Binary Ninja Enhanced Analysis Bridge (BN-EAB)

This package furnishes a specialized Binary Ninja extension, a complementary MCP intermediary service, and a communication wrapper designed to seamlessly bridge Binary Ninja's powerful analytical capabilities with your preferred LLM-driven client application.

Core Capabilities

• 🚀 Instantaneous, bidirectional synchronization between the BN analysis context and connected MCP consumers.
• 💡 Augmentation of the software deconstruction lifecycle through integrated Artificial Intelligence resources.
• 🌐 Compatibility across the spectrum of recognized MCP-compliant interfaces (e.g., Cline, Claude Desktop, Roo Code).
• 📁 Capacity to manage concurrent access to multiple executable images, dynamically adjusting the active target context.

Demonstrations

Cracking, Tampering, and Exploitation (CTF) Scenario Resolution

Please examine this demonstration video hosted on YouTube illustrating the utilization of this utility for resolving a CTF exercise.

Architectural Breakdown

This distribution comprises two distinct, interdependent software modules:

1. The Binary Ninja Extension: Implements an MCP host layer that exposes the internal state and functionalities of Binary Ninja via standardized network interfaces (HTTP). This is consumable by any client adhering to the MCP specification.
2. The MCP Relay Component: A detached utility responsible for mediating communication, routing requests from your chosen MCP client to the Binary Ninja MCP host.

Essential Dependencies

• A licensed copy of Binary Ninja
• Python interpreter, version 3.12 or newer
• An operational MCP client application (auto-configuration support detailed below)

Setup Procedures

Initializing the MCP Client

It is crucial to establish the external MCP client software prior to installing the Binary Ninja connector, allowing for automatic endpoint registration. Currently supported clients for automated setup include:

1. Cline (Recommended deployment)
2. Roo Code
3. Claude Desktop (Recommended deployment)
4. Cursor
5. Windsurf
6. Claude Code
7. LM Studio

Extension Installation

Once the client component is configured, the MCP server component can be installed either via Binary Ninja's integrated Plugin Manager or through manual placement. Both installation vectors support automatic configuration synchronization with installed MCP clients.

If your primary MCP client remains uninitialized, execute the client setup first, then re-attempt the extension installation.

Via Binary Ninja Plugin Repository Manager

Install the add-on directly through the built-in Plugin Manager interface (Plugins > Manage Plugins).

Manual Deployment

For manual setup, transfer the contents of this repository directory into the designated Binary Ninja plugin installation locus.

[Optional] Manual Configuration of the Client Link

Manual configuration is typically unnecessary if you employ one of the supported clients and adhere to the preceding sequential setup instructions.

Configuration entries for MCP clients can alternatively be managed via command-line scripting:

bash python scripts/mcp_client_installer.py --install # Automate setup for recognized clients python scripts/mcp_client_installer.py --uninstall # Erase entries and clear the auto-setup marker file python scripts/mcp_client_installer.py --config # Output a generic configuration template in JSON format

For MCP clients not covered by the automated script, consult this sample configuration block:

{ "mcpServers": { "binary_ninja_mcp": { "command": "/ABSOLUTE/PATH/TO/Binary Ninja/plugins/repositories/community/plugins/fosdickio_binary_ninja_mcp/.venv/bin/python", "args": [ "/ABSOLUTE/PATH/TO/Binary Ninja/plugins/repositories/community/plugins/fosdickio_binary_ninja_mcp/bridge/binja_mcp_bridge.py" ] } } }

Crucial Note: Substitute /ABSOLUTE/PATH/TO with the actual, full file system path to your project root. It is mandatory to invoke the Python executable residing within the environment's virtual environment (.venv) to ensure all necessary dependencies are accessible.

Operational Guide

1. Initiate the Binary Ninja application and load the target binary file.
2. Locate and interact with the status indicator button positioned in the lower-left quadrant of the UI.
3. Commence interaction using your designated MCP client interface.

