summaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
authorJordan Wiens <github@psifertex.com>2026-05-27 14:55:28 -0400
committerJordan Wiens <github@psifertex.com>2026-05-27 14:55:28 -0400
commit162b406ea28aa5bacc34a00745d8780bcbf58753 (patch)
tree39802866489bd352c54599024e24ee346b44cd35 /docs
parentf2ae12d97604da6136b26c184eb7fe30531b4d5e (diff)
add better syntax highlighting for code blocks
Diffstat (limited to 'docs')
-rw-r--r--docs/about/index.md2
-rw-r--r--docs/dev/batch.md6
-rw-r--r--docs/dev/bnil-hlil.md2
-rw-r--r--docs/dev/bnil-llil.md32
-rw-r--r--docs/dev/bnil-mlil.md28
-rw-r--r--docs/dev/bnil-modifying.md8
-rw-r--r--docs/dev/bnil-overview.md10
-rw-r--r--docs/dev/concepts.md4
-rw-r--r--docs/dev/documentation.md16
-rw-r--r--docs/dev/flags.md30
-rw-r--r--docs/dev/plugins.md240
-rw-r--r--docs/dev/typelibraries.md24
-rw-r--r--docs/dev/workflows.md2
-rw-r--r--docs/guide/efiresolver.md2
-rw-r--r--docs/guide/index.md6
-rw-r--r--docs/guide/plugins.md2
-rw-r--r--docs/guide/troubleshooting.md8
-rw-r--r--docs/guide/types/platformtypes.md6
-rw-r--r--docs/guide/types/typeimportexport.md118
-rw-r--r--docs/guide/types/typelibraries.md6
20 files changed, 298 insertions, 254 deletions
diff --git a/docs/about/index.md b/docs/about/index.md
index 3893082c..7bdf898e 100644
--- a/docs/about/index.md
+++ b/docs/about/index.md
@@ -8,7 +8,7 @@ For details on what network requests Binary Ninja makes and how to control them,
Vector 35 (Officially, Vector 35 Inc) is a Delaware C Corp with their primary office in Melbourne, FL and a mailing address of:
-```
+```text
Vector 35
PO Box 971
Melbourne, FL 32902-0971
diff --git a/docs/dev/batch.md b/docs/dev/batch.md
index f983a726..a7b6334c 100644
--- a/docs/dev/batch.md
+++ b/docs/dev/batch.md
@@ -15,7 +15,7 @@ While MacOS, Linux, and Windows all ship with python interpreters, those are onl
First, make sure to run the [install_api.py](https://github.com/Vector35/binaryninja-api/tree/dev/scripts) script. Note that the script is shipped with Binary Ninja already, just look in your [binary path](../guide/index.md#binary-path) inside of the `scripts` subfolder. Run it like:
-```
+```bash
python3 ~/binaryninja/scripts/install_api.py
```
@@ -38,7 +38,7 @@ with binaryninja.load("/bin/ls") as bv:
If we run it, we'll see:
-```
+```bash
$ ./first.py
Opening /bin/ls which has 128 functions
```
@@ -73,7 +73,7 @@ for bin in glob("/bin/*"):
Now let's run it and notice it's fast enough to parse all of `/bin/*` in just a few seconds:
-```
+```bash
$ ./glob.py
Opening /bin/cat which has 11 functions
Opening /bin/echo which has 2 functions
diff --git a/docs/dev/bnil-hlil.md b/docs/dev/bnil-hlil.md
index 7443f192..03447eab 100644
--- a/docs/dev/bnil-hlil.md
+++ b/docs/dev/bnil-hlil.md
@@ -27,7 +27,7 @@ To observe the transformations that occur from MLIL to HLIL, you can use the bui
The instruction set is made up of [`HighLevelILInstruction`](https://api.binary.ninja/binaryninja.highlevelil-module.html#binaryninja.highlevelil.HighLevelILInstruction) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an HLIL instruction:+
-```
+```pycon
>>> current_il_instruction
<HighLevelILVarInit: uint64_t rax_2 = zx.q(rax_1 - 0x6c)>
>>> type(current_il_instruction)
diff --git a/docs/dev/bnil-llil.md b/docs/dev/bnil-llil.md
index 2ac1e77f..5509151e 100644
--- a/docs/dev/bnil-llil.md
+++ b/docs/dev/bnil-llil.md
@@ -21,7 +21,7 @@ Since doing is the easiest way to learn let's start with a simple example binary
Next, enter the following in the console:
-```
+```pycon
>>> for block in current_function.low_level_il:
... for instr in block:
... print (instr.address, instr.instr_index, instr)
@@ -43,7 +43,7 @@ Finally, we can print out the attributes of the instruction. We first print out
In python, iterating over a class is a distinct operation from subscripting. This separation is used in the `LowLevelILFunction` class. If you iterate over a `LowLevelILFunction` you get a list of `LowLevelILBasicBlocks`, however if you subscript a `LowLevelILFunction` you actually get the `LowLevelILInstruction` whose `instr_index` corresponds to the subscript:
-```
+```pycon
>>> list(current_function.low_level_il)
[<block: x86_64@0x0-0x3f>, <block: x86_64@0x3f-0x45>, <block: x86_64@0x45-0x47>,
<block: x86_64@0x47-0x53>, <block: x86_64@0x53-0x57>, <block: x86_64@0x57-0x5a>]
@@ -56,13 +56,13 @@ In python, iterating over a class is a distinct operation from subscripting. Thi
## Low Level IL Instructions
Now that we've established how to access LLIL Functions, Blocks, and Instructions, let's focus in on the instructions themselves. LLIL instructions are infinite length and structured as an expression tree. An expression tree means that instruction operands can be composed of operation. Thus, we can have an IL instruction like this:
-```
+```text
eax = eax + ecx * 4
```
The tree for such an instruction would look like:
-```
+```text
=
/ \
eax +
@@ -75,7 +75,7 @@ There are quite a few reasons that we chose to use expression trees that we won'
Now let's get back to the examples. First let's pick an instruction to work with:
-```
+```pycon
>>> instr = current_function.low_level_il[2]
>>> instr
<il: rsp = rsp - 0x110>
@@ -85,63 +85,63 @@ For the above instruction, we have a few operations we can perform:
* **address** - returns the virtual address
-```
+```pycon
>>> hex(instr.address)
'0x40084aL'
```
* **function** - returns the containing function
-```
+```pycon
>>> instr.function
<binaryninja.lowlevelil.LowLevelILFunction object at 0x111c79810>
```
* **instr_index** - returns the LLIL index
-```
+```pycon
>>> instr.instr_index
2
```
* **operands** - returns a list of all operands.
