PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Down Binary Ninja’s Low Level IL

blog.trailofbits.com | blog | #reverse-engineering | #binary-ninja | #python-api | #llil | #intermediate-representation | #dataflow-analysis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An intro to Binary Ninja's Low Level IL: its architecture-agnostic IR structure, how it powers register and stack dataflow analysis, and writing a simple recursive traversal via the Python API.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Devirtualizing C++ with Binary Ninja
A Binary Ninja plugin example resolves C++ virtual calls: LLIL finds vtable pointers in constructors, register assignments are tracked, and the vtable offset computed to jump to the target function.
blog · blog.trailofbits.com
“Unstripping” binaries: Restoring debugging information in GDB with Pwndbg
Trail of Bits extends Pwndbg with Binary Ninja integration—syncing symbols, signatures, and stack variables with decompilation—and Go type parsing to debug stripped binaries in GDB more like an IDE.
blog · blog.trailofbits.com
A Winter’s Tale: Improving messages and types in GDB’s Python API
A Trail of Bits associate describes work to speed up GDB and improve its Python API, covering parallel symbol loading, obstack internals, __repr__ methods, and types support benefiting Pwndbg.
blog · blog.trailofbits.com
MUI: Visualizing symbolic execution with Manticore and Binary Ninja
MUI pairs the Manticore symbolic execution engine with Binary Ninja's interface, making state exploration visual and interactive, with custom hooks to tame state explosion during analysis.
blog · blog.trailofbits.com
Revisiting 2000 cuts using Binary Ninja’s new decompiler
Four years after the original 2000 cuts post, the author revisits the challenge with Binary Ninja's new decompiler, showing how High Level IL shrinks 43 assembly instructions down to six.
blog · blog.trailofbits.com
Reverse Taint Analysis Using Binary Ninja
KRFAnalysis uses Binary Ninja's MLIL SSA form for reverse taint analysis, tracing crashes from the KRF syscall fault injection tool back to the responsible arguments and code paths.
Back