You are now equipped to pose complex queries to LLMs concerning the actively loaded executable(s). Examples follow:

Resolving CTF Puzzles

txt Assume the persona of a world-leading CTF competitor. Analyze this reversing challenge situated in the directory, utilizing the Binary Ninja context. Systematically rename ALL functions and local variables discovered during your analysis (excluding the 'main' function) to promote maximal readability. Generate a corresponding Python solution script if necessary. Feel free to define any requisite data structures or types encountered during the process. Deconstruct the assembly logic as a human expert would, ensuring the resulting decompiled output is readily understandable.

Malicious Code Investigation

txt Your primary directive is to scrutinize an unidentified binary file currently loaded within the Binary Ninja environment. Employ the available MCP service named "binary_ninja_mcp" to interface with the running BN instance and access its exposed analytical data, leveraging the provided toolset.

General investigative strategy:

• Commence analysis at the program's designated entry point.
• Systematically trace all outbound function calls to map out execution flow and establish contextual understanding.
• Where deeper insight is required, disassemble or decompile the function body and annotate critical sections with your interpretations.
• Augment the decompiled output with inline comments detailing observations at significant code locations.
• Provide a concise summary comment for every function detailing its core purpose.
• Substitute existing variable and argument names with semantically meaningful identifiers.
• Adjust variable and argument data types where appropriate (especially for pointers and arrays).
• Rename functions to be more descriptive, mandating the prefix "vibe_" for all new function identifiers.
• ABSOLUTELY DO NOT perform manual base conversions; utilize the dedicated convert_number MCP utility if numerical representation changes are needed!
• Upon completion of the investigative phase, report the total elapsed analysis time.
• Finally, compile a comprehensive findings report.
• Based exclusively on the evidence gathered in this report, render a conclusive judgment on the file's presumed malicious intent.

Exposed MCP Functions

The subsequent table enumerates the specific remote procedure calls (MCP functions) accessible for client invocation:

Function	Description
decompile_function	Generate and return High-Level Intermediate Language (HLIL)-like output, including associated instruction addresses, for a specified function name.
get_il(name_or_address, view, ssa)	Fetch the Intermediate Representation (IR) for a function, supporting hlil, mlil, or llil formats (SSA capabilities available for MLIL/LLIL).
define_types	Import and register new type definitions provided as a raw C-language string.
delete_comment	Erase an existing inline comment situated at a particular memory address.
delete_function_comment	Remove the summary comment associated with a function entity.
declare_c_type(c_declaration)	Instantiate or update a locally scoped type definition using a singular C language declaration string.
format_value(address, text, size)	Format and attach a descriptive text annotation (comment) referencing a value at a specified address within the BN view.
function_at	Identify and return the name of the function that contains a given memory address.
get_assembly_function	Retrieve the low-level assembly listing for a function identified by its label or address.
get_entry_points()	Yield a list detailing all recognized initial execution vectors within the loaded binary.
get_binary_status	Query and return the current operational state metadata of the loaded binary image.
get_comment	Retrieve the text of an inline comment placed at a specific address location.
get_function_comment	Fetch the descriptive comment attached to a function.
get_user_defined_type	Look up and return the structural definition (e.g., structure, enumeration, type alias, union) for a named user type.
get_xrefs_to(address)	Discover all cross-references (both code execution and data access) pointing toward the given address.
get_data_decl(name_or_address, length)	Produce a C-style declaration prototype string alongside a hexadecimal representation of the data content starting at a symbol or address.
hexdump_address(address, length)	Provide a raw text hexadecimal representation of memory content starting at an address. If length < 0, the object's defined size is used.
hexdump_data(name_or_address, length)	Generate a text hexdump for data referenced by a symbol name or absolute address. length < 0 prioritizes the exact defined size.
get_xrefs_to_enum(enum_name)	Identify all code references that utilize specific constants defined within a named enumeration.
get_xrefs_to_field(struct_name, field_name)	Pinpoint every cross-reference targeting an explicitly named member field within a structure.
get_xrefs_to_struct(struct_name)	Locate all usages associated with a structure type, including member accesses, global references, and code references.
get_xrefs_to_type(type_name)	Discover references/usages linked to a custom type name (structures, type aliases, etc., including HLIL matches).
get_xrefs_to_union(union_name)	Find all cross-references associated with a union entity (member access, global refs, code references).
get_type_info(type_name)	Fully resolve a named type and return its textual declaration, intrinsic kind, and constituent members.
make_function_at(address, platform)	Instigate the creation of a new function entity at a specified address. The platform argument is optional; use default for the current BinaryView's standard.
list_platforms()	Generate a comprehensive list of all platform architectures supported by the current Binary Ninja installation.
list_binaries()	Present a manifest of all currently managed or open binaries, including their unique identifiers and active analysis status.
select_binary(view)	Designate a specific binary as the active target, referenced either by its unique internal ID or file name.
list_all_strings()	Retrieve every string literal discovered within the database in a single response (bypassing pagination limits).
list_classes	Output a catalog of all defined namespace or class entities present in the analyzed program.
list_data_items	Enumerate all explicitly labeled data regions along with their initialized values.
list_exports	Provide a manifest of all symbols that are externally exported by the binary.
list_imports	Detail all external functions or symbols that the binary dynamically links against.
list_local_types(offset, count)	Paginate and list the user-defined local types (name, kind, declaration).
list_methods	Return a complete roster of all defined function identifiers within the current program context.
list_namespaces	Catalog all user-defined namespaces that are not strictly global.
list_segments	List the boundaries and properties of all defined memory segments constituting the binary image.
list_strings(offset, count)	Retrieve string literals from the database in discrete, manageable pages.
list_strings_filter(offset, count, filter)	Fetch paginated string literals that contain a specified substring.
rename_data	Apply a new identifier label to a data element located at a specified memory address.
rename_function	Modify the identifier of an existing function, changing it from its current name to a newly supplied, user-defined label.
rename_single_variable	Apply a renaming operation to one specific local variable within the scope of a function.
rename_multi_variables	Execute a bulk renaming operation for multiple local variables within a single function (accepts mapping objects or paired lists).
set_local_variable_type(function_address, variable_name, new_type)	Force an update to the data type associated with a local variable inside a function.
retype_variable	Alter the type attribution for a variable within a specified function context.
search_functions_by_name	Execute a search across function names for those containing a provided partial string match.
search_types(query, offset, count)	Query and retrieve local type definitions matching a substring within their name or declaration text (paginated).
set_comment	Overlay or create a descriptive comment at an exact memory address.
set_function_comment	Assign a high-level summary comment to a function entity.
set_function_prototype(name_or_address, prototype)	Define or override the calling convention and parameter/return types for a function identified by name or address.