-```
+```pycon
>>> instr.operands
['rsp', <il: rsp - 0x110>]
```
* **operation** - returns the enumeration value of the current operation
-```
+```pycon
>>> instr.operation
<LowLevelILOperation.LLIL_SET_REG: 1>
```
* **src** - returns the source operand
-```
+```pycon
>>> instr.src
<il: rsp - 0x110>
```
* **dest** - returns the destination operand
-```
+```pycon
>>> instr.dest
'rsp'
```
* **size** - returns the size of the operation in bytes (in this case we have an 8 byte assignment)
-```
+```pycon
>>> instr.size
8L
```
Now with some knowledge of the `LowLevelIL` class let's try to do something with it. Let's say our goal is to find all the times the register `rdx` is written to in the current function. This code is straight forward:
-```
+```pycon
>>> for block in current_function.low_level_il:
... for instr in block:
... if instr.operation == LowLevelILOperation.LLIL_SET_REG and instr.dest.name == 'rdx':
@@ -187,14 +187,14 @@ Control flow transferring- and comparison instructions are straightforward enoug
Labels function much like they do in C code. They can be put anywhere in the emitted IL and serve as a destination for the `if` and `goto` instructions. Labels are required because one assembly language instruction can translate to multiple IL instructions, and you need to be able to branch to any of the emitted IL instructions. Let's consider the following x86 instruction `cmove` (Conditional move if equal flag is set):
-```
+```nasm
test eax, eax
cmove eax, ebx
```
To translate this instruction to IL we have to first create true and false labels. Then we emit the `if` instruction, passing it the proper conditional and labels. Next we emit the true label, then we emit the set register instruction and a goto false label instruction. This results in the following output:
-```
+```text
0 @ 00000002 if (eax == 0) then 1 else 3
1 @ 00000002 eax = ebx
2 @ 00000002 goto 3
diff --git a/docs/dev/bnil-mlil.md b/docs/dev/bnil-mlil.md
index 15fb836d..51028131 100644
--- a/docs/dev/bnil-mlil.md
+++ b/docs/dev/bnil-mlil.md
@@ -25,7 +25,7 @@ In the rest of this article we will explore the variable object, the type object
First, it's important to understand what we mean when we talk about a MLIL variable. Continuing from our example above we can get a [`Variable`](https://api.binary.ninja/binaryninja.variable-module.html#binaryninja.variable.Variable) object.
-```
+```pycon
>>> inst.output
[<var int64_t rax>]
>>> var = inst.output[0]
@@ -41,7 +41,7 @@ So let's look at the properties available on a [`Variable`](https://api.binary.n
The `source_type` represents the storage location type and can be one of the following :
-```
+```c
enum VariableSourceType
{
StackVariableSourceType,
@@ -51,7 +51,7 @@ enum VariableSourceType
```
-```
+```pycon
>>> var.source_type
<VariableSourceType.RegisterVariableSourceType: 1>
```
@@ -60,7 +60,7 @@ enum VariableSourceType
The `storage` property changes meaning depending on the [`VariableSourceType`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.VariableSourceType). When a variable is of type `RegisterVariableSourceType`, its `storage` property represents the index into the register list for the given architecture. If the `source_type` is `StackVariableSourceType`, its `storage` property represents the stack offset of the variable.
-```
+```pycon
>>> var
<var int64_t rax>
>>> var.source_type
@@ -84,7 +84,7 @@ The `index` is an identifier chosen to be unique across different analysis passe
The `type` property returns the `Type` object associated with the variable:
-```
+```pycon
>>> var.type
<type: int64_t, 0% confidence>
```
@@ -96,7 +96,7 @@ Type objects are described in detail in the next section.
Type objects are very similar to standard C types. A Type object's type can be determined through the object’s `type_class` property. Valid types are in the [`TypeClass`](https://api.binary.ninja/binaryninja.enums-module.html#binaryninja.enums.TypeClass) enumeration:
-```
+```c
enum TypeClass
{
VoidTypeClass = 0,
@@ -129,7 +129,7 @@ A boolean type is an integer which has a value of False (0) or True (!0).
An integer type has a sign, a width (in bytes), and a display type. The display type determines how the integer should be displayed; the options are self-explanatory:
-```
+```c
enum IntegerDisplayType
{
DefaultIntegerDisplayType,
@@ -202,7 +202,7 @@ Structure types are simple in principle but are complicated by the need for them
NamedTypeReference types are symbolic references to other types. They function much like a C `typedef` (i.e. Name X corresponds to type Y). The NamedTypeReference has a `type_class` property describing what sort of type it is pointing at.
-```
+```c
enum NamedTypeReferenceClass
{
UnknownNamedTypeClass = 0,
@@ -220,7 +220,7 @@ Most of the above should be self-explanatory except for the `UnknownNamedTypeCla
The instruction set is made up of [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) objects. Let's start exploring by using the python console to poke around at some instructions. Open up a binary in Binary Ninja and retrieve an MLIL instruction:
-```
+```pycon
>>> inst = current_mlil[8]
<il: rax = 0x402cb0("PORT")>
>>> type(inst)
@@ -231,27 +231,27 @@ The instruction set is made up of [`MediumLevelILInstruction`](https://api.binar
There are a number of properties that can be queried on the [`MediumLevelILInstruction`](https://api.binary.ninja/binaryninja.mediumlevelil-module.html#binaryninja.mediumlevelil.MediumLevelILInstruction) object, and the validity of these properties changes depending on what the current operation is. If we look at the `operation` of `inst` we can see it is a `MLIL_CALL` instruction.
