUNT(DISTINCT func_start(json_extract(value, '$.address'))) AS count
FROM json_each(search_bytes('0F 31'))
WHERE func_start(json_extract(value, '$.address')) IS NOT NULL;

-- List those functions
SELECT DISTINCT
    func_start(json_extract(value, '$.address')) AS func_ea,
    name_at(func_start(json_extract(value, '$.address'))) AS func_name
FROM json_each(search_bytes('0F 31'))
WHERE func_start(json_extract(value, '$.address')) IS NOT NULL;

This is much faster than scanning all disassembly lines:

• search_bytes() uses native BN binary search
• func_start() is O(1) lookup in the function index

Raw byte read

SELECT bytes(0x401000, 16);     -- "48 89 5C 24 08 48 89 ..."

Related skills

• xrefs for finding the call sites of functions that contain a found pattern
• disassembly for the surrounding instruction context (disasm(addr))