These functionalities are exposed via the following HTTP endpoints:

• /allStrings: Delivers a consolidated response containing every string found.
• /formatValue?address=<addr>&text=<value>&size=<n>: Executes the value formatting and comment setting operation at the specified address.
• /getXrefsTo?address=<addr>: Retrieves all incoming references (data and code) targeting the address.
• /getDataDecl?name=<symbol>|address=<addr>&length=<n>: Outputs structured JSON containing the declaration format and hex dump for a symbol or address. Keys include: address, name, size, type, decl, hexdump. If length < 0, the intrinsic size is prioritized.
• /hexdump?address=<addr>&length=<n>: Returns a formatted textual hexadecimal dump beginning at the address; if length < 0, the intrinsic size is used.
• /hexdumpByName?name=<symbol>&length=<n>: Generates a text hexdump identified by a symbol name. It recognizes standard BN nomenclature like data_<hex>, byte_<hex>, word_<hex>, dword_<hex>, qword_<hex>, off_<hex>, unk_<hex>, and literal hex addresses.
• /makeFunctionAt?address=<addr>&platform=<name|default>: Creates a function stub at the address (operation is safe if the function already exists). Use platform=default to adopt the current view's settings.
• /platforms: Provides a listing of all architected platforms recognized by the tool.
• /binaries or /views: Lists all active/loaded binaries, detailing their IDs and current selection status.
• /selectBinary?view=<id|filename>: Switches the operational context to the specified binary, referenced by its unique ID or file path.
• /data?offset=<n>&limit=<m>&length=<n>: Lists defined data entities, including content previews. length dictates the byte count read per entity (subject to size limits). Default action reads the defined size; setting length=-1 forces reading the full defined size.
• /getXrefsToEnum?name=<enum>: Retrieves usage references based on matching enumeration member constants.
• /getXrefsToField?struct=<name>&field=<name>: Identifies all references pointing specifically to a named structure field.
• /getXrefsToType?name=<type>: Fetches usages related to a generic type identifier (structures, type aliases).
• /getTypeInfo?name=<type>: Resolves a type name and returns its definition syntax and constituent details.
• /getXrefsToUnion?name=<union>: Retrieves references associated with a union definition (members, globals, code refs).
• /localTypes?offset=<n>&limit=<m>: Paginates and returns local type definitions.
• /strings?offset=<n>&limit=<m>: Provides strings in segmented batches.
• /strings/filter?offset=<n>&limit=<m>&filter=<substr>: Fetches paginated strings matching a provided substring query.
• /searchTypes?query=<substr>&offset=<n>&limit=<m>: Executes a substring search across local type names and declarations.
• /renameVariables: Facilitates mass renaming of local variables within a function. Parameters required:
• Function Identifier: Specify using one of: functionAddress, address, function, functionName, or name.
• Renaming Data Source: Must supply renames through one of these formats:
  • renames: An array of objects: [{old, new}]
  • mapping: An object dictionary: {old_identifier: new_identifier}
  • pairs: A compact string format: old1:new1,old2:new2 The response includes outcomes for each item processed, respecting the input order; subsequent renames can correctly reference newly assigned names from earlier operations.