-```
+```pycon
>>> inst.operation
<MediumLevelILOperation.MLIL_CALL: 51>
```
From the code in [`mediumlevelil.py`](https://github.com/Vector35/binaryninja-api/blob/dev/python/mediumlevelil.py#L175) we can see that the `MLIL_CALL` operation has three properties in addition to the operations available to all `MediumLevelILInstruction` objects
-```
+```text
MediumLevelILOperation.MLIL_CALL: [("output", "var_list"), ("dest", "expr"), ("params", "expr_list")],
```
Thus, we can query the call's `output` which is a list of variables:
-```
+```pycon
>>> inst.output
[<var int64_t rax>]
```
The call's `dest` (destination expression) which in this case is a `MLIL_CONST_PTR`:
-```
+```pycon
>>> inst.dest
<il: 0x402cb0>
>>> inst.dest.operation
@@ -264,7 +264,7 @@ The call's `dest` (destination expression) which in this case is a `MLIL_CONST_P
The parameter list can be accessed through the `params` property:
-```
+```pycon
>>> inst.params
[<il: "PORT">]
>>> inst.params[0]
diff --git a/docs/dev/bnil-modifying.md b/docs/dev/bnil-modifying.md
index bcd02b5b..47900708 100644
--- a/docs/dev/bnil-modifying.md
+++ b/docs/dev/bnil-modifying.md
@@ -590,7 +590,7 @@ In addition, it applies to Find In Text results, so you can enable Show IL Opcod
**Show IL Opcodes off:**
-```
+```text
10 @ 1400553e7 bool rcx = temp0 s< 0x12817497a9ff848a
11 @ 1400553f1 uint32_t rdx_1 = zx.d(rcx)
12 @ 1400553f4 uint32_t rdx_2 = rdx_1 << 3
@@ -600,7 +600,7 @@ In addition, it applies to Find In Text results, so you can enable Show IL Opcod
**Show IL Opcodes on:**
-```
+```text
10 @ 1400553e7 (MLIL_SET_VAR.b bool rcx = (MLIL_CMP_SLT.q (MLIL_VAR.q temp0) s< (MLIL_CONST.q 0x12817497a9ff848a)))
11 @ 1400553f1 (MLIL_SET_VAR.d uint32_t rdx_1 = (MLIL_ZX.d zx.d((MLIL_VAR.b rcx))))
12 @ 1400553f4 (MLIL_SET_VAR.d uint32_t rdx_2 = (MLIL_LSL.d (MLIL_VAR.d rdx_1) << (MLIL_CONST.d 3)))
@@ -614,7 +614,7 @@ When you need to inspect a particular expression in a given IL function, it can
If you have the UI open, you can skip traversing the entire IL tree and simply click the expression of interest.
From there, you can use `current_il_expr` in the Python console to interact with that expression directly.
-```
+```pycon
# Clicking the `s<` token...
>>> current_il_expr
<MediumLevelILCmpSlt: temp0 s< 0x12817497a9ff848a>
@@ -632,7 +632,7 @@ From there, you can use `current_il_expr` in the Python console to interact with
Compare this to `current_il_instruction`, which only gives you the top-level instruction:
-```
+```pycon
# Clicking the `rdx_1` token...
>>> current_il_instruction
<MediumLevelILSetVar: rdx_2 = rdx_1 << 3>
diff --git a/docs/dev/bnil-overview.md b/docs/dev/bnil-overview.md
index df0447ea..a43c4a27 100644
--- a/docs/dev/bnil-overview.md
+++ b/docs/dev/bnil-overview.md
@@ -44,7 +44,7 @@ Besides the typical `&&` bitwise operators, BNIL makes use of `sx` and `zx` to i
Expressions in BNIL can have one of the following suffixes to indicate a size:
-```
+```text
.q -- Qword (8 bytes)
.d -- Dword (4 bytes)
.w -- Word (2 bytes)
@@ -53,7 +53,7 @@ Expressions in BNIL can have one of the following suffixes to indicate a size:
Note that floating point IL instructions have their own possible size suffixes:
-```
+```text
.h -- Half (2 bytes)
.s -- Single (4 bytes)
.d -- Double (8 bytes)
@@ -63,7 +63,7 @@ Note that floating point IL instructions have their own possible size suffixes:
Additionally, floating point IL operations are indicated with a prefixed `f`, like:
-```
+```text
f* -- Floating-point multiplication
f/ -- Floating-point division
f+ -- Floating-point addition
@@ -89,7 +89,7 @@ A number of macros are used to simplify output when rendering IL where no standa
So putting all that together, if you were to see the following in an IL expression:
-```
+```text
sx.q(rax_2:0.d)
```
@@ -103,7 +103,7 @@ When you want to use the API to access BNIL instructions, here are a few tips th
So for example, if you want to try to determine whether a given instruction is a Call (which includes syscalls) you can use:
-```
+```python
for h in current_hlil.instructions:
if isinstance(h, Call):
print(f"{str(h)} is a Call of some sort")
diff --git a/docs/dev/concepts.md b/docs/dev/concepts.md
index 14756160..b1ca9687 100644
--- a/docs/dev/concepts.md
+++ b/docs/dev/concepts.md
@@ -26,7 +26,7 @@ Some BinaryViews have parent views. The view used for decompilation includes mem
When you're interacting with the Binary Ninja [scripting console](../guide/index.md#script-python-console), it's important to realize that every time you run a command, the UI is automatically going to update analysis. You can see this by even running a simple command like:
-```
+```python
print("test")
```
@@ -238,7 +238,7 @@ Summing up the basic blocks of a function is one way to produce a consistent siz
In Binary Ninja, there is no explicit `.size` property of functions. Rather, you can choose to calculate it one of two ways:
-```
+```python
function_size = current_function.total_bytes
# or
function_size = current_function.highest_address - current_function.lowest_address
diff --git a/docs/dev/documentation.md b/docs/dev/documentation.md
index 74129884..75817f16 100644
--- a/docs/dev/documentation.md
+++ b/docs/dev/documentation.md
@@ -14,13 +14,15 @@ To contribute to the Binary Ninja documentation, first sign the [contribution li
## Building
- git clone https://github.com/Vector35/binaryninja-api/
- cd binaryninja-api
- properdocs build
- echo User documentation available in site/
- cd api-docs
- make html
- echo API documentation available in build/html
+```bash
+git clone https://github.com/Vector35/binaryninja-api/
+cd binaryninja-api
+properdocs build
+echo User documentation available in site/
+cd api-docs
+make html
+echo API documentation available in build/html
+```
## Changing
Changing documentation for the API itself is fairly straightforward. Use [doxygen style comment blocks](https://www.doxygen.nl/manual/docblocks.html) in C++ and C, and [restructured text blocks](https://sphinx-tutorial.readthedocs.io/step-1/) for python for the source. The user documentation is located in the `api/docs/` folder and the API documentation is generated from the config in the `api/api-docs` folder.
diff --git a/docs/dev/flags.md b/docs/dev/flags.md
index 7bede18d..800a09c0 100644
--- a/docs/dev/flags.md
+++ b/docs/dev/flags.md
@@ -20,7 +20,7 @@ Instructions like JXX glance at the flagmen for permission to jump.
