This immediately caught my eye. Captive portals are common at hotels or on open networks, but I had not expected one at this vacation rental after entering the Wi-Fi password. So I decided to find out what was going on.

Starting with the Network

The captive portal pointed to guest.stayfi.com, and a quick Google search led me to the StayFi home page which describes the product as “WiFi & Guest Marketing Built For Vacation Rentals.” This looked interesting, though it was not immediately clear how it worked.

I asked an AI agent to map out the network topology, and it ran a few quick commands:

route -n get default
scutil --dns
arp -an

I initially assumed the captive portal was implemented by the gateway, but these commands quickly showed that the gateway and DNS server were two different hosts:

default gateway:  192.168.x.1
DNS server:       192.168.x.y

ARP entry for gateway:  78:45:58:xx:xx:xx
ARP entry for DNS:      88:a2:9e:yy:yy:yy

The DNS server’s MAC prefix, 88:a2:9e, pointed to Raspberry Pi hardware. Conveniently, the StayFi Express webpage includes a photo of the device, and it is unmistakably a Raspberry Pi. The setup guide also lists configuring custom DNS as part of installation.

This also explains how the StayFi device can trigger the captive portal. As the DNS server, it can direct queries such as captive.apple.com to itself. Its local HTTP server then redirects the browser to the remote StayFi portal shown earlier. If you submit the requested information, StayFi authorizes your device for Internet access.

At this point, several possible bypasses came to mind. We could try a different DNS server, such as 1.1.1.1 or 8.8.8.8, or perhaps connect through our own VPN. For the latter, we might need to know the VPN’s IP in advance. I manually changed the DNS server and the bypass worked on this network, but I still wanted to see exactly how StayFi works.

Imaging the Device

I decided to dig deeper. The operating system lives on an easily removable SD card (thanks, Raspberry Pi!), so I dumped a full disk image of it:

sudo dd if=/dev/rdisk8 \
  of=stayfi-express.img \
  bs=8m conv=noerror,sync

The resulting image was about 30 GB, most of which was empty space. The layout uses an A/B update scheme: two root slots allow a new system image to be installed while retaining a known-good one for rollback. A persistent data partition provides an overlay for configuration, databases, logs, and credentials.

After unpacking everything, the root filesystem contained mostly recognizable Linux packages. The custom part was thankfully small: three stripped AArch64 ELF binaries all built with Go 1.22.5.

This is one reason appliance reversing can be fun: a multi-gigabyte filesystem often reduces to a few megabytes of code that actually answers your question. The remaining data is just Linux doing Linux things.

Reverse Engineering the Go Programs

Go binaries are large, but they are often generous to reverse engineers. Even in stripped executables, metadata such as .gopclntab can preserve package paths and function names. I asked my AI agent to recover those names and analyze the binaries with the help of Binary Ninja’s MCP server. The overall design became clear quickly.

The HTTP service uses Go’s standard net/http stack and net/http/httputil.ReverseProxy. The DNS service uses the well-known miekg/dns package. Both use SQLite for local state. Using existing protocol libraries meant I could focus my analysis on the policy wrapped around them.

In simplified Go-like pseudocode, the HTTP flow looked roughly like this:

clientMAC := macForIP(request.RemoteAddr)

if isAuthorized(clientMAC) {
    proxyRequest(request)
    return
}

if matchesSmartConnect(request.UserAgent) {
    go authorizeWithCloud(clientMAC)
    proxyRequest(request)
    return
}

redirectToCaptivePortal(clientMAC)

For each client request, the appliance maps the source IP address back to a MAC address using its ARP table, with arping as a fallback. The MAC address becomes the local identity. SQLite records whether that identity is authorized, blocked, or eligible for a bypass rule.

DNS and HTTP then cooperate as DNS applies the client’s policy and records the query. When an unauthenticated browser makes a plain HTTP request, the HTTP service sends a redirect resembling:

https://guest.stayfi.com/sbc/captive_portal?sbc_mac=<appliance>&client_mac=<guest>

Notice that this is no longer on the local device—the request goes to a remote server.

According to StayFi’s privacy policy (last updated July 31, 2025), StayFi may disclose personal information such as email addresses, device identifiers, phone numbers, and usage information to the property manager. It may also share information with advertising partners.

I even tried entering a syntactically valid but fake-looking email address. The webpage had no issue with it, but the server rejected it. StayFi’s setup documentation says its optional valid-email check uses ZeroBounce, which is consistent with the rejection I observed. That check validates an email address; it does not establish the identity of the person entering it.

A Serious Privacy Concern

A closer look at the DNS server showed that it logs requests to dnsserver.log. A Datadog agent tails this file, with a configuration to forward the DNS logs to that third-party service.

The log recovered from my device covered about three and a half hours. It contained 11,801 DNS-request records representing 639 unique domain names. Packet captures showed sustained connections to Datadog log-intake infrastructure, consistent with that configuration.

DNS logs show which domain names a device looked up and when. They can suggest which services it used, but background applications and prefetching also generate queries, so a lookup does not prove that a person visited a website. Because the registration form sends the guest’s name, email, phone number, client MAC address, appliance MAC address, and property identifiers, these records could be linked to an identified guest, although I found no evidence showing whether or how often StayFi performs that correlation.

The privacy policy also says that StayFi automatically collects “Usage Information” and a “Device Identifier,” including IP and MAC addresses. More directly, it says StayFi “collects your network traffic information.”

The policy says it will not use this information “for any purpose other than to administer the Services”—for example, to maintain and secure the network, answer service-related questions, or respond to legal requirements. Elsewhere, it describes sharing personal or usage information with the property manager, service providers working on StayFi’s behalf, and, in some circumstances, advertising partners.

If you find this a little confusing, I felt the same way. It’s difficult to tell how they actually handle the data.

Little Surprises

Finding unexpected details is one of the best parts of reverse engineering, and this device did not let me down. For example, it whitelists certain device names and MAC address ranges associated with smart TVs and other IoT devices. This makes sense because you obviously cannot type your phone number into a smart speaker.

The downloaded regular expressions matched terms including:

tv, smart-tv, hbbtv, Roku, Fire TV, Apple TV, Chromecast,
Tizen, webOS, Sonos, thermostat, door lock, Home Assistant,
Nest, PlayStation, Xbox

The MAC whitelist contained 285 organizationally unique identifiers (OUIs). These are three-byte vendor prefixes rather than complete device addresses. A few examples were:

The device also comes with a WireGuard profile. A heavily redacted and abridged version looks like this:

# /etc/wireguard/wg-client.conf
[Interface]
PrivateKey = <redacted>
Address = 10.39.x.y/32

[Peer]
PublicKey = <redacted>
Endpoint = <redacted>:51820
AllowedIPs = 10.39.x.1/32, ..., 10.39.x.10/32

The narrow AllowedIPs means WireGuard routes traffic only to a small set of management hosts, not all of the appliance’s Internet traffic.

The root account also has six authorized SSH keys that appear to be associated with StayFi:

# /root/.ssh/authorized_keys
ssh-ed25519 <key-redacted> it@stayfi.com
ssh-ed25519 <key-redacted> it@stayfi.com
ssh-ed25519 <key-redacted> <name>@stayfi.com
ssh-ed25519 <key-redacted> <name>@stayfi.com
ssh-ed25519 <key-redacted> <name>@stayfi.com
ssh-ed25519 <key-redacted> <local-hostname>

This presumably allows StayFi operators to access the box remotely for tasks such as troubleshooting.

The next time a captive portal Wi-Fi asks for your phone number, maybe change your hostname to “tv” and see if you still get blocked!

Editor’s Note (Jordan here): Fun fact, we did in fact get a bunch of text spam after the offsite and have even had the system re-subscribe our number after we requested the office number be removed

This post tells the story of the conditional breakpoint with a side-quest to explore Binary Ninja’s expression parser which is the feature that makes it possible.

It Started with Navigation

If you’ve used Binary Ninja, you’ve probably pressed G to open the navigation dialog and typed in a function name. But did you know that dialog is powered by a full expression parser? This means you can type main + 0x10 to navigate 16 bytes past the start of main, or .text + 0x100 to jump to an offset within a section, or even [.data + 0x20] to dereference a pointer.

The expression parser can do a lot more than you would probably guess. Here’s some examples:

Expression Parser Capabilities

The supported operators include arithmetic (+, -, *, /, %), bitwise operations (&, |, ^, ~), comparisons (==, !=, >, <, >=, <=), and grouping with parentheses.

For memory dereferences, you can specify the size: [expr].b for a byte, [expr].w for a word, [expr].d for a dword, and [expr].q for a quadword. Without a suffix, it reads an address-sized value.

Numbers default to hexadecimal, but you can use 0n10 for decimal or 010 for octal when needed.

For the complete specification, see the parse_expression API documentation.

Making It Dynamic: Magic Values

The expression parser becomes even more powerful during debugging thanks to “magic values” which are name-value pairs that can be registered at runtime.

When you’re in a debug session, the debugger automatically registers all CPU registers (rax, rbx, rsp, rbp, rip, etc.) and module bases (kernel32, ntdll, libc, etc.) into the expression parser. This enables some useful workflows:

• Type rbp - 0x20 to navigate directly to a stack variable — no manual calculation needed
• Type kernel32 + 0x1000 to navigate into a loaded module, even with ASLR
• Type rsp to jump straight to the stack pointer

A quick note: historically, register names required a $ prefix (e.g., $rax). Register names can now be used directly, as in rax.

Plugin authors can take advantage of this system too. The add_expression_parser_magic_value API lets you register custom values. Imagine registering heap chunk addresses or TLS slots that users can then reference directly in expressions.

The 500-Line Feature

Conditional breakpoint support landed in December 2025, thanks to a PR from community contributor 3rdit. The entire feature (condition evaluation, UI, and API) took about 500 lines of code.

How is it possible to implement such a major feature in just 500 lines? The secret is that the condition evaluation uses the expression parser we just discussed. Here’s a simplified version of how it works:

bool DebuggerController::EvaluateBreakpointCondition(uint64_t address)
{
    const std::string condition = m_state->GetBreakpoints()->GetConditionAbsolute(address);
    if (condition.empty())
        return true;  // No condition means always stop

    // Use the expression parser to evaluate the condition
    uint64_t result = 0;
    std::string error;
    if (!BinaryView::ParseExpression(GetData(), condition, result, address, error))
        return true;  // Parse error, stop to be safe

    return result != 0;  // Non-zero means condition is true
}

The debugger simply calls ParseExpression on the condition string. If the result is non-zero, the condition is true and the debugger stops. That’s it. All the heavy lifting including parsing the expression, reading register values, performing arithmetic and comparisons is handled by the expression parser.

Because the condition is evaluated at the debugger core level rather than the adapter level, the same expression syntax is available across supported debugger adapters. The register and module names in an expression still depend on the target.

But Wait — Comparison Operators?

You might be wondering: how does the expression parser handle conditions like rax == 0x1234? After all, it was originally a navigation feature. What does a comparison even mean in that context?

Back in December 2022, while I was adding the magic value support for register values, I also added comparison operators to the expression parser: ==, !=, >, <, >=, <=. These operators return 1 if the condition is true, 0 otherwise.

I was already thinking ahead for conditional breakpoints. The expression parser already knew how to read register values and dereference memory locations making it a perfect match for evaluating breakpoint conditions. Adding comparison operators made it ready to use.

Then in December 2025, 3rdit reached out asking about adding conditional breakpoint support. I was excited — the foundation I’d laid three years earlier was finally going to be used. I told him that the expression parser was already there to support it so it shouldn’t be hard. He came back with PR #941, which was merged with little modification.

Thanks to 3rdit for the contribution!

How to Use Conditional Breakpoints

Here’s how to add a condition to a breakpoint.

Setting a Condition

1. Add a breakpoint at the desired location
2. Right-click the breakpoint in the Breakpoints widget
3. Select “Edit Condition…”
4. Enter your condition expression
5. Click OK

You can also view and edit conditions in the “Condition” column of the Breakpoints widget.

Example Conditions

These examples use x86-64 register names. Use the register names for your target architecture.

Remember that unprefixed numbers are hexadecimal: 10 means sixteen; 0n10 means ten.

Using the API

In Binary Ninja’s Python console, dbg is the debugger controller for the current view. These examples assume you have already added breakpoints at the specified locations. Replace the addresses and module name with values from your target.

from binaryninja.debugger import ModuleNameAndOffset

# Set a condition
dbg.set_breakpoint_condition(0x401000, "rax == 0x1234")

# With module-relative address
dbg.set_breakpoint_condition(ModuleNameAndOffset("myprogram", 0x1000), "rdi != 0")

# Get current condition
condition = dbg.get_breakpoint_condition(0x401000)

# Clear condition (set to empty string)
dbg.set_breakpoint_condition(0x401000, "")

For more details, see the conditional breakpoints documentation.

What’s Next

The expression parser continues to evolve. One possible extension would be a string comparison function such as streq. For example, a hypothetical streq(rdi, "password") could stop when rdi points to that string. This is an idea for future work, not syntax you can use today.

We’d love to hear your feedback on what would make conditional breakpoints even more useful for your workflows.

Next time you press G in Binary Ninja, remember that you have a full expression parser at your fingertips. Skip the calculator and just use rbp - 0x20 during your next debugging session.

References

Documentation

• Expression Parser API (parse_expression)
• Magic Values API (add_expression_parser_magic_value)
• Conditional Breakpoints Guide

Implementation

• Conditional Breakpoints PR #941
• Step-vs-Breakpoint Fix
• Feature Request Issue #93

Binary Ninja 6.0 (Krypton) is here! This is a major version bump, and it’s worth the wait. We’ve shipped a brand new MCP server, a new Binary Similarity feature, and a complete overhaul of the Plugin Manager as the new Extension Manager. Under the hood, you’ll find major improvements to performance and memory usage, a refactored calling convention to properly represent structure parameters and return values, and added HLIL structure initializers. On the scripting side, we’ve updated the bundled Python version to 3.13 and included it on Linux. We’ve also added a new TMS320C6x architecture, a new user wizard to ease migration, and a long list of debugger improvements. And those are still only some of the new features detailed below.

We’re also improving the free edition. We’ve added the highly requested armv8 (AArch64) architecture as well as the above-mentioned MCP server. Additionally, we’re also shipping a new Linux ARM64 build of the free version. Next, as previously announced, with this release we’re putting our new pricing and packaging into effect. Finally, thanks to everyone who participated in our 10 year celebration! We’re looking forward to another decade!

• Performance and Memory
  • Analysis Cache
  • Database Saving
• MCP
• Binary Similarity
• Architectures and Platforms
  • TMS320C6x
  • Multiple Global Pointers
• Analysis
  • Improved BASE (Fast Analysis Mode)
  • Calling Convention Refactor
  • HLIL_STRUCT_INITIALIZE
  • Type Fragments
• Scripting and Extensions
  • Python 3.13 and Linux
  • Scripting Console
  • Extension Manager
• New User Wizard
• Debugger
• Packaging and Licensing
  • New Features in Free
  • Pricing and Packaging
  • Server Deployments
• Open-Source Contributions
• Everything Else

Major Features

Performance and Memory

Let’s start with some some universally applicable improvements. No matter how you use Binary Ninja, you’ll see some fantastic speedups in 6.0 while also seeing decreases in memory usage. Exact improvements depend on the workload and hardware, so we picked some representative sample binaries and ran a gamut of testing. The results speak for themselves.

As you can see, across a representative corpus, 6.0 analyzes up to 2.16x faster than 5.3 while using as much as 55% less peak memory.

These gains come from many changes rather than any single optimization. There were dozens of smaller fixes, hundreds of hours of profiling, new tools developed to analyze memory usage, and Brian, Mark, Ryan, and others working to optimize the system. Nothing was sacred: many long-standing data structures and sections of code were critically examined for potential improvements.