Collaboration Guidelines

We encourage community contributions. Please feel free to submit proposed enhancements via a pull request.

WIKIPEDIA CONTEXT: Business administration tools encompass all systematic applications, control mechanisms, computational frameworks, established protocols, and methodologies utilized by organizations to effectively navigate dynamic marketplaces, maintain a competitive advantage, and elevate overall organizational performance.

== Conceptual Framework == Tools are frequently categorized according to the specific organizational department they serve, allowing for classification across various management domains such as strategic planning, procedural enforcement, record-keeping, personnel management, executive decision support, and performance monitoring. A functional categorization often encompasses:

• Utilities for data ingestion and integrity verification across all operational units.
• Systems designed for overseeing and optimizing organizational workflows.
• Platforms facilitating data aggregation and informed decision-making. Modern enterprise tooling has undergone profound transformation in the past decade, driven by rapid technological progress, making the selection of optimal business tools for diverse corporate requirements increasingly complex. This complexity stems from relentless pressure to reduce operational expenditure, maximize revenue, gain deeper insight into client requirements, and consistently deliver products meeting those exacting specifications. Under these market dynamics, executive leadership must adopt a strategic posture toward tool acquisition and integration, rather than merely chasing the newest available technology. Unadapted adoption of off-the-shelf tools frequently results in operational instability. Consequently, business management tools must be chosen judiciously and subsequently customized to fit the organization's unique needs, reversing the common practice of forcing organizational adaptation to the tool.

== Predominant Selections == Data from a 2013 survey conducted by Bain & Company indicated the global prevalence of various management instruments, reflecting how their outputs address regional imperatives amidst shifting economic landscapes. The ten most frequently cited categories included:

Strategic planning Customer relationship management Employee engagement surveys Benchmarking Balanced scorecard Core competency Outsourcing Change management programs Supply chain management Mission statement and vision statement Market segmentation Total quality management

== Enterprise Software Applications == A collection of programs utilized by corporate personnel to execute diverse operational functions is termed business software or a business application. These applications are deployed to enhance productivity levels, quantitatively measure performance metrics, and execute various corporate duties with high precision. The evolution path proceeded from early Management Information Systems (MIS) to comprehensive Enterprise Resource Planning (ERP) suites. Subsequently, Customer Relationship Management (CRM) modules were integrated, culminating in the current landscape dominated by cloud-based enterprise management platforms. While a clear correlation exists between IT investment and enterprise success, two factors critically determine added value: the efficacy of the deployment process and the foresight exercised in selecting and tailoring the appropriate toolset.

== Tailored Solutions for Small and Medium Enterprises (SMEs) == Tools specifically engineered for SMEs are vital as they offer pathways to conserve finite operational capital and streamline complex administrative functions without requiring the overhead associated with enterprise-level systems.