Analysis would be _really_ complicated by tracking a "remote thread" like this, in addition to the normal instruction stream. So another approach is to insert the flag logic _into_ the instruction stream:
-```
+```text
...
SUB a, b, c
flag_s = ...
@@ -39,7 +39,7 @@ But this is about basics! So what are the basic ways in which an architecture au
### 1) declare the flags
-```
+```python
flags = ['s', 'z', 'h', 'pv', 'n', 'c']
```
@@ -47,14 +47,16 @@ That's simple, it's just a list of strings.
### 2) assign flag Roles
- flag_roles = {
- 's': FlagRole.NegativeSignFlagRole,
- 'z': FlagRole.ZeroFlagRole,
- 'h': FlagRole.HalfCarryFlagRole,
- 'pv': FlagRole.SpecialFlagRole,
- 'n': FlagRole.NegativeSignFlagRole,
- 'c': FlagRole.CarryFlagRole
- }
+```python
+flag_roles = {
+ 's': FlagRole.NegativeSignFlagRole,
+ 'z': FlagRole.ZeroFlagRole,
+ 'h': FlagRole.HalfCarryFlagRole,
+ 'pv': FlagRole.SpecialFlagRole,
+ 'n': FlagRole.NegativeSignFlagRole,
+ 'c': FlagRole.CarryFlagRole
+}
+```
Map each flag to a role from [api/python/enum.py](https://api.binary.ninja/_modules/binaryninja/enums.html) if possible. This informs Binary Ninja to generate IL for the basic, textbook behavior of a flag. For example, the `ZeroFlagRole` will generate IL that sets the flag when an arithmetic result is zero.
@@ -126,7 +128,7 @@ Recap: the C function is named `add()` which will produce a Z80 instruction `ADD
Binary Ninja gives this LLIL, after compilation with [SDCC](http://sdcc.sourceforge.net):
-```
+```text
_add:
0 @ 0000020e HL = 3
1 @ 00000211 HL = HL + SP {arg2}
@@ -155,7 +157,7 @@ unsigned int add(unsigned int a, unsigned int b)
Since the Z80 ALU only adds 8-bit ints, multi-byte adds are synthesized with an initial `ADD`, followed by runs of `ADC`. Here's the new IL:
-```
+```text
_add:
0 @ 0000020e HL = 4
1 @ 00000211 HL = HL + SP {arg3}
@@ -197,7 +199,7 @@ With the defined variables and lifted IL, Binary Ninja decides when to generate
The previous sections said that flag roles were the textbook behavior of flags. If you can assign a flag to a role, there's a chance Binary Ninja will have that default behavior and you won't have to implement it yourself. For example, the carry flag is so common among architectures and its behavior is (to my knowledge) non-varying during addition, that we have it hard-coded into Binary Ninja:
-```
+```text
5 @ 0000021b temp0.b = A
6 @ 0000021b temp1.b = [HL {arg3}].b
7 @ 0000021b A = A + [HL {arg3}].b
@@ -224,7 +226,7 @@ So for any instructions that are not ADD, ADC, SUB, NEG, or FSUB, you can try an
What happens when you mark an instruction the producer of a certain flag, but no implementation exists?
-```
+```text
12 @ 0000029e A = sbb.b(temp1.b, D, flag:c)
13 @ 0000029e flag:s = sbb.b(temp1.b, D, flag:c) s< 0
14 @ 0000029e flag:pv = unimplemented
diff --git a/docs/dev/plugins.md b/docs/dev/plugins.md
index f83de6c7..cd320784 100644
--- a/docs/dev/plugins.md
+++ b/docs/dev/plugins.md
@@ -114,16 +114,18 @@ although it is recommended to use the latest version.
The first things to specify in your CMake file are a couple boilerplate options for building C++:
- # Pick whatever version you have
- cmake_minimum_required(VERSION 3.24)
+```cmake
+# Pick whatever version you have
+cmake_minimum_required(VERSION 3.24)
- # Name your plugin
- project(TestPlugin CXX)
+# Name your plugin
+project(TestPlugin CXX)
- set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD 20)
- # Unless you are writing a plugin that needs Qt's UI, specify this
- set(HEADLESS 1)
+# Unless you are writing a plugin that needs Qt's UI, specify this
+set(HEADLESS 1)
+```
Then you want to get the matching API repository for the version of Binary Ninja you have.
This information is contained in a file named `api_REVISION.txt` that exists in the root install folder for Linux,
@@ -132,43 +134,51 @@ the `Contents/Resources` sub-folder on macOS, and the root installation folder o
Once you know which revision to use, you can clone a copy of the binaryninja-api repository
and reference it directly in your plugin. If you're using git, this can be accomplished easily using a submodule:
- git submodule add https://github.com/Vector35/binaryninja-api.git binaryninjaapi
- cd binaryninjaapi
- # Pick the revision from api_REVISION.txt
- git checkout 6466fba3341b2ea7dbfceeeebbc6c0322a5d8514
+```bash
+git submodule add https://github.com/Vector35/binaryninja-api.git binaryninjaapi
+cd binaryninjaapi
+# Pick the revision from api_REVISION.txt
+git checkout 6466fba3341b2ea7dbfceeeebbc6c0322a5d8514
+```
If you're not using git, you can clone the repository elsewhere:
- git clone https://github.com/Vector35/binaryninja-api.git binaryninjaapi
- cd binaryninjaapi
- # Pick the revision from api_REVISION.txt
- git checkout 6466fba3341b2ea7dbfceeeebbc6c0322a5d8514
+```bash
+git clone https://github.com/Vector35/binaryninja-api.git binaryninjaapi
+cd binaryninjaapi
+# Pick the revision from api_REVISION.txt
+git checkout 6466fba3341b2ea7dbfceeeebbc6c0322a5d8514
+```
Now that you have the correct copy of the api, you need to point CMake at it and include it for use.