Analysis Cache

Binary Ninja maintains an analysis cache of analyzed functions. However, choosing when to re-analyze and when to cache can be tricky to get right from a performance perspective. With improved instrumentation and analysis, we were able to make much better use of the existing analysis cache while also fixing some bugs along the way.

Database Saving

This is just the beginning as we’re planning to focus even more on save and load times in future releases. However, in 6.0, we’ve already improved both memory usage and time taken for saving, as well as fixed a file size creep bug where files could keep growing with repeated saves.

MCP

While, in a previous release, Tim and BK on the Sidekick team added external MCP server support to Sidekick, with Binary Ninja 6.0, we shipped a first-party MCP server. It’s “batteries included” for the LLM-using world. It can interact directly with the UI you are looking at or, for versions of the product with headless API support, can be used directly without the UI at all.

There are two variants. The GUI MCP server runs inside Binary Ninja, communicating over HTTP, and is included in all editions including free. The headless MCP server is a standalone binaryninja_mcp binary that communicates over stdio, and is included with Commercial and Ultimate on macOS and Linux. Native Windows packages don’t ship the headless binary yet. Use the built-in GUI MCP server there or run the Linux build under WSL. This is an unfortunate limitation due to Windows’ file system locking, where a running MCP server can corrupt or block an installation.

Both variants expose the same data and allow the same actions: opening files and databases, selecting BinaryViews, driving and waiting on analysis updates, a compact triage summary of a binary, program structure (entry points, segments, sections, symbols, imports, exports, relocations, data variables, and strings), raw memory reads, function inspection covering metadata, disassembly, Pseudo C, ILs, and many more useful properties. They can rename objects, create and apply types, and create data variables as well.

Turning on the GUI server is easy: enable ui.mcp.enabled in settings and restart to automatically start, or run Plugins > MCP > Start Server for one-off runs. With default settings it listens at http://127.0.0.1:24642/mcp, and Plugins > MCP > Copy Connection Info will hand you the exact URL and authorization header for your session, so you can paste it straight into your client. If you’d rather lock it down, set ui.mcp.token and clients will need to send a matching bearer token.

The documentation has ready-to-paste configurations for Claude Desktop, Cursor, VS Code, and Codex, as well as much more information.

Binary Similarity

Binary Similarity is, at heart, the task of noticing that the two functions in front of you are the same, except one has a cape and one wears glasses.

With 6.0, Mason created our Binary Similarity system for comparing two or more related binaries. It’s not a competing diffing engine to popular tools like BinDiff, Diaphora, or BSim. Rather, it’s a pluggable framework which can not only leverage multiple providers, but also allow you to integrate, compare, and do more with them than ever before.

We currently ship two providers: Google BinDiff (for finding structurally similar functions) and WARP (for finding exact function matches). All providers report similarity and confidence, allowing you to review possible matches, render them side by side, and apply the available analysis information to the new binary.

For example, when comparing two releases of a popular game, Binary Similarity quickly highlights the changes in cGcFrontendPageShop::GenerateRepShopInventory. Rendering the result keeps both versions in sync and highlights the differences, making it easy to identify patched logic.

Patch diffing is not the only use case. Often you have a heavily annotated binary whose annotations you want to port to a newer (or different) version. With Binary Similarity, we can automatically transfer annotations from one binary to another, saving time and effort.

Of course, the UI is not the only way to use the new Binary Similarity functionality. This is Binary Ninja, after all: everything is pluggable and accessible via an API. The complete system is exposed through the Python API, C++ API, and Rust API, allowing you to create and run sessions headlessly.

Plugins can also register entirely new providers and resolvers. Providers find possible matches, while resolvers choose which results to use (and can apply them automatically), so the system is not limited to WARP and BinDiff or to our built-in matching algorithm(s). In fact, the third-party binja diff plugin, which wraps QBinDiff by Quarkslab, already supports adding QBinDiff as a provider for a second opinion to BinDiff.

NOTE: Binary Similarity is only available in Ultimate.

For more information on configuring sessions, reviewing and applying results, or running it headlessly, see the Binary Similarity documentation. Our immediate roadmap includes new integrations and even our own novel matching implementation, so stay tuned!

Architectures and Platforms

TMS320C6x

Brandon’s been on a DSP kick and adding those difficult-to-decompile architectures to Binary Ninja. First it was Hexagon and, now with 6.0, it’s TMS320C6x.

Keep an eye out for an upcoming blog post with more details about all the behind-the-scenes changes and how we can now handle such a problematic architecture. In the meantime, all customers with current Ultimate support can update to a version with 19 first-party architectures!

Here’s a quick sneak peek for everyone else:

Multiple Global Pointers

Binary Ninja could previously track and allow users to override only a single global pointer register, but that doesn’t cut it for every architecture. TriCore, for example, uses four registers to point into different global data regions, and Binary Ninja can now track and override each of them independently. With accurate global pointer values available during analysis, references to global data resolve correctly and produce much cleaner decompilation.

Analysis

Improved BASE (Fast Analysis Mode)

Introduced in a previous post, BASE is our automated base address detection feature built into all versions of Binary Ninja. With 6.0, it includes a new “sampling” mode, enabled by default, which can produce accurate results much faster. It’s especially useful for large files, though the previous IL Analysis Mode is still available when accuracy matters more than speed.

Calling Convention Refactor

One of our main thrusts going forward is better handling of language-specific decompilation. We’ve built language representation features for that, and our workflow system lets us tweak the decompilation in many useful ways. But our type system, calling convention, and ILs likely need changes to fully support the most modern programming languages. Instead of sticking to just treating everything like C, we want to keep working toward language-specific support like we have with Objective-C.

To that end, in 6.0 Rusty refactored our calling convention system. We can now support structure returns and parameters which are used by a number of languages. Most of the changes you’ll see in 6.0 may seem minimal at face value, but actually unblock several future language-specific decompilation improvements that you should see in upcoming stable releases (or even sooner if you follow our development branch).

That said, we do ship two specific changes in 6.0. While the added Go and Pascal calling conventions don’t do much out of the box, when combined with a plugin like Delphinja, you can get some much improved results since it includes type libraries and specific debug information parsing that can leverage the new convention!

The Go calling convention support is in the core, but as we’re not yet processing the metadata available in .gopclntab sections and similar information, you won’t see any automatic changes yet. Keep an eye out for this in the next stable release!

HLIL_STRUCT_INITIALIZE

A new IL instruction and a system for initializer expressions greatly simplify structure initializations, resulting in some very clean decompilation.

Type Fragments

Fragments from Krypton are bad news. Type fragments in Krypton are great news.

A type fragment represents a bitwise slice of a larger source type while that slice is carried in integer-like storage. When a calling convention passes pieces of a structure in registers, or an optimized inline memcpy copies a typed object in register-sized chunks, those pieces used to decay into integers and the connection back to the original object was lost. Type fragments preserve that relationship, tracking which bits of which source type a given register is holding as it flows through the program.

These are intermediate, in-flight types used by analysis rather than something you’ll define yourself, and they render in decompiled output using __frag notation (or __frag_be when the source is big-endian). Together with the calling convention refactor above, this means structures split across registers keep their types instead of just dissolving into integers.

Scripting and Extensions

Python 3.13 and Linux

We’ve been shipping a bundled Python in our macOS and Windows builds of Binary Ninja for a while now. Starting in 6.0, we ship this bundled Python with all builds on all platforms, including x86-64 and AArch64 Linux. This means that our support for third-party Linux distributions should be a bit more reliable since we don’t need to make assumptions about what’s installed by default.

While he was at it, Alex also bumped the included version to 3.13 to keep things a bit more modern. Our minimum supported version is still 3.10 if you require something older, however.

This does mean that if you were running the previously bundled version of Python and you switch, none of your plugin dependencies will be installed! The one-time Plugin Migration dialog will reinstall them for you.

Scripting Console

A small but noticeable quality-of-life improvement for those who do a lot of scripting: the scripting console now hints at individual parameters instead of just the prototype.

Extension Manager

The Plugin Manager is dead, long live the Extension Manager! This change not only sets the groundwork for better plugin features, but also paves the way for native plugins and being able to install things other than plugins, like themes or type libraries. Almost half the team touched the extension manager code this release, it was truly a team effort.

Here are the main features you’ll see with the new Extension Manager:

• You can choose which version of a plugin to install
• Dependency installation opens a dialog so you can see pip at work
• Conflicting dependencies have some auto-detection and resolution
• Plugin details are cached offline
• Plugins are more verbose about their status in details and the extension list
• The snippets plugin is shipped by default
• Plugins can be sorted by name, publication date, or most recently updated

One heads-up if you’re updating: Extensions installed through the extension manager are stored differently on disk, so your first 6.0 launch will run a one-time migration. This will reinstall everything you had previously, dependencies included, and re-enable them when it’s done.

We also want to have a special mention to one of our summer interns Ashvika who did a ton of work to improve our plugin ecosystem. If you notice many more plugins with proper images and readmes, you can thank her for it!

You’ll notice the new name in the API, too: The Python module is now extensionmanager, with a deprecation shim left behind.

New User Wizard

It’s hard to switch tools when you’re used to a particular workflow or hotkey, and it’s even harder to dig and find all the settings you might want to change in a new tool. New in 6.0 is a short three-step wizard. You choose a light or dark theme, a preferred experience, and a few privacy and network settings (automatic crash reports, automatic update checks, and online WARP).

The middle step is for you if you’re arriving from another tool. Next to the Binary Ninja defaults, you can pick a Ghidra or IDA-Like experience. There are multiple differences among them, and the configuration lives in docs/files in the API repository - contributions are welcome.

If you want more information about what’s different compared to other tools, check out our migration guide.

Debugger

Krypton gives you a much clearer picture of the process around the code you are debugging. The new Debugger Memory Map sidebar shows every mapped region reported by the debug adapter, including its address range, size, permissions, and name. Binary Ninja can also mirror those mappings as individual memory regions, allowing Find to search mapped memory without trying to scan the entire address space. And when an address belongs to a library that was not part of the original analysis, you can now load symbols from the debugger backend on demand, either for one module or for all loaded modules. These are added as auto symbols, so they participate in analysis and annotations without overriding any names you have defined yourself.

• Feature: Added double-click navigation to a token’s runtime address during a debug session
• Feature: Added the ability to go to the previous/next register write in TTD (Time Travel Debugging)
• Improvement: Made the WinDbg/TTD version a setting instead of always downloading the latest
• Improvement: Refined double-click navigation while debugging
• Improvement: Skipped the adapter settings dialog on subsequent debug sessions
• Fix: Fixed LLDB target creation to use the executable path instead of the analyzed input file when debugging a shared library
• Fix: Fixed breakpoint removal after the debugger exits
• Fix: Fixed unreadable memory during TTD when the readable region is smaller than a cache block
• Fix: Fixed the register cache not being invalidated after a successful register write
• Fix: Fixed incorrect module end addresses on macOS with the LLDB adapter
• Fix: Verified the Authenticode signature of the downloaded WinDbg MSI bundle

Packaging and Licensing

New Features in Free

The most common request from Binary Ninja Free users was for AArch64 support, and with 6.0 it’s finally here! The free edition now decompiles armv8 (AArch64) in addition to x86, x86_64, and armv7 (with Thumb2). That covers the overwhelming majority of binaries most people run into today, and we’re happy to make the free version even more useful.

Adding armv8 also removed the reason we held back an ARM Linux build of Binary Ninja Free. So 6.0 ships a free installer for ARM Linux, available on the Binary Ninja Free download page.

Armv8 isn’t the only thing new in Free for 6.0. Our new MCP server is included, so you can point your favorite LLM at Binary Ninja and let it use our analysis completely for free. Free keeps getting more powerful under a yellow sun.

Everything else stays the same. It’s still free for non-commercial and commercial evaluation uses. The remaining limitations (no API or plugins and a reduced set of ILs) still apply. If you need any of our other architectures, the full breakdown of what ships in each edition lives on the purchase page.

Sidekick Free

In case you missed it over on the Sidekick blog, we recently launched free Sidekick credits for ALL Binary Ninja users with active support. You don’t need a credit card for a trial or to sign up. Just install the plugin and start using it. The included free credits refill every month.

Pricing and Packaging

As we outlined in our 6.0 pricing changes announcement, collaboration is no longer included with Ultimate by default. It is now a per-seat add-on available for named, computer, and floating Ultimate licenses. You can choose to add it to only the seats that need shared projects, versioned check-ins, real-time chat, and more.

We have also removed the old minimum seat count needed to get access to the Binary Ninja Enterprise Server. Enterprise Servers are no longer licensed separately: customers with the collaboration add-on or floating Ultimate licenses can download and self-host as many servers as they need, wherever they need them.

Server Deployments

The new packaging also greatly improves how Enterprise Servers are managed. Instead of receiving a license for each server, you now create a server deployment in the Binary Ninja Portal. A deployment represents one server installation and belongs either to your account or to a team you manage.

From the portal’s new Server Deployments page, you can create a deployment, assign floating licenses, and download a server bundle for your chosen platform, release channel, and version. The server bundle includes everything needed to set up the server, and will look very familiar to those who have deployed Enterprise Servers in the past. If the floating licenses assigned to a deployment change, you can also download only a new license bundle without having to download the entire server bundle again.

Each floating license can be assigned to only one deployment at a time; if a multi-seat floating license needs to be divided across deployments, split it in the portal first, then assign each resulting license to the appropriate deployment. Floating licenses can also be released from one deployment and reassigned to another. This lets you decide exactly how to distribute your floating seats across as many self-hosted deployments as your environment needs.

Open-Source Contributions

Special thanks to the following open-source contributors whose PRs were merged into this release:

• appleflyerv3 [#8246]
• ArcaneNibble [#7859]
• bloombit-dev [#8180]
• ChrisKader [#8249]
• grant-h [#8119]
• haileys [#8050]
• jonpalmisc [#8267]
• jrozner [#8164]
• owah [#8362]
• SmoothHacker [#1106]
• utkonos [#7868]
• xitska [#8270]
• endeavor [TMS320C6x Contributions]

We appreciate your contributions!