Include something like the following in your CMake script and either add the path of your clone
to the HINTS list or set the BN_API_PATH environment variable to the location of your clone
- find_path(
- BN_API_PATH
- NAMES binaryninjaapi.h
- # List of paths to search for the clone of the api
- HINTS ../.. binaryninjaapi $ENV{BN_API_PATH}
- REQUIRED
- )
- add_subdirectory(${BN_API_PATH} api)
+```cmake
+find_path(
+ BN_API_PATH
+ NAMES binaryninjaapi.h
+ # List of paths to search for the clone of the api
+ HINTS ../.. binaryninjaapi $ENV{BN_API_PATH}
+ REQUIRED
+)
+add_subdirectory(${BN_API_PATH} api)
+```
Be sure to create a shared library and link against the Binary Ninja api. Also, you can use the
`bn_install_plugin` helper to automatically set up your plugin to install to the Binary Ninja plugins directory
when you use `cmake install`.
- # Use whichever sources and plugin name you want
- add_library(TestPlugin SHARED TestPlugin.cpp)
+```cmake
+# Use whichever sources and plugin name you want
+add_library(TestPlugin SHARED TestPlugin.cpp)
- # Link with Binary Ninja
- target_link_libraries(TestPlugin PUBLIC binaryninjaapi)
+# Link with Binary Ninja
+target_link_libraries(TestPlugin PUBLIC binaryninjaapi)
- # Tell `cmake --install` to copy your plugin to the plugins directory
- bn_install_plugin(TestPlugin)
+# Tell `cmake --install` to copy your plugin to the plugins directory
+bn_install_plugin(TestPlugin)
+```
From there you can write the rest of your plugin's CMake configuration, including any other dependencies or
options that you want. When you want to run your plugin, you can use `cmake --build` and `cmake --install`
@@ -178,24 +188,26 @@ You could also copy the plugin manually if you are using a different plugins dir
In the source code of your plugin, you will need to export some functions that Binary Ninja uses to load your plugin
at runtime:
- #include "binaryninjaapi.h"
- extern "C" {
- // Tells Binary Ninja which version of the API you compiled against
- BN_DECLARE_CORE_ABI_VERSION
+```cpp
+#include "binaryninjaapi.h"
+extern "C" {
+ // Tells Binary Ninja which version of the API you compiled against
+ BN_DECLARE_CORE_ABI_VERSION
- // Function run on plugin startup, do simple initialization here (Settings, BinaryViewTypes, etc)
- BINARYNINJAPLUGIN bool CorePluginInit()
- {
- return true;
- }
+ // Function run on plugin startup, do simple initialization here (Settings, BinaryViewTypes, etc)
+ BINARYNINJAPLUGIN bool CorePluginInit()
+ {
+ return true;
+ }
- // (Optional) Function to add other plugin dependencies in case your plugin requires them
- BINARYNINJAPLUGIN void CorePluginDependencies()
- {
- // For example, if you require the x86 to be loaded before your plugin
- AddRequiredPluginDependency("arch_x86");
- }
+ // (Optional) Function to add other plugin dependencies in case your plugin requires them
+ BINARYNINJAPLUGIN void CorePluginDependencies()
+ {
+ // For example, if you require the x86 to be loaded before your plugin
+ AddRequiredPluginDependency("arch_x86");
}
+}
+```
From there, you can implement your plugin functionality as you desire. I highly recommend looking at other plugins for
API usage since the C++ API is less well-documented than the Python API. Usually the functions and classes are named
@@ -219,46 +231,50 @@ or you can attempt to use a system-provided copy if you use Linux and like to li
Building it is a bit of a process, but should provide you with a working installation. Once you have a Qt build,
you can amend your CMake file to make a UI plugin. You will need the following CMake:
- # Remove this or set to 0
- # set(HEADLESS 1)
+```cmake
+# Remove this or set to 0
+# set(HEADLESS 1)
- # If you are using Qt MOC (i.e. use Q_OBJECT/Q_SIGNALS/Q_SLOTS)
- set(CMAKE_AUTOMOC ON)
- set(CMAKE_AUTORCC ON)
+# If you are using Qt MOC (i.e. use Q_OBJECT/Q_SIGNALS/Q_SLOTS)
+set(CMAKE_AUTOMOC ON)
+set(CMAKE_AUTORCC ON)
- # Locate Qt installation for linking
- find_package(Qt6 COMPONENTS Core Gui Widgets REQUIRED)
+# Locate Qt installation for linking
+find_package(Qt6 COMPONENTS Core Gui Widgets REQUIRED)
- # Add MOCS to your build
- add_library(TestPlugin SHARED library.cpp ${MOCS})
+# Add MOCS to your build
+add_library(TestPlugin SHARED library.cpp ${MOCS})
- # Link against both binaryninjaapi/binaryninjaui and Qt6
- target_link_libraries(TestPlugin PUBLIC binaryninjaapi binaryninjaui Qt6::Core Qt6::Gui Qt6::Widgets)
+# Link against both binaryninjaapi/binaryninjaui and Qt6
+target_link_libraries(TestPlugin PUBLIC binaryninjaapi binaryninjaui Qt6::Core Qt6::Gui Qt6::Widgets)
+```
Then, in your plugin code, instead of using the exported functions for a core plugin, use the ones for a UI plugin:
- #include "binaryninjaapi.h"
- #include "uitypes.h"
- #include "uicontext.h"
+```cpp
+#include "binaryninjaapi.h"
+#include "uitypes.h"
+#include "uicontext.h"
- extern "C" {
- // Tells Binary Ninja which version of the API you compiled against
- BN_DECLARE_UI_ABI_VERSION
+extern "C" {
+ // Tells Binary Ninja which version of the API you compiled against
+ BN_DECLARE_UI_ABI_VERSION
- // Function run on plugin startup, do simple initialization here (ViewTypes, SidebarWidgetTypes, etc)
- BINARYNINJAPLUGIN bool UIPluginInit()
- {
- return true;
- }
+ // Function run on plugin startup, do simple initialization here (ViewTypes, SidebarWidgetTypes, etc)
+ BINARYNINJAPLUGIN bool UIPluginInit()
+ {
+ return true;
+ }
- // (Optional) Function to add other plugin dependencies in case your plugin requires them
- // Historically, these have never actually been used
- BINARYNINJAPLUGIN void UIPluginDependencies()
- {
- // For example, if you require triage view to be loaded before your plugin
- AddRequiredUIPluginDependency("triage");
- }
+ // (Optional) Function to add other plugin dependencies in case your plugin requires them
+ // Historically, these have never actually been used
+ BINARYNINJAPLUGIN void UIPluginDependencies()
+ {
+ // For example, if you require triage view to be loaded before your plugin
+ AddRequiredUIPluginDependency("triage");
}
+}
+```
From there, you can implement whatever wacky Qt user interfaces you dream up. Be warned that the Binary Ninja UI API is
rather poorly documented and often missing helper functions for use by plugins. Feel free to ask for assistance and
@@ -305,51 +321,55 @@ VSCode takes a bit of configuration to set up, but can build and debug plugins e
You can install the C/C++ extension, the CMake extension, and the CMake Tools extension.