Everything Else

Analysis / Core

• Feature: Added abs, min, and max IL instructions
• Feature: Added bswap, popcnt, clz, ctz, cls and rbit instructions
• Feature: Added an SSA instruction for partial variable writes in HLIL
• Feature: Added support for loading local stack variables from PDB debug info
• Feature: Added type convergence detection to prevent non-converging type inference
• Improvement: Added wmain to analysis.mainFunctionDetection.mainSymbols so navigate-to-main also finds wmain
• Improvement: Added a fast-fail to the Itanium RTTI parser for large unbacked sections
• Improvement: Added an MLIL analysis pass to better separate partial writes when the upper bits are unused
• Improvement: Capped recursive function pointer type growth to a deterministic, parameter less spelling
• Improvement: Improved PDB import to collect locals and parameters from blocks contained in a FrameProcedure
• Improvement: Improved function inlining to handle nonstandard return registers
• Improvement: Improved recovery of sp-based locals during PDB import
• Improvement: Improved the accuracy of the pvs tooltip across all ILs
• Improvement: Introduced BiDiReferenceMap and used it for the code, data and type reference indices, unifying their previously separate forward and reverse halves
• Improvement: Preserved outlined strings with inferred typedefs
• Improvement: Refined type convergence detectors
• Improvement: Simplified clz(x) u>> log2(W) to x == 0 in HLIL
• Improvement: Used variable SSA instead of memory SSA for direct access to array variables or structure fields in HLIL
• Improvement: Wired structured demangler simplification for stdlib templates through the core
• Fix: Fixed HLIL SSA loop condition phi expression mappings
• Fix: Fixed HLIL SSA memory versioning for aliased partial writes and initializers
• Fix: Fixed HLIL SSA missing a memory version increment for nested structures written through a pointer
• Fix: Fixed HLIL null comparisons dropping pointer offsets
• Fix: Fixed IL for functions that referenced an address before a data variable was defined there, requiring re-analysis when the variable’s type changed
• Fix: Fixed LLIL SSA to preserve register stack outputs
• Fix: Fixed MLIL stack offsets not being reloaded correctly through local variables
• Fix: Fixed PDB import to only adjust stack-pointer-relative locals on x86_64
• Fix: Fixed original_filename purge option not clearing identifying information from the display_name and virtual path fields
• Fix: Fixed case-insensitive search not matching strings with different casing
• Fix: Fixed custom string types displaying non-ASCII characters as escaped UTF bytes instead of the decoded text
• Fix: Fixed demangling of certain mangled Microsoft x86_64 symbols that were previously left unresolved
• Fix: Fixed incorrect HLIL translation of pointer arithmetic involving lea that produced bogus comparisons like this != -0x10
• Fix: Fixed malformed HLIL structure accessor generated when applying a structure type to a variable computed with consecutive adds instructions
• Fix: Fixed scattered return values not being combined correctly in MLIL/HLIL when a function’s return type is wider than a single return register
• Fix: Fixed Find in HLIL missing matches when HLIL line addresses are non-monotonic
• Fix: Fixed GetTypeForAccess returning incorrect fragments for struct accesses spanning multiple fields
• Fix: Fixed a crash caused by deep mutual recursion between DefaultLiftFunction and CheckForInlinedCall when lifting deeply nested inlined calls
• Fix: Fixed a deadlock causing UI freezes when analysis was running while many types were being created
• Fix: Fixed a stack overflow crash in the GNU3/MSVC demanglers when demangling deeply recursive crafted names
• Fix: Fixed a crash caused by cycles in the GNU3 demangler
• Fix: Fixed a crash from malformed LLIL indirect branch targets
• Fix: Fixed a crash from unbounded recursion during function inlining when two functions directly call each other
• Fix: Fixed a few copy assignment operators to correctly handle self-assignment
• Fix: Fixed a potential divide by zero in alignment checks
• Fix: Fixed a race condition in AddDataReferences that could crash due to a missing lock
• Fix: Fixed a use-after-free in the GNU3 demangler when expanding a template parameter pack
• Fix: Fixed a use-after-free involving custom function architecture context
• Fix: Fixed a use-after-free when a function was added to a component and its symbol was retired in the same batch
• Fix: Fixed addition of signed range PossibleValueSets
• Fix: Fixed an assertion failure caused by using a variable ID where a variable index was expected
• Fix: Fixed an out-of-range crash in symbol name truncation used by the disassembly text renderer
• Fix: Fixed calculation of struct bit field member offsets during PDB import
• Fix: Fixed calculation of addition of two UnsignedRange values when both start and end overflow
• Fix: Fixed calculation of the addition of two identical PVS ranges
• Fix: Fixed crashes from a null BinaryViewRef when GetViewOfType raced with view removal
• Fix: Fixed creation of Variables that could not be represented in their compact internal representation
• Fix: Fixed creation of void data variables at call targets that had not yet been typed
• Fix: Fixed demangling of symbols in binaries built with MSVC’s /d2FH4 flag
• Fix: Fixed detection of long strings
• Fix: Fixed function type propagation to callers when a committed type change only affected confidence
• Fix: Fixed handling of demangled results with no type information
• Fix: Fixed incoming but resolved partial accesses being incorrectly treated as parameters
• Fix: Fixed indirect stack offset loads in MLIL
• Fix: Fixed invalid IL instruction access in MLIL_STORE_STRUCT_SSA
• Fix: Fixed missing symbol name for __chkstk and other compiler-inserted functions in PE binaries
• Fix: Fixed non-deterministic lifted IL for no-return tail calls
• Fix: Fixed recursive function pointer detection misclassifying refined callbacks as growth
• Fix: Fixed removal of composite parameter variables when they appeared unused
• Fix: Fixed speculative data variable widths depending on function analysis order when two functions access the same address with different widths
• Fix: Fixed stack adjustment analysis to treat an empty value as 0
• Fix: Fixed stack propagation through pointer typedefs
• Fix: Fixed the demangler not creating types referenced from demangled names that don’t already exist
• Fix: Fixed the default location not updating when changing the type of a return value
• Fix: Fixed the string-finding analysis pass overwriting existing typed data variables
• Fix: Fixed two bugs caused by function return values being unintentionally discarded
• Fix: Fixed type propagation dropping typedefs during normalization
• Fix: Marked the err family of libc functions as noreturn in the type library, preventing bad disassembly after calls to them

Performance

• Improvement: Improved performance of loading ELF binaries with many sections not mapped into the address space
• Improvement: Improved component tree performance
• Improvement: Improved performance of IsELFDataRelocation for armv7 by using a switch instead of std::map
• Improvement: Improved performance of string annotation detection by skipping constants that aren’t mapped addresses
• Improvement: Improved performance of string detection by eliminating unnecessary allocations
• Improvement: Improved symbol throughput by removing non-demangling SymbolQueue consumers
• Improvement: Used a custom allocator for C++ containers in the free edition
• Fix: Cached log row size hints to keep the log view responsive under heavy logging
• Fix: Fixed memory leaks in the Python and Rust APIs
• Fix: Fixed a memory leak of DataRenderer instances
• Fix: Fixed several crashes that occurred when loading a database under low free memory conditions

UI

• Feature: Added Create Struct Member at Offset to the Type View
• Feature: Added a hover preview for extern symbols that includes type information
• Feature: Added a context menu action to remove tags
• Feature: Added a description column to the Project Browser
• Feature: Added a function signature table to the edit function dialog
• Feature: Added a new UI for array-style settings
• Feature: Added a setting to control outline visibility
• Feature: Added an argument assist popup when typing function calls
• Feature: Added an option to disable Snippets
• Feature: Added optional headers to sidebar widgets
• Feature: Added optional size hints for splitters
• Feature: Added support for custom data in flow graphs
• Feature: Added support for diagonal scrolling in graph view
• Feature: Added support for extensible filter actions in the UI
• Feature: Added the ability to change the scrollbar width
• Feature: Grouped extern symbols by originating library in Linear View for Mach-O and PE binaries
• Feature: Open sourced all default themes and added an alpha channel to colors in .bntheme files
• Improvement: Accepted a lone ? as a full-byte wildcard in FlexHex search
• Improvement: Added wmain to the list of entry point names recognized by the navigate to main setting
• Improvement: Added a helper for background sorting and filtering of flat UI models
• Improvement: Added horizontal scrolling to the History View
• Improvement: Added horizontal scrolling to the Stack View
• Improvement: Added the ability to hide columns in the project browser
• Improvement: Allowed the command palette to search project files by their full project path (e.g. Project/File.exe)
• Improvement: Dispatched token double-clicks to plugins in linear and graph views
• Improvement: Displayed the external library name in the sticky header in linear view when many symbols are imported from the same library
• Improvement: Hid the relative address in the goto dialog when it is not needed
• Improvement: Improved Display As and type toggle behavior in the UI
• Improvement: Improved default highlighting and fixed tab order
• Improvement: Improved rendering of tokenized text views
• Improvement: Improved syntax highlighting for code blocks
• Improvement: Improved toggling of integer display signedness
• Improvement: Made the command palette also look up UIAction aliases
• Improvement: Normalized theme handling and added support for stylesheets specified as arrays
• Improvement: Released all default UI themes as open source
• Improvement: Sorted Memory Map segments and sections numerically by address
• Improvement: Sorted switch blocks in graph view by case number
• Fix: Added missing copy shortcuts
• Fix: Darkened string color in the classic theme
• Fix: Fixed Linear view navigation to data added since the last refresh
• Fix: Fixed Linear View losing the current navigation position when word wrapping shifted line layout after toggling the sidebar
• Fix: Fixed Stack View allowing single-item actions when multiple items were selected
• Fix: Fixed Symbol view folders re-expanding after being collapsed
• Fix: Fixed ViewFrame::navigate unconditionally raising and activating the window, causing focus to be stolen when reverting an undo action
• Fix: Fixed context menus for calls when the call target is HLIL_IMPORT
• Fix: Fixed crash in the Add Type Library dialog when canceling without selecting a platform
• Fix: Fixed incorrect possible value set display at MLIL that showed undetermined even though the correct values were available
• Fix: Fixed stack view only allowing selection of the first item when multiple items share the same offset
• Fix: Fixed zero-sized fields no longer showing up in the UI
• Fix: Fixed a crash caused by a null pointer in setHighlightToken
• Fix: Fixed a crash that could occur when displaying the Type Library Explorer
• Fix: Fixed a crash when double-clicking a function header in linear view
• Fix: Fixed a few unintentionally hardcoded colors to use themed colors instead
• Fix: Fixed a lock inversion in the type browser
• Fix: Fixed a scoring bug in the command palette
• Fix: Fixed a strict weak ordering violation in the OptionsDialog view sort comparator
• Fix: Fixed a threading issue when saving navigation history
• Fix: Fixed auto symbols shadowing user-defined symbols in the component tree
• Fix: Fixed content being lost when resizing a view
• Fix: Fixed crash in the UI when the base structure or member type of a named type reference could not be resolved
• Fix: Fixed dropping files or folders onto the project table
• Fix: Fixed horizontal scrolling artifacts
• Fix: Fixed inaccurate possible value set tooltip for variables outside of MLIL SSA
• Fix: Fixed incorrect text shown when undefining a type or field
• Fix: Fixed line wrap width calculation to stop using view width, which the UI could not adapt to without significant rework
• Fix: Fixed multi-line form dialog inputs forcing a minimum width that caused unwanted horizontal scrolling
• Fix: Fixed navigation raising and activating the wrong window when using detached sidebars
• Fix: Fixed tab text and tooltip not refreshing to show updated display names until the next UI event
• Fix: Fixed the Settings Resource dropdown to list each open tab separately instead of collapsing tabs of the same file into one entry
• Fix: Fixed the Symbols view to respect collapsed folders during navigation and selection changes
• Fix: Fixed the Workflow view incorrectly accepting navigation requests it couldn’t handle, preventing it from acting as a catch-all navigation sink
• Fix: Fixed the container browser and universal architecture selector to use the project file name instead of the file metadata name
• Fix: Fixed the symbol widget not showing all symbols defined at the same address
• Fix: Fixed truncation of file paths in the triage view
• Fix: Improved default highlighting and fixed tab key order in array settings UI
• Fix: Restored the placeholder helper text in the Create Types from C Source dialog

Architectures and Platforms

• Feature: Added ARM and Thumb lifting for VRHADD and VRECPE, and fixed SBC immediate handling
• Feature: Added FreeBSD PowerPC and RISC-V support
• Feature: Added armv8 support to the free version
• Feature: Added a little-endian octeon MIPS architecture
• Feature: Added architecture callbacks for selecting the initial linear sweep alignment
• Feature: Added architecture-specific linear sweep capabilities
• Feature: Added automatic import and application of JNI types
• Feature: Added big-endian support for the C-SKY v2 architecture and fixed recognition of big-endian M-CORE binaries
• Feature: Added decoding and lifting support for RISC-V Zba, Zbb, and Zbs bitmanip extensions and WCH instructions
• Feature: Added disassembly and lifting support for Apple’s vendor-specific aarch64 instructions
• Feature: Added lifting for the ARM vcvt.f64.s32 and vmov.f64 instructions
• Feature: Added return value location handling for the x86/x86_64 ELF ABI
• Feature: Added support for WCH vendor-specific RISC-V extensions, including a hardware-accelerated memory copy and custom compressed instructions
• Feature: Added support for ARM64_RELOC_BRANCH26, ARM64_RELOC_GOT_LOAD_PAGE21, and ARM64_RELOC_GOT_LOAD_PAGEOFF12 relocations on aarch64
• Feature: Added support for big-endian NDS32 architecture
• Feature: Added support for the RISC-V Zbs single-bit bit-manipulation instructions
• Feature: Implemented RISC-V Zba address-generation instructions
• Feature: Implemented some Zbb bit-manipulation instructions for RISC-V
• Feature: Implemented the remaining Zbb instructions for the RISC-V architecture
• Improvement: Added ABI-sized heuristic return sizing for MIPS R5900
• Improvement: Coalesced Thumb IT blocks with trailing conditional branches
• Improvement: Emitted abs instructions during lifting for the csky architecture
• Improvement: Emitted abs, min, and max instructions during aarch64 lifting
• Improvement: Emitted abs, min, and max instructions when lifting Hexagon code
• Improvement: Emitted abs, min, and max instructions when lifting nds32 code
• Improvement: Emitted bswap, clz, and rbit instructions during lifting for armv7
• Improvement: Emitted bswap, popcnt, clz, ctz, cls, and rbit instructions directly during lifting on aarch64 instead of using intrinsics
• Improvement: Emitted bswap, popcnt, clz, and ctz instructions during x86 lifting
• Improvement: Expanded ARM, Thumb, and NEON lifting coverage for the ARMv7 architecture
• Improvement: Improved MIPS n32 ABI support
• Improvement: Improved defaultarch inlining to detect registers set to the caller’s return address and treat jumps to them in the callee IL as returns
• Improvement: Improved heuristic return sizing to use ABI-based sizes for MIPS R5900
• Improvement: Improved library tracking for imported symbols in Mach-O binaries
• Improvement: Improved support for the octeon and n32 MIPS ABIs
• Improvement: Improved x86 LLIL flag lifting for arithmetic, test, rotate, and shift instructions
• Improvement: Lifted abs, min, and max instructions for the tricore architecture
• Improvement: Lifted more TriCore instructions added in the 1.8 architecture revision
• Improvement: Preserved native symbols when generating macOS dSYMs
• Improvement: Recovered implicit this parameters in GNU3-mangled symbols
• Improvement: Updated RISC-V Zbb bitmanip lifting to use first-class LLIL operations for min/max, clz/ctz, and popcount
• Improvement: Updated aarch64, armv7 and x86 lifting to emit new bitwise operation IL instructions
• Improvement: Used a 64KiB default page size on AArch64 Linux
• Fix: Added special handling for 0000 in RISC-V disassembly to work around a binary parsing issue
• Fix: Fixed ARMv7 vcvt lifting and added support for lifting scalar vabs directly when lane and register widths match
• Fix: Fixed Thumb2 IT conditional block analysis so subsequent instructions like b are correctly recognized as conditional
• Fix: Fixed ARMv7 rev instruction lifting that lost the initial most-significant byte
• Fix: Fixed DWARF import using the wrong address width for unknown architectures
• Fix: Fixed Thumb-2 ELF functions referenced from .gnu_debugdata being created as ARM functions instead of Thumb-2
• Fix: Fixed WCH RISC-V architecture registration and ELF relocation lookup by renaming it to rv32gc_wch to match the existing RISC-V architecture
• Fix: Fixed IT instruction info in the Thumb2 architecture
• Fix: Fixed full-width bit field instruction lifting for BFI and BFC on ARMv7
• Fix: Fixed incorrect lifting of x86 ANDN/PANDN/VPANDN
• Fix: Fixed incorrect lifting of double precision FMOV immediate on aarch64
• Fix: Fixed stack adjustment for pop r16 on x86
• Fix: Fixed x86 MOVSS lifting to zero-extend the memory-source form
• Fix: Fixed LHA instruction encoding on TriCore
• Fix: Fixed lwpc and restore.jrc lifting for nanoMIPS
• Fix: Fixed a BinaryView leak in VxWorksViewType::IsValidForData
• Fix: Fixed a demangling error for MSVC-mangled operator+ overloads on basic_string
• Fix: Fixed a bounds-checking issue in the Mach-O parser to improve robustness
• Fix: Fixed a crash from a malformed PE exception directory table size
• Fix: Fixed a crash when looking up token hover values for architecture-less items
• Fix: Fixed a crash when reading a malformed CFString in Mach-O binaries
• Fix: Fixed a hang during MIPS ELF symbol lookup caused by a malformed symbol table with a GOT entry outside valid memory regions
• Fix: Fixed a missing CALLI variant in the TriCore architecture added in 1.8
• Fix: Fixed a race condition in x64 platform view initialization on Windows
• Fix: Fixed adding the image base when looking up section-relative symbols in ELF files
• Fix: Fixed alternate names in the PPC32 and thumb2 type libraries and added an API to remove alternate names
• Fix: Fixed an out-of-bounds read during Thumb-2 lifting
• Fix: Fixed analysis giving up on Hexagon functions with Exceeds 'analysis.limits.maxFunctionUpdateCount' errors
• Fix: Fixed correctness issues in the GNU3 demangler
• Fix: Fixed disassembly of RISC-V 0000 trap instructions that some compilers insert after jumps
• Fix: Fixed handling of ARM64_RELOC_GOT_LOAD_PAGEOFF12 and ARM64_RELOC_GOT_LOAD_PAGE21 relocations for aarch64
• Fix: Fixed handling of non-monotonic records in Intel Hex files
• Fix: Fixed inability to override architecture selection for Thumb2 ELF files with an even entry point address
• Fix: Fixed incorrect instruction info for Thumb2 IT instructions
• Fix: Fixed incorrect ordering when popping values from a register stack
• Fix: Fixed inline return detection to avoid treating LLIL_JUMP(reg) as an inline return when the callee uses a nonstandard return register
• Fix: Fixed lift for pop with segment registers on x86
• Fix: Fixed lift of JAL on RISC-V by properly setting the return register
• Fix: Fixed lifting for MOVSS and ANDN on x86
• Fix: Fixed lifting of sbc.s on ARMv7 so the overflow flag is computed instead of left unimplemented
• Fix: Fixed lifting of full-width bit field instructions on ARMv7
• Fix: Fixed out-of-order TriCore disassembly operands for instructions added in 1.8
• Fix: Fixed the GNU3 demangler to use its registered config path
• Fix: Fixed the RISC-V architecture not disassembling the sh2add instruction
• Fix: Fixed the PE loader creating symbols for debugging metadata symbol entries
• Fix: Fixed the ARM/Thumb2 function platform for .gnu_debugdata symbols
• Fix: Fixed the carry flag not being lifted for the ARMv7 lsl.s instruction
• Fix: Fixed the rounding flag not being properly emitted on some x86 floating point instructions
• Fix: Fixed type lookup for Thumb function pointers by normalizing the address before lookup
• Fix: Fixed unimplemented ARMv7/Thumb2 lifting for several multiply/divide, sync primitive, and SIMD/FP instructions including vld1, vst1, vldmia, vstmia, umaal, and clrex
• Fix: Hardened Mach-O parsing against out-of-bounds reads by tightening bounds checks and bounding rebase/bind entry limits
• Fix: Ignored R_RISCV_RELAX relocations on RISC-V
• Fix: Implemented C, P, A, and O flags for sbb.d, lsr.d, and.b, and xor.d instructions
• Fix: Marked _exit as non-returning for iOS Thumb
• Fix: Marked abort and other noreturn functions as __noreturn on Apple platforms to prevent them from appearing to fall through
• Fix: Fixed the default calling convention for MSP430, which was backwards