You need to set up a task in `.vscode/tasks.json` to build and install your plugin. Something like this:
- // tasks.json
- {
- "version": "2.0.0",
- "tasks": [
- {
- "type": "cmake",
- "label": "CMake: install",
- "command": "install",
- "problemMatcher": [],
- "detail": "CMake template install task",
- "options": {
- "environment": {
- // You will need this if your Binary Ninja installation is not in the default location
- "BN_INSTALL_DIR": "C:\\Users\\User\\AppData\\Local\\Vector35\\BinaryNinja",
- // You will need this if you are writing a UI plugin
- "PATH": "C:\\Users\\User\\Qt\\6.10.1\\msvc2019_64\\bin"
- }
+```jsonc
+// tasks.json
+{
+ "version": "2.0.0",
+ "tasks": [
+ {
+ "type": "cmake",
+ "label": "CMake: install",
+ "command": "install",
+ "problemMatcher": [],
+ "detail": "CMake template install task",
+ "options": {
+ "environment": {
+ // You will need this if your Binary Ninja installation is not in the default location
+ "BN_INSTALL_DIR": "C:\\Users\\User\\AppData\\Local\\Vector35\\BinaryNinja",
+ // You will need this if you are writing a UI plugin
+ "PATH": "C:\\Users\\User\\Qt\\6.10.1\\msvc2019_64\\bin"
}
}
- ]
- }
+ }
+ ]
+}
+```
You will also want to set up a launch task in `.vscode/launch.json` to launch Binary Ninja in a debugger,
so you can debug your plugin.
Be sure to set `"preLaunchTask"` to use the `CMake: install` task created above, so your code updates will be
built and installed automatically before you start debugging.
- // launch.json
- {
- "version": "0.2.0",
- "configurations": [
- {
- "name": "(Windows) Launch",
- "type": "cppvsdbg",
- "request": "launch",
- "program": "C:\\Users\\User\\AppData\\Local\\Vector35\\BinaryNinja\\binaryninja.exe",
- "args": [],
- "stopAtEntry": false,
- "cwd": "C:\\Users\\User\\AppData\\Local\\Vector35\\BinaryNinja",
- "environment": [],
- "console": "externalTerminal",
- "preLaunchTask": "CMake: install"
- }
- ]
- }
+```jsonc
+// launch.json
+{
+ "version": "0.2.0",
+ "configurations": [
+ {
+ "name": "(Windows) Launch",
+ "type": "cppvsdbg",
+ "request": "launch",
+ "program": "C:\\Users\\User\\AppData\\Local\\Vector35\\BinaryNinja\\binaryninja.exe",
+ "args": [],
+ "stopAtEntry": false,
+ "cwd": "C:\\Users\\User\\AppData\\Local\\Vector35\\BinaryNinja",
+ "environment": [],
+ "console": "externalTerminal",
+ "preLaunchTask": "CMake: install"
+ }
+ ]
+}
+```
There are a few other options you can use to assist in debugging:
diff --git a/docs/dev/typelibraries.md b/docs/dev/typelibraries.md
index 5623e087..13412683 100644
--- a/docs/dev/typelibraries.md
+++ b/docs/dev/typelibraries.md
@@ -13,13 +13,13 @@ The information in a type library is contained in two key-value stores:
When a binary is opened, its platform is determined, all .bntl's are processed, and those matching the platform of the loaded binary are registered. A debug log will show:
-```
+```text
Registered library 'libc.so.6' with platform 'linux-x86_64'
```
Then, those with either a filename or an alternative name matching the exact text of the binary's import command are imported, much like the native linker/loader. For example, in ELF, the .dynstr entry is used.
-```
+```text
elf: searching for 'libc.so.6' in type libraries
Type library 'libc.so.6' imported
```
@@ -30,7 +30,7 @@ This requested name should be a soname, like "libfoo.so.1" but could be a linkna
Binary Ninja's logic for determining a match is straightforward:
-```
+```python
typelibname.removesuffix('.bntl') == requestedname or requestedname in alternativenames
```
@@ -46,7 +46,7 @@ Example:
The alternative names list should have:
-```
+```text
libfoo.so.1.2.3 <-- includes version, minor, release (most specific)
libfoo.so.1.2 <-- includes version, minor (less specific)
libfoo.so.1 <-- includes version (soname)
@@ -172,7 +172,7 @@ A named object is the name of an external/imported symbol for which the type lib
I've seen "types of types", "sorts of types", "kinds of types", "classes of types" used to differentiate the varieties of possible types, and there are probably more. Binary Ninja uses "class", example:
-```
+```pycon
>>> type_obj.type_class
<TypeClass.FunctionTypeClass: 8>
```
@@ -191,13 +191,13 @@ Function types (types with `.type_class == FunctionTypeClass`) have a `.paramete