Core Plugins

• Feature: Added a strings table to the shared cache triage view, showing strings from every image in the shared cache
• Feature: Added a KernelCache workflow activity to rename stubs in __auth_stubs sections based on their target symbol name
• Feature: Added a recursive load button to the Dyld Shared Cache triage view
• Feature: Added an activity to rename objc_msgSend stub functions, helping with stripped binaries such as macOS 27
• Improvement: Added Objective-C support for method type strings using pointers relative to the selector base address, as seen in iOS 27 shared caches
• Improvement: Added back the BinExport command to all paid product versions
• Improvement: Improved UX when loading the shared cache
• Improvement: Improved handling of shared cache files in projects
• Improvement: Reduced log noise when loading iOS/macOS 27 shared caches
• Improvement: Refactored the DSC symbols table to use TriageTablePanel, adding asynchronous loading, filtering, and sorting
• Improvement: Resolved cross-image stub functions to their target image in KernelCache context menu actions
• Improvement: Set region display names for the KernelCache to make it easier to obtain segment bounds
• Improvement: Stored processed Objective-C metadata in the database instead of regenerating it on load
• Improvement: The triage view is now always shown when opening a shared cache or kernel cache
• Improvement: Used the demangler API for exported function names in the binexport plugin
• Fix: Fixed IDB import not being freed
• Fix: Fixed headless loading of a bndb extracted from a container being parsed as Raw/Mapped instead of restoring the analyzed database
• Fix: Fixed miscellaneous crashes in the Objective-C plugin when analyzing malformed binaries
• Fix: Fixed Load /usr/lib/libFoo.dylib context menu action in the Dyld Shared Cache view to resolve cross-image stub functions to their target image
• Fix: Fixed objc_msgSend$stub functions incorrectly appearing in __objc_stubs on iOS/macOS 27 shared caches
• Fix: Fixed a potential object lifetime issue in DSC (Dyld Shared Cache) support
• Fix: Fixed insufficient bounds checking on UTF8 CFStrings in the Objective-C analyzer
• Fix: Fixed missing parameter types on Objective-C methods in shared caches
• Fix: Fixed potential crashes from using invalid plugin objects
• Fix: Fixed resolution of calls via __auth_stubs in the kernel cache for iOS 27 / macOS 27
• Fix: Fixed the Objective-C workflow overriding user-specified call types for objc_msgSend calls, preventing users from refining inferred types to account for variadic arguments
• Fix: Fixed the DSC triage view not being displayed by default when reopening a dyld shared cache from disk
• Fix: Fixed the type library utility plugin not loading

Extension Manager

• Fix: Fixed Extension Manager hanging until a request timed out when closing it while an unreachable third-party repository was configured
• Fix: Fixed installed plugins missing their descriptions in the Extension Manager
• Fix: Fixed a null pointer crash in the plugin install API
• Fix: Fixed a crash when a plugin repository returned a non-JSON response
• Fix: Fixed a null pointer dereference when the plugin repository is missing
• Fix: Fixed handling of empty unofficial repository URLs in the Extension Manager
• Fix: Fixed handling of installed extensions that have since been removed
• Fix: Fixed handling of plugins with no dependencies
• Fix: Fixed installed plugin titles in the Extension Manager not being clickable links to their repositories
• Fix: Fixed license text rendering as plaintext in the Extension Manager
• Fix: Fixed lock ordering issues in the Extension Manager
• Fix: Fixed memory leaks in the Extension Manager
• Fix: Fixed migration to also reinstall legacy plugin dependencies
• Fix: Fixed native wheel installation failures caused by pip not inheriting the system PATH when resolving native dependencies like clang
• Fix: Fixed pip installation errors not being shown in the UI when plugin dependencies fail to install
• Fix: Fixed plugin actions not being available immediately after loading a plugin
• Fix: Fixed plugins without dependency providers failing to load
• Fix: Fixed repository booleans not actually disabling repositories
• Fix: Fixed several situations where the Extension Manager did not select the latest plugin version
• Fix: Fixed the Extension Manager to properly override old repo URLs when new ones are added
• Fix: Fixed the Extension Manager crashing Python when plugin_status.json is invalid
• Fix: Fixed the Python plugin install API to default to the latest version
• Fix: Fixed the UI hanging when disabling or uninstalling a plugin while the Extension Manager is updating
• Fix: Fixed the UI hanging when installing a Python module from the Extension Manager
• Fix: Fixed the dependency install dialog repeatedly prompting to install dependencies that were already installed
• Fix: Fixed the plugin dependency dialog not resolving \n newlines in its JSON output
• Fix: Fixed the Extension Manager writing a failed download’s error response to disk as a zip instead of failing early on a non-200 status code
• Fix: Fixed the Extension Manager prompting to force-install plugins even when the installed version satisfies requirements
• Fix: Fixed the Install Python Dependency action hanging the UI by running pip installation as a background task
• Fix: Fixed the deferred uninstall state not resetting after a plugin was reinstalled
• Fix: Fixed the Extension Manager using the wrong target directory when updating plugins
• Fix: Fixed version sorting in the Extension Manager

Collaboration / Projects

• Feature: Added an AuthenticateWithToken API for Enterprise to authenticate directly with a token
• Feature: Added configurable columns to the Project Browser, similar to macOS Finder or Windows Explorer
• Improvement: Changed the Enterprise Server version to a structured VersionInfo type instead of a plain string
• Fix: Fixed Enterprise snapshot mapping lookups on push when connected
• Fix: Fixed project names not resolving on the New Tab page after the project’s first open
• Fix: Fixed a crash in collaboration chat during window teardown
• Fix: Fixed crash when the collaboration user list was empty
• Fix: Fixed navigation to an already-open tab instead of the requested container entry when opening multiple entries from the same container in a project
• Fix: Fixed the project table view to accept file and folder drop events instead of trying to open them
• Fix: Fixed the open tab’s name and project browser display name not updating live when a project file was renamed
• Fix: Prevented downloading a .bndb before an initial snapshot has been pushed

API

• Feature: Added API for deprecated plugins
• Feature: Added API to reload the database connection
• Feature: Added APIs for measuring Unicode string width in character cells and breaking strings into grapheme clusters, and constrained derived strings to the enabled Unicode blocks
• Feature: Added Python constructors for fragment types
• Feature: Added Binary Similarity APIs
• Feature: Added BNSimplifyDemangledTemplateName API
• Feature: Added new license APIs
• Feature: Added recognize_constant_data to the StringRecognizer API
• Feature: Added type slices, a primitive type representing a byte range within a child type without being a pointer
• Feature: Added Unknown() and IsUnknown() builder functions to Unimplemented IL across LLIL/MLIL/HLIL
• Feature: Added an API to query UIAction aliases
• Feature: Added an API to specify the file to reopen for moved databases
• Feature: Added an API call to remove alternate names from a loaded type library
• Feature: Added support for __typeof__ and decltype to the Clang type parser
• Feature: Added support for populating alias fields into extraSearchableText for UI actions, allowing plugins to namespace their command-palette entries
• Feature: Added support for specifying clang compiler flags when creating BNTLs
• Feature: Added the OnTokenDoubleClicked notification hook to UIContextNotification
• Feature: Exposed flow graph construction to the API
• Feature: Exposed an API for running string detection on arbitrary buffers, enabling detection over an entire shared cache
• Feature: Introduced config-based demangler APIs (BNDemanglerConfig and BNDemanglerResult) with unified demangle and template-simplification functions, replacing the legacy demangler entry points
• Feature: Re-added the License tab and license text field to the API
• Improvement: Added a BinaryView field to LinearDisassemblyLine
• Improvement: Added a reason field to MLIL_FORCE_VER for use in automated variable splitting
• Improvement: Added comparison operators to VersionInfo
• Improvement: Added helper methods to DominatorTree for walking immediate dominators
• Improvement: Added static DataRendererContainer::RenderLinesForData as a replacement for the DataRenderer::RenderLinesForData member function
• Improvement: Consolidated the C++, Python, and Rust demangler APIs around a config-driven design
• Improvement: Extended MLIL call instruction outputs to be expressions
• Improvement: Improved PyInitConfig based Python initialization
• Improvement: Integrated template simplification into the structured GNU3/MSVC demanglers
• Improvement: Made DataBuffer implicitly convert to std::span
• Improvement: Made DefaultWebsocketClient::connect asynchronous instead of blocking
• Improvement: Made basic block accessors lock-free for the C API
• Improvement: Migrated Python demangler bindings to route through the DemanglerConfig/DemangleResult C API, with structured template simplification support
• Improvement: Refactored the MSVC demangler to parse symbols into structured type nodes before finalization
• Improvement: Removed unused path manipulation functions from the C API
• Improvement: Replaced NotImplemented in Architecture patch methods with default values or errors
• Improvement: Replaced the isAuto parameter of BinaryView::StoreMetadata to allow persisting metadata without marking the file as modified
• Improvement: Updated bnpython3 to read from stdin when the input file is -
• Improvement: Updated core demangle APIs to use registered demanglers
• Fix: Added missing fields to BNLicenseAddon
• Fix: Added missing initialization calls in the Python API
• Fix: Fixed Python Metadata object comparisons to use BNMetadataIsEqual
• Fix: Fixed Shiboken warnings caused by bad enum conversions in the Python API
• Fix: Fixed GNU3 demangler template and backref handling by using shared type nodes for substitutions and nested names
• Fix: Fixed Function.set_user_inline_during_analysis raising a TypeError instead of setting the value
• Fix: Fixed GetSystemCacheDirectory to use the documented paths
• Fix: Fixed LowLevelILFunction::AddOverflow to store its operands in the correct fields of the expression
• Fix: Fixed demangle_ms returning invalid types and mishandling attributes for vftables, multiple inheritance, and parameterless functions
• Fix: Fixed leaks caused by unclear ownership of Menu instances
• Fix: Fixed Make Enum storing concrete types instead of named type references
• Fix: Fixed Metadata::operator== to perform a value comparison instead of a pointer comparison
• Fix: Fixed SESSION_COUNT not incrementing when cloning a Session
• Fix: Fixed _inline_during_analysis_with_confidence not converting InlineDuringAnalysisWithConfidence in the Python API
• Fix: Fixed copy_expr_to and added builder methods for recently-added instructions in the Python API
• Fix: Fixed a crash when registering an Architecture or ArchitectureHook multiple times in Python
• Fix: Fixed a NameError in get_block_lines caused by referencing an undefined instr variable instead of block
• Fix: Fixed a memory leak in the Python API where BNParseExpression errors weren’t freed with BNFreeParseError
• Fix: Fixed a parameter swap bug in IsSSAVarLiveAt for MLIL SSA that caused incorrect liveness results
• Fix: Fixed a potential crash caused by an invalid FileContext current frame during close
• Fix: Fixed an overflow error in Shiboken on Linux when converting uint64_t values greater than INT64_MAX
• Fix: Fixed custom demangler dispatch on Python 3.14
• Fix: Fixed demanglers failing to compile on the API side due to an include on core-only unicode.h
• Fix: Fixed exceptions from __del__ on StructureType, EnumerationType, and NamedTypeReferenceType during Python interpreter shutdown
• Fix: Fixed handling of modules parameter when passed as either a list or a string
• Fix: Fixed handling of no-type results in the demangler
• Fix: Fixed handling of zero-width types returned by a custom Demangler in the Python API
• Fix: Fixed incorrect reference counting in the C++ API
• Fix: Fixed leaks caused by missing parenting of Qt objects
• Fix: Fixed missing initialization in several APIs that could leave objects in an uninitialized state
• Fix: Fixed the Visual C++ name demangler failing on certain mangled names, such as those containing @@@
• Fix: Fixed the Python API missing get_default_load_settings_for_data, which was referenced in example code but never implemented
• Fix: Fixed the stub generator to be less strict about leading indentation
• Fix: Guarded against use of disposed BinaryView handles
• Fix: Made loader.syntheticSectionBase writable instead of read-only
• Fix: Re-added the license text field to the API
• Fix: Replaced bare except: clauses with except Exception: in the Python API to fix signal propagation

Rust API

• Feature: Added Rust APIs for custom function lifters
• Feature: Added FlowGraphLayout and accompanying APIs for custom flow graph layouts to the Rust API
• Feature: Added a transform module to the Rust API
• Feature: Added support for owned Settings handles in the Rust API
• Improvement: Migrated the Rust demangler bindings and consumers to the new C contract
• Improvement: Removed the BinaryViewExt trait and its blanket impl from the binary_view module
• Improvement: Refactored the default implementation of BinaryViewBase::save to save raw file contents
• Fix: Fixed Rust plugin dSYMs not preserving native debug symbols for C/C++ dependencies
• Fix: Fixed Activity::new_with_action in the Rust API storing a stack pointer to the callback closure, causing use-after-free when the closure captured variables
• Fix: Fixed load_with_options_and_progress to correctly accept None for options
• Fix: Fixed a missing operand field when round-tripping text tokens in the Rust API
• Fix: Fixed a use-after-free in Function::set_int_display_type in the Rust API
• Fix: Fixed improper use of Ref<T> in collaboration project function signatures in the Rust API
• Fix: Fixed off-by-one accesses to operand lists in MediumLevelILInstruction::lift that could cause a crash or incorrect data being read
• Fix: Fixed the Rust save bindings for custom binary views
• Fix: Removed an unused dependency on libdbus from the Rust secrets provider
• Fix: Renamed Settings::new to Settings::global in the Rust API to remove a foot gun

Debugger

• Improvement: Disabled the debugger.useMemoryMapSegments setting by default
• Improvement: Remembered the last checked access types in the TTD next/prev memory access dialog
• Improvement: Rendered debugger dependencies in a readable format instead of a single-line JSON blob
• Fix: Fixed LLDB version detection on macOS and Linux
• Fix: Fixed TTD sidebar widgets showing on non-TTD platforms
• Fix: Fixed TTD target termination to occur on the engine thread
• Fix: Fixed a DebuggerController reference leak caused by AttachProcessDialog
• Fix: Fixed a null pointer crash in DebuggerUI::CreateForViewFrame when UIContext::contextForWidget returned null
• Fix: Fixed a strdup memory leak in GetPathBaseName
• Fix: Fixed a bounds check issue in RLE decoding (DecodeRLE)
• Fix: Fixed a bug where deleted debugger controllers were nulled instead of erased from the controller list
• Fix: Fixed a crash caused by DebuggerController being freed while detached worker threads for Launch/Attach/Connect/Go/Step*/RunTo*/Restart/Detach were still running
• Fix: Fixed a crash in CorelliumAdapter::BreakInto when m_rspConnector is null
• Fix: Fixed a crash when reading stack variable parameters for calls in the debugger IL views
• Fix: Fixed a leftover debug thread not being joined in the WindowsNativeAdapter destructor when a debugged process exits on its own
• Fix: Fixed a null pointer dereference in DbgEngAdapter::ReadMemory and WriteMemory
• Fix: Fixed a null pointer dereference in EsrevenAdapter::GetProcessList
• Fix: Fixed crashes from missing null checks on m_rspConnector in WriteMemory and TTD call query
• Fix: Fixed potential crash from missing nullptr checks on returns from the LLDB API
• Fix: Fixed several memory leaks in the debugger
• Fix: Fixed the debugger throwing an exception when parsing certain integers in the remote protocol
• Fix: Rejected a TTD launch when no trace was specified
• Fix: Removed a redundant 100x Release() loop from the DbgEng adapters’ Reset()

Documentation

• Feature: Added an example plugin that recognizes and displays Rust string slices
• Improvement: Documented side-by-side installs
• Improvement: Documented the difference between Forget This File and Remove From Recent Files
• Improvement: Documented the difference between unimplemented and unknown LLIL states
• Improvement: Documented the target memory map being mirrored as segments
• Improvement: Improved documentation for context-aware control-flow recovery, lifting, and disassembly
• Improvement: Improved the large file section of the troubleshooting documentation
• Improvement: Made the sidebar navigation collapsible in the Python API docs
• Fix: Corrected the kernel cache support matrix, which incorrectly listed support for iOS versions predating MH_FILESET
• Fix: Fixed the multitool.py file download example to actually save the downloaded file

Other

• Feature: Allowed opening databases without opening a file
• Improvement: Changed linker behavior to more closely match gcc
• Improvement: Compiled jsoncpp into a separate namespace when built as part of core, allowing it to be included in statically linked builds
• Improvement: Improved IDB (IDA Pro database) file support
• Improvement: Renamed the BNTL commands root to Type Library
• Improvement: Updated to Qt 6.11.1, raising the minimum PySide Python version to 3.10
• Improvement: Updated to LLVM 22.1.8 and raised the minimum supported Python version
• Fix: Enabled creation of .pyc files in the system cache directory
• Fix: Fixed Zstd decompression of files with multiple concatenated frames
• Fix: Fixed sys.executable not being properly set for bnpython3
• Fix: Fixed a crash on startup caused by a malformed settings.json
• Fix: Fixed a deadlock on quit between RunGuard teardown and the URL handler thread
• Fix: Fixed crashes caused by unsafe use of printf-style logging calls
• Fix: Fixed incorrect Python code signing on macOS
• Fix: Fixed missing Python entitlement on macOS
• Fix: Fixed normalization of the virtualenv path setting
• Fix: Fixed potential crash in BNPathExists, BNIsPathDirectory, and BNIsPathRegularFile when the filesystem operation throws an exception
• Fix: Fixed update channel detection to use manifests instead of hard-coded GUIDs

With such a large release, we’ve done more than even the list shown here. For even more details, check out our closed milestone on GitHub.

A few weeks ago I was watching a YouTube video that covered my earlier research on the UCPD driver, and for a split second I saw a registry key that I have been searching for an example of for some time. I contacted the video’s author and obtained the key from his machine. It was Base64 encoded and to my surprise, once I decoded it, it started with MZ.

Sure enough, it’s a valid Windows executable sitting inside a registry key. This post is the story of both taking it apart as well as the bug I found that means the whole mechanism is dead anyway.

A Quick Refresher on UCPD

If you have not read my earlier post on UCPD, here is the short version.

UCPD stands for User Choice Protection Driver and its entire job is to protect your default browser choice. On Windows, setting the default browser used to be a matter of writing a registry key with the correct hash. UCPD put a stop to that: now, only the Windows Settings app is allowed to do it and the driver specifically blocks a list of Microsoft’s own utilities like reg.exe, powershell.exe, rundll32.exe that could otherwise be tricked into modifying the setting.

Browser vendors (and spyware/adware authors!) were not thrilled. They found workarounds, Microsoft tightened the driver, they found new workarounds, and so on. I covered that cat-and-mouse game in the blog post above and in a lightning talk at RE//verse 2025 already, so I won’t rehash it here.

There was one loose end from that research, though. Buried in the driver is a code path that loads some configuration from this registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UCPD\DR

Unfortunately, I couldn’t analyze it because on every machine and VM I have, the key is empty.

A PE with No Code

We can see from the FlyTech video “Microsoft Added This Driver to Windows and Said Nothing”, that on his machine, DR had a value. He read DR as “Disaster Recovery,” which, as we’ll see below, is probably not the case.

FlyTech is based in Europe, which could explain why he has the key set. The entire UCPD saga grew out of the EU browser choice rules, so it would not be surprising if Microsoft only pushes these policy blobs to European users. To be clear though, this is only a guess.

As mentioned earlier, after we Base64 decode it, it is a PE file.

So: is Microsoft running a binary on your machine behind your back?

No. And that relates to the first interesting thing about this file. I opened it in Binary Ninja and there is no code in it at all. This is not a parsing bug – it only has a tiny .rdata section containing what looks like encrypted data, plus an Authenticode certificate at the end of the file.

>>> list(bv.functions)
[]

But why wrap data in a PE at all, if nothing is ever going to execute it?

Presumably, by packaging the payload as a signed PE, Microsoft gets to reuse the entire Authenticode code-signing infrastructure for free and the driver can verify that only Microsoft could have produced this blob before it acts on the contents. This is actually a very sensible design decision. You really don’t want a kernel driver consuming policy from a registry key that any administrator could overwrite.

Now that I have both halves of the puzzle – the encrypted blob and the code that decrypts it – we can finally figure out what it does.

Reversing the Loader

This driver is quite easy to reverse because every stage logs an ETW event with a descriptive tag of the action. Reading top to bottom, process_DR does exactly what you would expect:

Stage 5 is the one I cared about. I asked Sidekick, our AI assistant, to reverse the decryption function. Its answer: this is a custom XOR stream cipher. A hash function derives a set of seeds from the key, those seeds generate a keystream, and the keystream gets XORed against the ciphertext. Nothing exotic.

It also renamed everything as it went: expand_key_state, derive_keystream, and the two mixing functions. That turned the wall of sub_140004xxx calls into something you can actually read. I had a quick glance at the code and it seemed correct.

Reimplementing the Cipher

Then I had Sidekick re-implement the whole thing in Python.

Before I could run the code, I noticed that the cipher needs a 32-byte key, but the function doesn’t have one baked in. Thus, it has to come from the data itself.

Looking at the start of .rdata, it is not hard to see that it begins with a u32 schema version of 0x3ec, followed by a u32 of 0x238, which looks exactly like the length of the ciphertext. If I take the next 0x20 bytes as the encryption key, the remaining bytes in the section are exactly 0x238. It all checks out! The layout is shown below:

I handed this to Sidekick and asked it to decrypt the blob. However, despite my high expectations, the result was garbage:

00000000: fe 2a 56 4a e3 ff fb 5b 9f 78 91 bd 2b d0 5c 59  .*VJ...[.x..+.\Y
00000010: 0d 92 1f e9 10 c0 44 8f 0a 2d c5 2d c8 b9 54 7d  ......D..-.-..T}
00000020: be bd 53 65 68 2b b4 08 63 f0 69 89 2e 4c a0 7a  ..Seh+..c.i..L.z
00000030: 2d ca 1c 50 75 00 80 09 f3 ef 41 8e 78 67 7f 49  -..Pu.....A.xg.I
00000040: f5 0a 1e f2 b1 49 05 b5 8e b2 51 2d 27 44 0f 1c  .....I....Q-'D..
00000050: 36 6f bc 39 8f cb 60 49 ee 1c 46 0e 16 a2 b1 91  6o.9..`I..F.....
00000060: 92 40 27 84 64 02 92 41 a2 ec a8 dc d1 4f 54 3f  .@'.d..A.....OT?

My first impression was that Sidekick blew it. So I asked Claude Code to redo it with Binary Ninja’s MCP server. I deliberately only gave it the binary instead of the analysis database, so it could not be affected by Sidekick’s renaming or type information.

This time it wrote another script, which produced the exact same garbage output. When challenged, it even brought Unicorn in and emulated the code to argue that it had done everything correctly.

The chances of two AIs getting it wrong in exactly the same way seemed quite low, so I suspected something weird was going on. I just couldn’t immediately tell what it was so I sat on it for a while.

Finding the Right Hash

After stewing on the problem some, I decided to Google several of the magic constants used in the cipher. This was how we used to do things without AI! There were a few hits, and none of them appeared to be helpful. Then, out of pure luck, I decided to search with DuckDuckGo, and this time I got a promising hit: CalcHash_CS64. It appears to implement the same algorithm in C.

Still doubtful, I handed that to the AI anyway and asked it to see if it could get anywhere. And this time it actually worked! The blob decrypts to something readable:

00000000: 01 00 00 00 03 00 00 00 0c 00 00 00 28 02 00 00  ............(...
00000010: 01 00 00 00 f4 03 00 00 0c 00 00 00 18 02 00 00  ................
00000020: 0e 00 00 00 ee 03 00 00 0b 00 00 00 1a 00 00 00  ................
00000030: 2a 00 5c 00 64 00 6c 00 6c 00 68 00 6f 00 73 00  *.\.d.l.l.h.o.s.
00000040: 74 00 2e 00 65 00 78 00 65 00 ee 03 00 00 0b 00  t...e.x.e.......
00000050: 00 00 12 00 00 00 2a 00 5c 00 72 00 65 00 67 00  ......*.\.r.e.g.
00000060: 2e 00 65 00 78 00 65 00 ee 03 00 00 0b 00 00 00  ..e.x.e.........

And the only difference between the two versions is that CalcHash_CS64 uses MD5 to derive the seeds, while our reimplementation uses SHA-512. But UCPD’s code clearly uses SHA-512 to derive the seeds:

Here is what I think happened. At some point somebody at Microsoft looked at this code, saw MD5, and decided to harden it with SHA-512. But they only changed the driver, and forgot to update the code that generates the ciphertext.

I don’t think the failure is silent, either. That DecryptData failure path is not a debug print, it is an ETW telemetry event. So somewhere at Microsoft there should be a steady drip of decryption failures firing every time this key is parsed. To be clear, I have not debugged a live machine to confirm that, but it is fairly clear from the code. If you happen to work on UCPD at Microsoft: go check your telemetry!

With that said, AI did a great job but we’re not quite at AGI yet.

What is in the Dynamic Rules

We can see 14 program names from the decrypted blob:

*\dllhost.exe    *\reg.exe       *\rundll32.exe   *\powershell.exe
*\regedit.exe    *\wscript.exe   *\cscript.exe    *\cmd.exe
*\InfDefaultInstall.exe          *\pwsh.exe       *\wmiprvse.exe
*\regini.exe     *\bssafe.exe    *\mshta.exe

If you read my first UCPD post, that list will look extremely familiar. These are Microsoft’s own signed binaries – they pass the “is it signed by Microsoft” check trivially – so they get their own denylist. Otherwise flipping the default browser would be as easy as asking reg.exe to do it for you, which defeats the purpose of the driver.

Now, why ship this in a registry key at all? The very same list of names is already hardcoded in UCPD.sys.

Remember the key is called DR. I don’t believe it’s Disaster Recovery, but rather it stands for Dynamic Rules. Changing the driver’s behavior normally means shipping a new UCPD.sys, and then getting users to install an update and reboot. With this channel, Microsoft can push a policy update as a signed blob in a registry value and have it take effect on the next load. It is similar to a definition update for an AV product.

And it is considerably more than a list. I had the AI reverse the dispatcher as well. The decrypted buffer is a nested TLV tree – first a u32 count, then records of [type][value kind][length][payload] – walked by a dispatcher that looks up each type in a handler table populated at driver init. Five of them are registered:

Our blob is a single type 3 record. Deny and allow are independent structures with separate locks, so a config can deny broadly and then carve out exceptions. Each handler takes a lock, rebuilds its structure from scratch, and emits an ETW event tagged with the rule name and a schema version.

For now the list it ships is identical to the one already compiled into the driver, so at the moment it changes nothing – but the machinery is there for the day a browser vendor finds a new way around the protection.

I also wrote a Kaitai Struct definition for it and rendered the parsed tree directly in the Binary Ninja UI using our Kaitai UI plugin (with a patch).

Why this Crypto? The “Patent Hash”

The story could end here, but there is one more thread that ties everything together.

Throughout the analysis, the AI kept referring to the hash function as the “patent hash”. I assumed this was a hallucination, but Microsoft holds an actual patent on this exact cipher: US 6,570,988 B1 (expired around 2020), “Simple technique for implementing a cryptographic primitive using elementary register operations.”

And it is the same algorithm Windows uses to compute the UserChoice association hash.

Think back to the pre-UCPD world. Under the UserChoice key you had a program ID and a Hash value. That hash mixes your username, the program ID, the extension or protocol, and a timestamp. If it does not validate, Windows ignores your default and falls back to Edge. It is the tamper-evident layer that UCPD was later built to enforce in kernel mode. It was reverse engineered by Christoph Kolbicz back in 2017. Firefox later implemented the same algorithm so it could set itself as the default browser without walking the user through Windows’ settings UI.

Now it is clear why Microsoft would roll their own cipher instead of just using AES: they didn’t quite. They had this lying around from UserChoice, so they reused it.

On AI + RE

There is no doubt that AI is getting better rapidly, and that more and more RE work can be handled by it. I still remember the shock when I heard that at last year’s DEF CON finals, a team’s AI beat both human players to a VM challenge from LiveCTF. Exactly a year later, that is not surprising at all. In fact, AI has become so good at RE that it is now hard to find challenges it cannot solve.

AI is only going to get better – better than most human reverse engineers. However, as this post shows, we still need a real person to examine its results and steer it when things do not check out automagically. Plus, only a human can appreciate the irony of a broken algorithm in the broader sense.