### How do I manually load a type library?
-```
+```pycon
>>> bv.add_type_library(TypeLibrary.load_from_file('test.bntl'))
```
### How can I manually load a type object?
-```
+```pycon
>>> bv.import_library_object('_MySuperComputation')
<type: int32_t (int32_t, int32_t, char*)>
```
@@ -221,7 +221,7 @@ Named Type References are a way to refer to a type by name without having its de
For example, examine this struct from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py):
-```
+```c
struct Rectangle2 {
int width;
int height;
@@ -233,13 +233,13 @@ We don't know at this moment what a `struct Point is`. Maybe we've already added
Load the resulting `test.bntl` in your binary and try to set some data to type `struct Rectangle2` and you'll be met with this message:
-```
+```text
TypeLibrary: failed to import type 'Point'; referenced but not present in library 'libtest.so.1`
```
This makes sense! Now go to types view and `define struct Point { int x; int y; }` and try again, success!
-```
+```text
100001000 struct rectangle_unresolved data_100001000 =
100001000 {
100001000 int32_t width = 0x5f0100
@@ -260,7 +260,7 @@ By a hierarchy of objects from [api/python/types.py](https://github.com/Vector35
As an example, here is the hierarchical representation of `type struct Rectangle` from [typelib_create.py](https://github.com/Vector35/binaryninja-api/blob/dev/python/examples/typelib_create.py)
-```
+```text
typelib.named_types["Rectangle"] =
----------------------------------
Type class=Structure
@@ -281,7 +281,7 @@ Here is the representation of `type int ()(int, int)` named `MyFunctionType` fro
When a binary is loaded and its external symbols is processed, the symbol names are searched against the named objects from type libraries. If there is a match, it obeys the type from the type library. Upon success, you'll see a message like:
-```
+```text
type library test.bntl found hit for _DoSuperComputation
```
diff --git a/docs/dev/workflows.md b/docs/dev/workflows.md
index 72b8347f..2b6fe925 100644
--- a/docs/dev/workflows.md
+++ b/docs/dev/workflows.md
@@ -574,7 +574,7 @@ bv.workflow.machine.cli()
**Available Commands**:
-```
+```text
abort configure dump halt log override reset run step
breakpoint disable enable help metrics quit resume status
```
diff --git a/docs/guide/efiresolver.md b/docs/guide/efiresolver.md
index a11545eb..ad3867ed 100644
--- a/docs/guide/efiresolver.md
+++ b/docs/guide/efiresolver.md
@@ -44,7 +44,7 @@ steps:
2. Define a GUID in the following format:
- ```
+ ```json
{
"EFI_EXAMPLE_CUSTOM_PROTOCOL_GUID": [
19088743, 35243, 52719,
diff --git a/docs/guide/index.md b/docs/guide/index.md
index 058e4e91..bb51f690 100644
--- a/docs/guide/index.md
+++ b/docs/guide/index.md
@@ -1087,8 +1087,10 @@ The interactive python prompt also has several built-in "magic" functions and va
The python interpreter can be customized to run scripts on startup using `startup.py` in your user folder. Simply enter commands into that file, and they will be executed every time Binary Ninja starts. By default, it comes with an import helper:
- # Commands in this file will be run in the interactive python console on startup
- from binaryninja import *
+```python
+# Commands in this file will be run in the interactive python console on startup
+from binaryninja import *
+```
From here, you can add any custom functions or objects you want to be available in the console. If you want to restore the original copy of `startup.py` at any time, simply delete the file and restart Binary Ninja. A fresh copy of the above will be generated.
diff --git a/docs/guide/plugins.md b/docs/guide/plugins.md
index a064f967..57a8d8b6 100644
--- a/docs/guide/plugins.md
+++ b/docs/guide/plugins.md
@@ -95,7 +95,7 @@ Binary Ninja ships with an embedded version of Python on Windows and macOS. On L
You may also wish to use your own custom interpreter which you can set with the [python.interpreter setting](settings.md#python.interpreter) to point to the appropriate install location. Note that the file being pointed to should be a `.dll`, `.dylib`, or `.so` though homebrew will often install libraries without any extension. For example:
-```
+```bash
$ file /usr/local/Cellar/python@3.8/3.8.5/Frameworks/Python.framework/Versions/3.8/Python
/usr/local/Cellar/python@3.8/3.8.5/Frameworks/Python.framework/Versions/3.8/Python: Mach-O 64-bit dynamically linked shared library x86_64
```
diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 70cb6b5c..954ddf5f 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -128,7 +128,7 @@ You may also manually create a `settings.json` file in your [user folder](./inde
macOS Ventura enables more in-depth code signing verification that can cause issues with Binary Ninja when migrating between versions. If you receive a warning that `“Binary Ninja.app” is damaged and can’t be opened. You should move it to the Trash.`, it is likely that you have merely upgraded from an older version of Binary Ninja and older files in the application bundle are impacting code signing. The simplest fix is to simply request a [new download bundle](https://binary.ninja/recover/), drag the old bundle to the trash and drag the new bundle in place. Alternatively, if your bandwidth is low or you do not have an active license, you can try manually removing extra folders. In case you are migrating from 3.1.3439 to 3.2.3811, that would be:
-```
+```bash
rm -rf /Applications/Binary\ Ninja.app/Contents/Frameworks/Python.framework/Versions/3.9/
```
@@ -142,7 +142,7 @@ Below are a few of the most common problems with Linux installations:
- Some unzip utilities do not maintain the `+x` executable bit on files when extracted. To fix this, we recommend:
- ```
+ ```text
chmod +x binaryninja/*.so.*
chmod +x binaryninja/plugins/*
```
@@ -172,7 +172,7 @@ If you have installed Binary Ninja into a path outside your home folder such as
Ubuntu 22.04 and newer ship Firefox as a snap that is confined by AppArmor. The confinement blocks `snap.firefox.firefox` from reading arbitrary system paths outside the user's home directory, so paths such as `/opt/binaryninja/docs` are inaccessible. Binary Ninja's local help viewer fails under these conditions because Firefox cannot open the documentation files it launches from `/opt/binaryninja/`, and `dmesg` will show `apparmor="DENIED"` entries similar to:
-```
+```text
apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/opt/binaryninja/docs/index.html" requested_mask="r" denied_mask="r"
```
@@ -275,7 +275,7 @@ With the addition of [projects](../guide/projects.md) and [type archives](../gui
1. Update to a version with support for the new extensions (builds 4860 or newer)
1. Run:
-```
+```text
/System/Library/Frameworks/CoreServices.framework/Versions/Current/Frameworks/LaunchServices.framework/Versions/Current/Support/lsregister -f -R -trusted "/Applications/Binary Ninja.app"
```
diff --git a/docs/guide/types/platformtypes.md b/docs/guide/types/platformtypes.md
index cf1b8fc4..93e5f0f4 100644
--- a/docs/guide/types/platformtypes.md
+++ b/docs/guide/types/platformtypes.md
@@ -7,13 +7,13 @@ Binary Ninja pulls type information from a variety of sources. The highest-level
Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on Windows:
-```
+```c
typedef uint8_t u8;
```
You could write this type into:
-```
+```text
/home/user/.binaryninja/types/platform/windows-x86.c
```
@@ -30,7 +30,7 @@ The base path for these files is in your [user folder](../index.md#user-folder)
For example, something like:
-```
+```bash
$ pwd
/home/user/.binaryninja/types/platform
$ cat windows-x86.c
diff --git a/docs/guide/types/typeimportexport.md b/docs/guide/types/typeimportexport.md
index c245deef..775e0064 100644
--- a/docs/guide/types/typeimportexport.md
+++ b/docs/guide/types/typeimportexport.md
@@ -57,51 +57,61 @@ Since you need to specify the include paths for system headers, you will need to
On these systems, you can run a command to print the default search path for compilation:
- gcc -Wp,-v -E -
- clang -Wp,-v -E -
+```bash
+gcc -Wp,-v -E -
+clang -Wp,-v -E -
+```
For the directories printed by this command, you should include them with `-isystem<path>` in the order specified.
For example on macOS, with Xcode 13:
- $ clang -Wp,-v -E -
- clang -cc1 version 13.0.0 (clang-1300.0.29.3) default target arm64-apple-darwin21.6.0
- ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/local/include"
- ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/Library/Frameworks"
- #include "..." search starts here:
- #include <...> search starts here:
- /usr/local/include
- /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
- /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
- /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
- /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks (framework directory)
- End of search list.
+```text
+$ clang -Wp,-v -E -
+clang -cc1 version 13.0.0 (clang-1300.0.29.3) default target arm64-apple-darwin21.6.0
+ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/local/include"
+ignoring nonexistent directory "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/Library/Frameworks"
+#include "..." search starts here:
+#include <...> search starts here:
+ /usr/local/include
+ /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
+ /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
+ /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
+ /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks (framework directory)
+End of search list.
+```
From this example, the flags would be: (note: not including the framework directory line)
- -isystem/usr/local/include
- -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
- -isystem/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
- -isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
+```text
+-isystem/usr/local/include
+-isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/13.0.0/include
+-isystem/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
+-isystem/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
+```
Another example on Arch Linux:
- $ gcc -Wp,-v -E -
- ignoring nonexistent directory "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../../../../../x86_64-pc-linux-gnu/include"
- #include "..." search starts here:
- #include <...> search starts here:
- /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
- /usr/local/include
- /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
- /usr/include
- End of search list.
+```text
+$ gcc -Wp,-v -E -
+ignoring nonexistent directory "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../../../../../x86_64-pc-linux-gnu/include"
+#include "..." search starts here:
+#include <...> search starts here:
+ /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
+ /usr/local/include
+ /usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
+ /usr/include
+End of search list.
+```
From this example, the flags would be:
- -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
- -isystem/usr/local/include
- -isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
- -isystem/usr/include
+```text
+-isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include
+-isystem/usr/local/include
+-isystem/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed
+-isystem/usr/include
+```
##### For Windows
@@ -109,29 +119,35 @@ For windows, there's no easy command to list all the include paths, so you have
You will end up with something like the following for user mode:
- -x c -std=c99
- -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+```text
+-x c -std=c99
+-isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+```
Or, for kernel mode:
- -x c -std=c99
- -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km"
+```text
+-x c -std=c99
+-isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km"
+```
Note that some header files might require manually including a specific `windows.h` header which necessitates specifying a target platform to get the appropriate includes:
- --target=x86_64-pc-windows-msvc
- -x c -std=c99
- -include"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\windows.h"
- -isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
- -isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+```text
+--target=x86_64-pc-windows-msvc
+-x c -std=c99
+-include"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\windows.h"
+-isystem"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.28.29333\include"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\shared"
+-isystem"C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um"
+```
##### Cross-Platform Targets
@@ -151,13 +167,13 @@ Binary Ninja pulls type information from a variety of sources. The highest-level
Platform types are used to define types that should be available to all programs available on that particular platform. They are only for global common types. Consider, for example, that you might want to add the following on Windows:
-```
+```c
typedef uint8_t u8;
```
You could write this type into:
-```
+```text
/home/user/.binaryninja/types/platform/windows-x86.c
```
@@ -172,7 +188,7 @@ You may wish to provide types that are common across multiple architectures or p
For example, something like:
-```
+```bash
$ pwd
/home/user/.binaryninja/types/platform
$ cat windows-x86.c
diff --git a/docs/guide/types/typelibraries.md b/docs/guide/types/typelibraries.md
index 5848cc8e..8dfece4d 100644
--- a/docs/guide/types/typelibraries.md
+++ b/docs/guide/types/typelibraries.md
@@ -32,8 +32,10 @@ Type Libraries contain details about a specific library that is imported by bina
Type Libraries are named after the source library they are providing types for. When a binary is opened, Binary Ninja finds all of its linked library dependencies, and looks up Type Libraries for them. Those with a File Name or Alternative Name matching the exact text of a library used by the binary will be imported into the analysis. You can see this process in the Log:
- elf: searching for 'libc.so.6' in type libraries
- Type library 'libc.so.6' imported
+```text
+elf: searching for 'libc.so.6' in type libraries
+Type library 'libc.so.6' imported
+```
The [Developer Guide](../../dev/typelibraries.md) contains more details about the implementation details of the Type Library format.