References

• Inside Windows’ Default Browser Protection – my earlier UCPD research
• FlyTech Videos, “Microsoft Added This Driver to Windows and Said Nothing”
• 276793422/CalcHash_CS64 – the reference implementation that broke the case open
• US 6,570,988 B1 / WO2000078118A2 – the Microsoft patent
• SetUserFTA: UserChoice hash defeated – Christoph Kolbicz on the original use of the patent hash
• UCPD.sys - UserChoice Protection Driver - Part 2 – Kolbicz’s follow-up research on UCPD
• https://hitco.at/blog/windows-userchoice-protection-driver-ucpd/
• https://github.com/xusheng6/ucpd_analysis – all of my UCPD analysis databases and tooling
• 202606_DR/ – everything from this post: the .reg captures, the extracted PE, the analysis databases, a standalone decrypt_reg.py, and the Kaitai definition

Ten Thirteen Years, One Timeline

This post might be finishing off our ten year celebration, but when we looked at the history we had to go back even further to before we started Vector 35! For all the details, check out out interactive timeline: every stable release, every milestone, and the community moments that have made this journey so special.

Explore the timeline

Let’s look at some of the highlights:

• Vector 35 was founded on January 14th, 2015, and Binary Ninja first went on sale July 23rd, 2016. That’s eighteen months of building before anyone could buy anything. In the meantime, we were self-funding from our work on the Cyber Grand Challenge and other contracting work.
• Two days after we incorporated, we shipped an MMO. Pwn Adventure 3: Pwnie Island ran as that year’s Ghost in the Shellcode CTF. The PwnAdventure series actually predates the company, and all of it is on the timeline in the pre-history section.
• The community existed before the product did. Our Slack went live during the beta, months before there was anything we were willing to sell. The API repository was also live and got its MIT license in April 2016, three months ahead of launch. We’ve always had a healthy plugin ecosystem as that was a goal right from the start!
• Binary Ninja was not a decompiler for its first four years. High Level IL didn’t go a stable build until 2.0 in May 2020. While some of our customers considered MLIL good enough for work, we always considered 2.0 the first “true decompiler”.
• We started with, and remain committed to open source. The original Python prototype, the core architectures, Decompiler Explorer, the Debugger and WARP are all out there under open licenses, a trend we expect to continue into the future.

You can also see how the rate of commits has been increasing over time! Not linear with the team-size, but we’ve been rapidly improving the rate at which we ship featuers, even prior to the advent of semi-trustworthy AI coding.

What the Last Ten Days Looked Like

We ran our first-ever sale. A major 35% off in celebration of the last decade for the last ten days and it’s now closed. If you caught it, thank you! If you didn’t, and you’re reading this before the upcoming 6.0 release and are interested in a commercial license or above, you should still consider buying (or renewing) now before the upcoming price change! (Non-commercial will actually see a price-decrease at the 6.0 launch)

We also gave something away every single day: shirts, bottles, mugs, stickers, a training seat, and several full licenses including an Ultimate license. Winners are listed as they confirm in the original post.

Because we’ve had a number of unclaimed prizes so far, once we let all the 5 business day limits pass, if we have any remaining un-allocated prizes, we’ll do a separate narrower drawing to limit the number of folks who are inelgibile or uninterested.

Alongside all that we published the details behind our upcoming pricing changes, and rolled out a brand refresh – new logo, more character art, and updated styling working its way across the product, the site, and the documentation. There’s even more changes to come with the website, so keep an eye on it!

Thank You

Ten years is a long time to work on one problem, and the only reason it’s been possible is the people who bought licenses, filed bugs, wrote plugins, gave talks, argued with us in Slack about issue priority, and generally made this a community rather than a customer base.

Thank you. Genuinely. We had a great ten days celebrating with you, and we’re looking forward to finding out what the next decade’s timeline looks like.

Sign up for the mailing list if you want to hear about it first.

The short version:

• Non-Commercial is getting cheaper
• Commercial is going up in price
• Our “introductory” Ultimate pricing is ending
• The renewal discount is changing and rewards auto-renewal
• Enterprise is moving from one-size-fits-all bundles to an add-on structure
• Finally, yes, despite industry trends, the product will remain a perpetual license

The new prices will take effect when we release 6.0 (code-named Krypton). We are currently targeting August 19th, 2026, but the best source of truth is the public Krypton milestone on GitHub. If we make changes to the planned release date, you’ll see it there first.

Until then, current prices remain in effect, and the 35% anniversary discount (coupon 10YRS35OFF, good through August 1st at noon ET) still stacks on top of today’s prices. If you have been thinking about buying or renewing, now is the best time!

• Why We’re Making These Changes
• New License Pricing
• Perpetual Licensing
• Renewals
• Enterprise Changes
• Most Savings

Why We’re Making These Changes

We don’t change our prices often, and when we do, we try to explain ourselves. Here is why we’re doing it:

• It’s been a long time. Non-Commercial has been $299 since 2020. Commercial was last adjusted in November 2022. This is quite a long time, especially with global prices and our operating costs rising so much over that period.
• We are ending introductory pricing. The Ultimate edition’s price has been temporary since we introduced it while we added features. It’s got quite a few now!
• The product is dramatically more capable. Since those prices were set, we have shipped the Ultimate edition (with Firmware Ninja and a number of additional decompilation architectures), Enterprise 2.0, Sidekick’s AI-assisted analysis, WARP for function matching, a fully-featured debugger with time-travel support, and a steady stream of decompiler and language improvements (Go, Swift, Rust, Objective-C, C++, and more) across our 4.x and 5.x releases and our upcoming 6.0 release will feature even more improvements. We’ll have a lot more on that topic in our ten-year retrospective later this week.
• We are rewarding the customers who make our lives easier. Our new auto-renewal option will get the best rate going forward, and Enterprise customers who use fewer features will pay less.

Raising prices lets us keep investing in the product at the pace we have been and, just as importantly, keep Binary Ninja a one-time purchase you own forever rather than a subscription you rent.

New License Pricing

A new license is a one-time purchase that includes one year of updates and support, and the license never expires. You can keep running the last version you received forever. Here is what a new purchase costs today versus after 6.0:

A few things worth calling out:

• Non-Commercial’s price is going down, from $299 to $199. It has been $299 since we released the decompiler back in 2020, and we would rather keep the hobbyist, student, and personal-use tier as accessible as possible. (The rarely-used Non-Commercial “Computer” license is being retired; Non-Commercial will be named-only going forward.)
• The student discount rate is unchanged at 75% off. Because it is a percentage of the base price, student pricing follows the new prices: student Non-Commercial drops from $74 to $49, while student Commercial rises from $374 to $449.
• Ultimate’s price was always introductory. When we launched Ultimate in 2024 we said the $2,999 price was introductory and would rise. It took us two years, during which time we added Firmware Ninja and four more decompilation architectures (M·CORE, Hexagon, NDS32, TMS320C6x).
• Collaboration is becoming an add-on. More on that in the Enterprise section.

Perpetual Licensing

Your Binary Ninja license does not expire. Renewing extends access to updates and support for an additional year but it is not required to use versions you’ve had access to.

As commercial software has increasingly moved toward subscriptions, we considered whether we should too. The advantage is a more consistent funding model, but we didn’t feel it was right for us.

Instead, with 6.0, we are reducing our renewal discounts. This does increase the price of renewals, but they remain discounted from the cost of a new license and unlike a subscription, the software does not expire.

We believe this strikes the right balance: your renewal supports continued development, while you retain a perpetual license and are never forced to keep paying merely to continue using the tool you’ve already paid for.

Renewals

With 6.0 we are changing renewals in two ways: The discount is changing, and the new auto-renewal option is now cheaper than manual renewal.

We want to be upfront about this: for Commercial and Ultimate, renewals are going up meaningfully. There are two reasons behind the change. First, the old renewal was set many years and features ago, and ongoing development, which is what support renewals pay for, has accelerated enormously in that time. Second, auto-renewal makes life easier for both us and customers who want to keep getting the latest versions and we want to reward them. In fact, Non-Commercial’s new renewal rate is now cheaper if you set up auto-renewal.

Enterprise Changes

The biggest structural change is to how we sell Enterprise and collaboration features. While it might initially raise costs for Enterprise customers, in the long-run it will let organizations pay for only what they need.

Collaboration itself was always a subscription (client licenses continued to function after support ended but collaboration did not), and that is not changing.

Until now, every Enterprise deployment started with a server bundle. The bundle included a minimum purchase of a licensed server plus three floating Ultimate seats, regardless of which features you actually needed. With 6.0, we are no longer pricing the server separately and are moving toward an à la carte model:

• There is no minimum bundling. You buy the Ultimate licenses you need – named, computer, or floating – and nothing else is required.
• Collaboration is a per-seat add-on ($1,299). The versioned, shared project database with real-time chat that used to define Enterprise is now something you add only to the seats that need it.
• Servers are no longer licensed individually. You can decide how many self-hosted Enterprise servers to split your floating licenses between. This is especially useful for customers with multiple segregated networks.

The trade-off should be clear: a large team that uses everything Enterprise offers will pay more than before, but a team that only needs a subset can spend less. Some concrete examples for three seats:

The customers that will see increases are the largest deployments that use every feature at scale. If you run a large Enterprise deployment and want to walk through what the new model means for your specific configuration, please reach out and we will work with you before your next renewal.

Most Savings

So how can you get the most savings possible?

• Buy at current prices, with 35% off on top. Our 10-year anniversary coupon, 10YRS35OFF, is good through August 1st at noon ET and stacks on top of today’s pricing for Non-Commercial, Commercial, and Ultimate.
• Renew early to lock in current renewal pricing. As long as you have less than a year of support remaining, you can renew now at today’s rate. If you want to renew multiple years in advance, that’s fine too! Just wait until after August 1st when the coupon ends and the renewal system will be back to allowing early-renewal. You can purchase multiple times and extend your support out at the current price.
• Existing customers keep their current support. Changing prices never affects updates you have already paid for. If your support is active, you continue to receive updates at no additional charge until it lapses. If you don’t renew, you’ll still have access to all of your databases and be able to use existing versions though of course we’re sad to see you go.

As always, if you have questions about how any of this applies to your situation, our support team and the community Slack are the best places to reach us. Thanks, as ever, for ten years of trust – we do not take pricing decisions, or your support, lightly.

Ten years ago tomorrow, we shipped the first build of Binary Ninja. In the beginning, there were just four of us looking to take on the monumental task of building a commercial-grade decompiler from scratch. We knew it would be a lot of work, but we were excited to take our ideas about how we could improve the state of the art and make a difference in a community we had long been involved in. A decade later and we’ve had tens of thousands of customers put their trust in us. Other than the name and having a dark theme, the product feels light-years different from the version we first launched with. And the most surprising thing of all? The amazing community that has grown around the tool. The super active plugin ecosystem, Slack, people posting tips on YouTube, and all the amazing feedback we’ve been given over the years have truly blown us away.

Given all that, we’re going to celebrate it in style. Over the next ten days we’re running 10 Days for 10 Years: our first-ever sale, a giveaway every single day, and more blog posts covering where we came from, where 6.0 is going, and a fresh new facelift for the brand.

• The First (and Maybe Only) Binary Ninja Sale
• Ten Days of Giveaways
• What Else Is Coming
• A New Look
• Thank You

The First (and Maybe Only) Binary Ninja Sale

In ten years we have never put Binary Ninja on sale. Not on Black Friday, not at conferences, not for any other occasion. We’ve offered “welcome back” discounts for former customers, and we’ve offered our student discount and sometimes we’d give away shirts or other items, but that’s it. Our pricing has always been firm so people knew that the best time to buy was always now.

We’re making an exception for the next ten days.

Yes, that’s 35% off, and given that prices are changing with 6.0, this is the lowest price Binary Ninja will ever be for most editions, by a large margin. Maybe we’ll do this again in 10 more years, but don’t be surprised if we wait 35 years instead! Thirty-five is, of course, our favorite number!

There are a few things to note about the coupon code. First, no exceptions. If you miss this time window, that’s unfortunate, but we will not be extending the time window. Payment must be received before the coupon expires or it will not be valid. Second, the code is valid for all editions of Binary Ninja you can purchase automatically online. This includes Ultimate, Commercial, and Non-Commercial. Third, current customers can take advantage of this discount too! As long as you have less than one year of support left on your license, you can renew early and add another year at the discounted rate. Finally, it can’t be stacked with our two other discounts – the student discount and the welcome back discount.

We’re so happy we’ve been able to thrive and grow over the past decade and this is a small way we can say thank-you.

Buy Binary Ninja →

Ten Days of Giveaways

Every day for the next ten days we’re giving something away. Giveaways include our awesome branded items, a training seat, and even several full licenses.

No purchase is necessary to enter or win, and the only requirement is being on our mailing list. The full Terms and Conditions have all the details, including how winners are picked and notified, and the handful of regions we unfortunately can’t include because of local sweepstakes laws.

We’ll come back and fill in the Winners column below as we go – each day’s drawing is run through random.org, and we’ll list the winners here in anonymized form.

You must be subscribed to our mailing list to be eligible. Winners are drawn from the subscriber list each day and notified by email. Sign up here – it takes about ten seconds, and it’s also where you can hear about all the latest updates. Don’t worry, it’s a very low-volume list!

There are no hoops to jump through. Subscribe, and you’re in for every remaining drawing. If you’re already on the list, you’re already eligible and you don’t need to do anything.

What Else Is Coming

The sale and the giveaways are just the start. We’re publishing several blog posts over the next week looking both backward and forward.

• A Look Back – a proper retrospective on how Binary Ninja got here: the decisions that worked, the ones that didn’t, what the product looked like before it had a decompiler, and a few stories you probably haven’t heard. If you’ve only known Binary Ninja since it got good, feel free to come back and see the before-times when that wasn’t the case!
• The Road to 6.0 – we’re going to walk through what’s landing in 6.0, code-named Krypton. We’ll also have our usual feature stream. Of course, the hardcore fans already know you don’t have to wait for us since the Krypton milestone on GitHub is public.
• Pricing Changes – Binary Ninja prices are changing when we release 6.0, going up for most editions. We’ll publish a dedicated post in the next week with the specific numbers and, more importantly, the reasoning: the changes since we last updated prices, how long it’s been, and what’s happened in that time period.

We’re telling you before it happens rather than after, and the 35% off is live now, which means anyone who wants to buy (or renew!) has ten days to do it.

A New Look

Another way we wanted to celebrate the last decade was to make some branding changes. We love both our original logo and our whole mascot team. But if we’re honest, we haven’t always been consistent with the logo, colors, and styling so we took the opportunity to not only do a website refresh but to standardize across the product, social media, and websites. There are mostly small changes, but we love that they take what’s good and make it even better.

This brand refresh includes a new logo, a growing cast of character art, and updated styling rolling out across the website, social media, and documentation. The documentation is currently on a test branch if you want a sneak peek. Come check it later, but if you haven’t seen the documentation in a while you might already be surprised at how much it’s changed!

• User Documentation – the user guide, from getting started through the deeper analysis features
• Python API Reference – the full Python API
• Rust API Reference – the Rust API

Team Binjy

We wanted to give a special thanks to the artist behind all of our awesome Team Binjy artwork! If you’ve enjoyed all the cool graphics that accompany our stable releases, you have them to thank!

Thank You

We started Vector 35 almost twelve years ago now, and we’ve spent the vast majority of that time focused on one hard problem. We’ve only been able to do it because of the community. To all of you for buying licenses, filing bugs, spreading the love, writing plugins, giving talks, and joining our Slack to point out why your favorite GitHub issue should be prioritized higher than we thought…

Thank you! You’ve made this better than we could have ever expected and we’ve loved every minute. We’re looking forward to the next decade, and hope you are too.

We also wanted to send a special thank-you to our longest running customer. Sierra Haex purchased a license the second day we were on-sale and has maintained a license since then! We’ve sent her a special thank-you package and extended her license for another 10 years for free! Thanks for your loyalty and support! ❤️

Don’t miss the rest of it: the daily giveaways, the retrospective, the 6.0 preview, and the pricing details all go out to the mailing list first. Subscribe here.

Today we’re releasing a new “R2” for Jotunheim. This second stable release of 5.3 primarily contains stability fixes with a heavy emphasis on crashes and hangs (in part thanks to our new Sentry infrastructure). This release should result in a much more stable reverse engineering experience.

As always, customers with active support on the development branch have access to these changes and more.

BinaryView Fixes

• Multiple fixes for crashes loading malformed Mach-O binaries and binaries with malformed Objective-C metadata
• Fixed a hang when loading an ELF MIPS binary containing a corrupt symbol table
• Fixed long analysis stalls on malformed size claims in C++ RTTI data
• Fixed malformed PE exception directory causing large allocations / hangs
• Fixed a memory leak from VxWorks view loading (Ultimate only) (#8075)

Analysis and Architectures

• Multiple Thumb-2 lifting fixes including an out-of-bounds read during lifting, and incorrect handling of IT (conditional) instructions
• Fixed an out-of-bounds read when lifting certain Rust binaries (#8155)
• Fixed a crash from unbounded recursion when two functions that call each other are both marked “inline during analysis”
• Fixed crashes when no default calling convention is registered for a platform (resulted in both PDB and WARP crashes) (#8196, #8181)

Stability: Races and Lifetimes

• Multiple fixes for crashes when a binary view is closed or removed while still in use
• Fixed a race condition on Windows x64 binaries during view initialization
• Fixed a WARP crash when its sidebar was deleted just as analysis completed

UI and Platform

• Fixed a crash rendering very long symbol names when the maximum symbol width setting is smaller than the symbol being truncated
• Fixed an abort when checking file paths the OS denies access to (e.g. permission errors while reading the keybindings file)
• Fixed a UI crash when a structure’s base type or a member type can’t be resolved from a named type reference
• Fixed keybindings not saving in the free version on macOS (#7253)

Debugger

The debugger received its own batch of 20 stabilization commits in this release. Apologies to those impacted by these issues:

• Multiple crash fixes in debug adapters when a connection is unavailable or drops mid-operation (#1073, #1076, #1077, #1078)
• Multiple object-lifetime and threading fixes (#1047, #1048, #1058, #1062, #1080, #1086)
• Fixed a deadlock and repeated resume-event spam with conditional breakpoints (#1051)
• Fixed the native Windows adapter being unusable after detaching from a target (#1050)
• Multiple error-handling improvements so failures while reading debuggee memory or communicating with remote targets are logged instead of crashing or being silently dropped (#1046, #1079, #1081)
• UI fixes: time-travel debugging widgets no longer appear for targets that don’t support it, and the debugger sidebar no longer steals focus every time the target stops (#1033, #1055)

These builds are now live on both our website and update servers. If you’re a Binary Ninja Free user, you can download a new installer here. If you’re a Personal, Commercial, or Enterprise user, the new build is available from the portal or via a license recovery email. And as always, you can update your existing client.

For Binary Ninja 5.3, we’re bringing features and fixes across a number of areas. For improved interoperability, we’ve added Ghidra Export to the existing Ghidra Import code and have improved our IDB Import capability. For new architectures and platforms, we’ve added NDS32 to Ultimate, a new ILP32 ABI for AArch64, and a new set of APIs for “weird” architectures. And of course, we’ve made a number of improvements to the UI including a new Universal Mach-O loader UI, usability improvements to the container browser, and a new “super” command palette! Plus, changes to the debugger, enterprise features, new opt-in crash reporting to help us squash bugs faster, and so much more!

• Architecture / Platform
  • New Architecture APIs
  • NDS32
  • AArch64 ILP32 ABI
• UI
  • Mach-O Architecture Picker
  • Container Browser Improvements
  • Command Palette Refresh
• Types & Signatures
  • Type Library Utilities
  • WARP Improvements
• Interoperability
  • Ghidra Export
  • IDB Import Improvements
• Enterprise
• Debugger
  • Hardware and Conditional Breakpoints
  • New Debug Adapters
• Crash Reporting
• Open-Source Contributions
• Everything Else

Major Features

Architecture / Platform

New Architecture APIs

Building on the new architecture APIs added in 5.1, we’ve added a new set of APIs to support standalone function-level lifting. Our initial design for Binary Ninja was optimized for multithreaded analysis with as little state as possible so that each basic block could potentially be analyzed in its own thread. However, for plenty of architectures (including a lot of VM-based ones such as Java, Python bytecode, .NET, etc.), there is far too much state or even metadata at the top of each function. The only way to handle such architectures is to enable a single thread to analyze the entire function. While the ABB feature in 5.1 added support for basic block recovery and analysis in a single thread, in 5.3 we now support full function-level lifting.

Internally, we’re using these APIs to work on our upcoming TMS320C6x support, but because we use the same APIs available to third parties, this also means other projects like banjo or some of the WASM plugins we’ve heard about could be updated for much better decompilation results using these new APIs.

Keep an eye out for an upcoming blog post explaining more about how you can leverage these APIs yourself!

NDS32

Ultimate customers will appreciate the brand new NDS32 support. We now have 18 officially supported architectures including full decompilation in our Ultimate/Enterprise edition!

AArch64 ILP32 ABI

It’s not enough to just have support for the instructions in a CPU architecture since there are lots of platforms or variants that need to be supported. For example, ILP32 adds a mode for AArch64 that has 32-bit pointers despite still using 64-bit mode. In 5.3, we’ve not only added the platform, but also updated our function recognizer for ILP32 PLT entries and fixed a bug related to the address size calculation.

UI

Mach-O Architecture Picker

While it’s long been possible to open a specific slice in a fat Mach-O or even adjust your settings to default to a particular slice, the UI around it was fairly painful, reusing our “Open With Options” dialog in a way that led to a lot of confusion.

In 5.3, you now get a much more streamlined dialog that lets you pick the architecture and, more importantly, makes it easy to set the default for future opens without having to dig through the settings! The dialog also shows the size of each slice, so you can quickly identify the one you need.

Container Browser Improvements

We first introduced the Container Browser in 5.2; however, we’ve made a number of improvements to both the container system and to the formats it supports!

Already Supported Formats: CaRT, Gzip, IntelHex, LZFSE, SRec, TiTxt, Zip, Zlib

New In 5.3: AR, Bzip2, CPIO, DMG (compression only), FIT, IMG4/KernelCache, LZ4Frame, LZMA, Tar, TRX, UImage, Universal Mach-O, XZ, Zstd

The Container Browser UI itself has also had a number of improvements, as well. It now remembers your most recent selection, can be triggered for files explicitly from the file menu (or by holding Ctrl+Alt and dragging/dropping), and the UI has been refreshed.

We’ve also added better documentation about the transform system and UI.

Command Palette Refresh

While we’ve had our command-palette for some time, in 5.3 we’ve turbocharged it with a ton of new features. You can prefix your search with various characters to get different behaviors. Note that the default CTRL/CMD-P hotkey defaults to “action search” (the previous behavior) but can be rebound to use any of the new behaviors.

• = Use the expression parser to calculate an address and navigate there (including a preview)
• > Action search, the previous default
• / Search recent files and projects, as well as open tabs
• @ Search function symbols (similar to searching in the symbol sidebar)
• ? Display available search prefixes
• t: Just search open tabs (useful as a bindable hotkey)
• " Search strings

For more details, check out our recent blog post about it.

Types & Signatures

Type Library Utilities

One of our major focus areas currently is our type system and how we collect, manage, and apply types. To that end, this release includes a new set of utilities to handle type libraries. This can be used to automatically create usable type libraries from a binary view or from files in a directory. For users with project support (currently commercial and above), type libraries can also be generated from files in a project.

See the BNTL plugin menu for the available commands:

There’s also a command-line version for headless automation for customers with headless support:

/t/bntl_utils_cli > ./bntl_cli --help
Generate, inspect, and validate Binary Ninja type libraries (BNTL)

Usage: bntl_cli <COMMAND>

Commands:
  create    Create a new type library from a set of files
  dump      Dump the type library to a C header file
  diff      Generate a diff between two type libraries
  validate  Validate the type libraries for common errors
  help      Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help
  -V, --version  Print version
/t/bntl_utils_cli > ls -l
total 13728
-rwxr-xr-x  1 jwiens  wheel  5498296 Apr  9 11:23 bntl_cli*
drwxr-xr-x  4 jwiens  wheel      128 Apr  9 11:37 headers/
/t/bntl_utils_cli > ls -l headers/
total 1360
-rw-r--r--@ 1 jwiens  wheel  690055 Apr  9 11:35 sqlite3.h
-rw-r--r--  1 jwiens  wheel     286 Apr  9 11:37 stdarg.h
/t/bntl_utils_cli > ./bntl_cli create sqlite3.dll "windows-x86_64" ./headers/ ./output |grep -v "Loaded native"
2026-04-09T15:40:37.966972Z  WARN binaryninja: User plugins disabled from command-line override logger=Default
2026-04-09T15:40:39.381327Z  INFO binaryninja: 10021 bundled types for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.381337Z  INFO binaryninja: 0 bundled variables for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.381339Z  INFO binaryninja: 77 bundled functions for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.384452Z  INFO binaryninja: 1 types for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.384459Z  INFO binaryninja: 0 variables for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.384461Z  INFO binaryninja: 0 functions for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.677619Z  INFO bntl_cli::create: Created type library 'sqlite3.dll': ./output/x86_64/sqlite3.dll.bntl

Keep an eye out for an upcoming blog post that will include more details about how these tools can make your life easier.

WARP Improvements

Last release, we added networked functionality to WARP, our tool for matching previously identified functions. This allowed users to push and pull function information from our server. Additionally, the v2 enterprise server release included a built-in WARP server for our enterprise customers. For this release we are continuing to improve the UX of interacting with the WARP server.

Pushing signatures is more straightforward with a new UI, and fetching signatures from the server uses less bandwidth by performing server-side matching.

For this release, we also deprecated SigKit (which can be re-enabled with analysis.signatureMatcher.autorun), with its removal scheduled for next release. To that end, we bundled signatures for common Linux libraries (libc6, libgcc, libstdc++) to finalize the migration from SigKit to WARP. These signatures are available for x86, x86_64, aarch64, and armv7.

Interoperability

Ghidra Export

We added Ghidra Import in Binary Ninja 5.2, and now we’ve come full circle with Ghidra Export capabilities in 5.3.

First, use the plugin menu to export a .gzf file:

Next, import the file into Ghidra:

That’s it! Now you’ll have all the types, symbols, bookmarks, comments, function starts, etc. that you had in Binary Ninja in Ghidra:

IDB Import Improvements

With this release, we overhauled our IDB (and TIL) import functionality. This new version processes more information and will work with many more IDA databases.

Enterprise

The biggest feature for Enterprise in 5.3 is that this is the first stable release since we launched our v2 Enterprise server. The new server comes with a number of major features:

• Bundled WARP server
• Server-wide search APIs
• Official rootless Podman support
• New deployment options

Check out the release blog post for more details. We encourage all Enterprise customers to migrate to v2, but we do plan to maintain the v1 server for some additional time to ease the transition.

Debugger

Hardware and Conditional Breakpoints

Two of our most requested debugger features are finally here: hardware breakpoints and conditional breakpoints, making your debugging workflow much more flexible.

To add a hardware breakpoint, press F3 or use Debugger / Add Hardware Breakpoint... (also available by right-clicking in the Breakpoint Widget). The dialog lets you pick the address, type (Hardware Execute, Read, Write, or Access), watchpoint size (1, 2, 4, or 8 bytes), and the entries show up in the Breakpoint Widget tagged HE/HR/HW/HA.

Conditional breakpoints attach to any existing breakpoint: right-click on a breakpoint (in either the Breakpoint Widget or the disassembly view) and choose Edit Condition.... Conditions support register names, arithmetic, comparisons, and memory dereferences (e.g., rax == 0x1234, [rsp + 0x20] != 0), and execution only pauses when the expression evaluates to non-zero.

New Debug Adapters

Two new debug adapters ship with 5.3:

The Windows Native Debug Adapter is a brand-new adapter built on top of the Windows debugging APIs and is now the default debugger on Windows. It comes with major performance improvements over the previous DbgEng-based adapter.

The GDB MI Adapter provides a new way to connect to GDB-compatible targets using the GDB Machine Interface protocol, fixing many corner cases in the previous GDB RSP adapter. It works seamlessly with gdbserver or GDB stubs such as those from QEMU, and includes support for TTD (Time Travel Debugging) via Mozilla’s rr. Currently Linux-only, with Windows and macOS support planned.

Crash Reporting

To ensure we can fix issues faster, in 5.3 we’ve added opt-in automatic crash reporting. The first time you launch 5.3 (unless you’ve already seen it on dev) you’ll see a prompt asking whether you’d like to share crash reports with us. In paid versions, it’s disabled by default. In the Free version, it’s enabled by default but you can still opt-out and you can change your mind at any time by changing the appropriate setting.

When enabled, a crash report contains:

• the OS version
• Binary Ninja version
• CPU architecture
• call stack at the time of the crash
• a list of loaded native libraries

No binary content or identifying information is intentionally included, though application and plug-in paths may contain your system username. Full details are in our privacy policy.

If you want to help us fix bugs faster, we’d appreciate enabling crash reporting but absolutely understand for many this is not desired which is why we default to NOT sending this information.

Open-Source Contributions

Special thanks to the following open source contributors whose PRs were merged into this release:

• 3rdit [#941, #943, #944, #946, #947, #969, #1026]
• chedahub [#7552]
• ekilmer [#7547]
• jonpalmisc [#7933]
• mostobriv [#7751]
• NicoleFaye [#962, #983, #991]
• nullableVoidPtr [#6423, #7965]
• razaina [#1004, #1005, #1006]
• SmoothHacker [#7780, #7788]
• trumank [#7797, #7825]
• utkonos [#7748, #7773, #7776, #7839, #7855]
• WHW0x455 [#7842]

We appreciate your contributions!

Everything Else

Analysis / Core

• Feature: Added ZxTransform to the transform system
• Feature: Added work provider signals for activity eligibility in workflows
• Feature: Added backward constraint propagation support to the Value Set Analysis (VSA) system
• Feature: Added PossibleValueSet::Compare to resolve set and range comparisons to constants
• Improvement: Added PossibleValueSet operation APIs and fixed Python PossibleValueSet bindings
• Improvement: Extracted thunk analysis into a standalone pass, decoupling it from the sigkit plugin to prepare for sigkit deprecation
• Improvement: Improved entry point detection to differentiate between a 0x0 entry address and no entry at all
• Improvement: Improved GNU3 demangler with support for new special-name and type constructs
• Improvement: Improved RTTI virtual function discovery to allow extern functions in MSVC vtables
• Improvement: Improved auto-naming of variables using parameter names from tail call targets
• Improvement: Improved memory efficiency of operand lists and label maps within IL instructions by replacing UNDEF instruction chains with a more compact representation
• Improvement: Improved performance by generating structure padding lazily
• Improvement: Improved performance of canMakeString by avoiding large scans for null terminators in UTF-16 and UTF-32 strings
• Improvement: Improved performance of non-namespaced type lookup in large BNDBs
• Improvement: Improved type propagation around offset pointers for better type inference
• Improvement: Moved zero-length section filtering from SectionMap to section creation APIs for more consistent behavior
• Improvement: Reduced map lookups during MLIL SSA translation for a 2-5% improvement in total analysis time
• Improvement: Reduced memory usage of function objects by 70% and their analysis data by 40% by restructuring storage of infrequently set fields
• Improvement: Represent operand lists and label maps more efficiently within IL instructions, replacing chains of UNDEF instructions
• Improvement: Rewrote GNU3 demangler for improved performance using DemangledTypeNode
• Improvement: Scoped RTTI loggers to their associated view for cleaner log output
• Improvement: Simplified HLIL expressions (X << Y) u>> Y and (X u>> Y) << Y
• Fix: Added validation for zero-sized symbol or string tables to prevent potential issues during analysis
• Fix: Fixed crash when readLEB128 is passed a null pointer
• Fix: Fixed crash when displaying a variable with null type in Pseudo-C and Pseudo-Rust
• Fix: Fixed DWARF import incorrectly linking functions without addresses to externs
• Fix: Fixed DWARF import incorrectly wrapping pointer types in named type references
• Fix: Fixed DWARF import wrapping function parameter types in unnecessary named type references
• Fix: Fixed GNU3 demangler float literal decoding to be platform-independent by using big-endian hex via union type-punning
• Fix: Fixed headless mode being prompted with an interaction for mismatched PDB during PDB import
• Fix: Fixed PDB bitfield members importing with wrong offset
• Fix: Fixed PDB parsing issue by removing stale QualifiedName state
• Fix: Fixed potential hang in DWARF import when encountering unhandled DW_AT_location variants for DW_TAG_variable
• Fix: Fixed undefined evaluation order in GNU3 demangler expression builders by sequencing reader-advancing calls into named locals
• Fix: Fixed use of uninitialized stack data in ABB
• Fix: Fixed PDB vtable type name parsing
• Fix: Fixed Analysis::DeleteUnusedAutoFunctions hanging for many minutes on large binaries with over 1 million functions
• Fix: Fixed FloatType alternate name not rendering in tokens when set
• Fix: Fixed LowLevelILFunction::GetInstructionsAt not working on SSA form
• Fix: Fixed MLILSSATranslator not consulting the Platform for global register information
• Fix: Fixed WorkflowMachine task name when resuming from an inactive state
• Fix: Fixed additional invalid ELF parsing issues
• Fix: Fixed anonymous type names conflicting with existing anonymous types
• Fix: Fixed crash in OutlineResolver caused by cycles involving named type references
• Fix: Fixed crash in WorkflowMachine when a workflow activity threw an exception
• Fix: Fixed crash when mapping to HLIL with a void variable type and an MLIL pointer expression type
• Fix: Fixed crash when opening a BNDB that references a non-existent named workflow
• Fix: Fixed data races in Function that could cause crashes during analysis
• Fix: Fixed FlexHex high nibble wildcard matching false positives on 0x7c
• Fix: Fixed forward type propagation to preserve NamedTypeReferences instead of resolving them to raw structs
• Fix: Fixed hang on close during pointer sweep analysis
• Fix: Fixed HLIL call rendering to correctly consider call type adjustments when displaying calls and parameter strings
• Fix: Fixed incorrect file backing when a memory region starts past the segment data length
• Fix: Fixed infinite loop/crash when adding a zero-length section
• Fix: Fixed lookup of basic block labels for higher-level ILs when the IL block start differs from the native block start
• Fix: Fixed miscellaneous issues with vtable type information in PDB processing
• Fix: Fixed non-deterministic tail call detection caused by stale basic blocks
• Fix: Fixed offset pointers imported with __offset attribute losing their offset due to struct member relationship not being preserved
• Fix: Fixed outliner incorrectly outlining scalar struct member writes
• Fix: Fixed outliner incorrectly outlining scalar struct member writes in arrays-of-structs
• Fix: Fixed PDB bitfield members importing with incorrect offset when the bitfield is placed at a storage offset greater than zero
• Fix: Fixed preservation of global pointer register value across call-site stack invalidations
• Fix: Fixed Python ABB incorrectly triggering guided analysis
• Fix: Fixed Python exception in FunctionLifterContext
• Fix: Fixed resolution of named type references for child types in OutlineResolver
• Fix: Fixed template simplifier to correctly account for [api:...] annotations
• Fix: Fixed type filtering to correctly respect underscores in type names
• Fix: Fixed unintentional fallthrough in HLIL simplification that caused exceptions
• Fix: Improved OutlineResolver handling when merging different stream types while writing to fully-typed byte arrays

UI

• Feature: Added “Copy as Rust Array” to the right-click context menu
• Feature: Added go-to address support in the native triage view
• Feature: Added structure data variables as objects in linear view
• Improvement: Added regex and case sensitivity options to FilterEdit widget
• Improvement: Added regex toggle to the component tree FilterEdit widget
• Improvement: Excluded .bndb files from the triage file picker to avoid opening database files in triage mode
• Improvement: Improved performance of the types view
• Improvement: Improved triage view responsive layout to adapt better to different window sizes
• Improvement: Improved outliner to recursively resolve nested struct types
• Improvement: Improved performance of Bookmarks actions by avoiding full function iteration to check validity
• Improvement: Improved performance of the types view by removing recursive expansion, switching to unordered_map, and using uniform row heights
• Improvement: Made analysis conflict dialog labels selectable for easier copying
• Improvement: Made the cross-reference view non-modal when opened in dialog mode
• Improvement: Shows function tags in the linear view sticky header
• Improvement: Sorts menu actions case-insensitively for consistent ordering
• Improvement: Updated entropy tooltip to display file offset and fixed Python version compatibility
• Improvement: Updated triage view to only show libraries when appropriate
• Fix: Fixed MemoryRegionDialog incorrectly prepopulating length for file-backed regions
• Fix: Fixed crash in TypeDialog when parser results arrived at the wrong time
• Fix: Fixed Enter key in the base field of the Create Structure dialog to add the structure instead of dismissing the dialog
• Fix: Fixed long path truncation in triage view and prevented UI from shifting when starting BASE
• Fix: Fixed regression preventing navigation back from triage view
• Fix: Fixed section list in triage view not updating when sections change
• Fix: Fixed settings view layout and resize performance
• Fix: Fixed triage entropy graph navigation for mapped files
• Fix: Fixed bad indentation for single-line function header comments in Linear View
• Fix: Fixed bug preventing editing of data comments created at addresses
• Fix: Fixed crash in Linear View when attempting to define an array
• Fix: Fixed crash in settings view
• Fix: Fixed crash when get_choice_input is called without an active window
• Fix: Fixed crash when viewing MLIL debug report caused by basic block annotations using committed IL functions instead of active ones
• Fix: Fixed duplicated comments in Linear View for objects sharing the same address
• Fix: Fixed hang when rendering self-referential typedef
• Fix: Fixed linear view not refreshing when resized vertically
• Fix: Fixed linear view refresh behavior when resized vertically
• Fix: Fixed linear view to subscribe to section updates so it reflects changes correctly
• Fix: Fixed multiple bugs in triage view
• Fix: Fixed multiple issues in the triage view
• Fix: Fixed null pointer crashes in the Chat sidebar
• Fix: Fixed off-by-one error in the array Copy As action
• Fix: Fixed parsing of extraneous bytes in search result previews
• Fix: Fixed potential null pointer crashes in the User Positions sidebar
• Fix: Fixed single function linear view when the viewed function becomes undefined
• Fix: Fixed sort order in settings view for settings without a subgroup
• Fix: Fixed spin boxes consuming scroll events in the settings view
• Fix: Fixed stack view and variable list sidebars not broadcasting cross-reference selections
• Fix: Fixed text diffs not respecting UTF-16 encoding of QStrings
• Fix: Fixed tooltip struct offset resolution to use ResolveMemberOrBaseMember for improved accuracy
• Fix: Fixed view state restoration being incorrectly applied when opening files via triage

Architectures and Platforms

• Feature: Added GetInstructionTextWithContext callback to the architecture class to share context between basic block recovery, lifting, and disassembly
• Feature: Added arm64 calling conventions for the Swift ABI, including repurposed callee-saved registers
• Feature: Added automatic and manual endianness override support for x86 ELF files
• Feature: Added Intel APX support for x86
• Feature: Added R_386_IRELATIVE relocation handling for x86 ELF binaries
• Feature: Added Swift initial demangling support for Swift symbols
• Feature: Added R_CKCORE_PCREL_JSR_IMM26BY2 relocation support for C-SKY architecture
• Feature: Allows architecture plugins to override function lifting and inlining via LiftFunction
• Feature: Detect Linux ro_after_init region and synthesize overlay section for improved kernel analysis
• Feature: Implemented DTPOFF64 and DTPMOD64 TLS relocations
• Improvement: Allow deserializing type libraries without registering them
• Improvement: Lifted new PPC instructions and fixed MIPS relocation handling
• Improvement: Updated AArch64 system registers based on ARM’s 2025-09 data
• Improvement: Added missing x86_64 relocations
• Fix: Fixed handling of relocations for self-bound data symbols in MachO binaries
• Fix: Fixed MIPS jalr instruction incorrectly receiving a default branch type
• Fix: Fixed si_split16 immediate decoding for PPC VLE I16A-form instructions
• Fix: Fixed calling convention applied to objc_retain_xN / objc_release_xN in the Objective-C runtime type library
• Fix: Fixed MachO chained fixup relocations not respecting addends
• Fix: Fixed MIPS jalr[.hb] $zero, $ra to be recognized as a return instruction
• Fix: Fixed MIPS64 relocation entry parsing
• Fix: Fixed operand order for several PPC floating point instructions that were reversed
• Fix: Fixed rounding flag emission on certain x86 floating point instructions
• Fix: Fixed FreeFunctionArchContext error logs on Linux
• Fix: Fixed LIST_ENTRY type specializations for AMD64 Windows platform
• Fix: Fixed C-SKY targets and improved Cpop instruction output
• Fix: Fixed crash on Windows when setting thread name with invalid characters
• Fix: Fixed crash when a platform is not registered in the global platform registry
• Fix: Fixed duplicate type libraries losing named types and objects
• Fix: Fixed import address symbol size to use platform address size instead of a hardcoded value (except linux-x32 which retains 8-byte pointers)
• Fix: Fixed lifting bug in Hexagon predicated jumps with intra-packet p0 dependencies
• Fix: Fixed logic bug affecting ldq/stq instruction handling in M-CORE architecture
• Fix: Fixed panic in C-SKY lifter when setting IL register
• Fix: Improved register handling safety in C-SKY and M-CORE lifting

Core Plugins

• Feature: Added initial version of a Swift support plugin
• Feature: Added PE resource information parsing and display in triage view
• Feature: Added support for applying parameter and return types during Swift demangling (disabled by default)
• Feature: Added whole-file entropy calculation to the triage view
• Feature: Added LZMA, LZMA2, LZ4 (Block/Frame), LZF, and ZStandard compression transforms
• Feature: Added support for loading stored files in AES encrypted zips
• Feature: Added UImage, FIT, and TRX firmware transforms
• Feature: Added quick export action to BinExport plugin
• Improvement: Added type propagation from objc_alloc_init and related functions in the Obj-C plugin
• Improvement: Added NRF52840 to Firmware Ninja board descriptions
• Improvement: Added support for loading Ghidra 12.0 databases in the Ghidra importer
• Improvement: Renamed corePlugins.ghidraImport to corePlugins.ghidra
• Improvement: Improved DSC section creation performance by deferring section map rebuilds until all sections are added
• Improvement: Improved KernelCache section creation performance by wrapping bulk section additions in BeginBulkAddSegments/EndBulkAddSegments to defer section map rebuilds
• Improvement: Improved Mach-O section type identification by properly masking flags with SECTION_TYPE
• Improvement: Improved Obj-C analysis to set return types on objc_msgSend calls that send an init message to a known class
• Improvement: Improved performance of loading many images from the shared cache after introduction of SectionMap
• Improvement: Improved Zlib transform diagnostics by surfacing inflate errors and warning on likely false positive decompression
• Improvement: Removed the add bitfield setting from SVD Import as bitfields are now always included with correct type system representation
• Improvement: Set segment flags for MachO kernel images based on how XNU initially maps them
• Fix: Fixed crash when parsing ELF files with empty .interp or .dynamic sections
• Fix: Fixed DSC symbols to correctly reflect local, global, or weak binding
• Fix: Fixed incorrect handling of BIND_SPECIAL_DYLIB_\*_LOOKUP modes in MachO chained fixups where negative-encoded library values were mishandled
• Fix: Fixed intermittent unrelocated pointers in DSC caused by FileAccessorCache LRU eviction discarding mapped files
• Fix: Fixed Obj-C plugin overriding the core.function.metaAnalysis workflow description
• Fix: Fixed Objective-C metadata not being processed when loading a DSC view from a .bndb
• Fix: Fixed reading dynamic string tables at large offsets in ELF files
• Fix: Fixed SVD import mapper issue where unordered register fields caused spurious __offset fields to appear in structures
• Fix: Fixed Ghidra import to use address size from the Ghidra database for default pointer width
• Fix: Fixed Ghidra importer generating empty function types when function parameters are uncommitted
• Fix: Fixed MachO weak bound symbols being incorrectly resolved to their import address
• Fix: Fixed nondeterminism in WARP matching by allowing multi-round matching to resolve function dependencies during parallelized analysis
• Fix: Fixed WARP relocatable region selection to properly fall back to section collection when segment list is used
• Fix: Fixed WARP server URL sanitization to handle malformed inputs
• Fix: Fixed WARP sidebar not showing selected function when opening the sidebar for the first time
• Fix: Fixed warp_headless example not linking binaryninjacore, which prevented it from loading

Collaboration / Projects

• Feature: Added table view and miscellaneous fixes and improvements to the Project Browser
• Feature: Added support for function value stores in collaboration
• Improvement: Added Open Selected Files with Container Browser... option to the project browser context menu
• Improvement: Improved container-aware display names in projects
• Improvement: Improved Save As behavior when working with project files
• Improvement: Separated recent file and project states to track them independently
• Fix: Fixed HTTP requests retrying during shutdown to prevent hangs or errors on exit
• Fix: Fixed improper variable cast in databasesync.py
• Fix: Fixed crash when failing to retrieve the current snapshot while saving a collaboration database
• Fix: Fixed default path for Create Type Archive dialog when used with a project file
• Fix: Fixed hang when checking floating license validity while unable to reach the Enterprise server
• Fix: Fixed minor issues in the collaboration Python API
• Fix: Fixed persistent User Positions errors
• Fix: Fixed save dialog proposing the container name instead of the entry name for container files in projects
• Fix: Fixed spurious crashes caused by unexpected WebSocket connection lifetime issues in collaboration
• Fix: Fixed stale display name and virtual path information when saving a file

API

• Feature: Added get_metadata() method to BinaryView, Function, and Project, and made query_metadata() raise KeyError consistently
• Feature: Added mutex and recursive_mutex to bn::base, using os_unfair_lock on Apple platforms
• Feature: Added TransformSession constructor that adopts an existing TransformContext
• Feature: Added global plugin command type for registering plugins available outside the context of a binary view
• Feature: Added QualifiedName.separator property to the Python API
• Feature: Added a hook for BinaryView subclasses to run code after snapshot data is applied
• Feature: Added missing LowLevelILFunction::AddOverFlow API
• Feature: Added support for calling conventions to specify required registers for heuristic calling convention detection
• Feature: Added support for ephemeral session-time settings for TransformSession
• Feature: Exposed BNDetectSearchMode to the Python API for search mode testing
• Feature: Introduced an RAII type for managing bulk symbol modifications to simplify batched symbol updates
• Feature: Added TypeLibrary.remove_named_object and TypeLibrary.remove_named_type to the Python API
• Feature: Added API to remove data from type libraries, useful when relocating information between type libraries before finalization
• Feature: Added GetNamedTypeSource API to type libraries
• Feature: Added TypeLibrary::Register to allow loading type libraries programmatically from scripts
• Feature: Added missing TypeLibrary.duplicate API to Python bindings
• Improvement: Allow decompressing standalone TypeLibrary objects without requiring them to be written to disk first
• Improvement: Updated function signatures of some type library APIs in Python
• Improvement: Added BN_DEPRECATED macro to annotate deprecated C++ APIs with compiler warnings
• Improvement: Added ProjectFile type annotation to the Python load function
• Improvement: Added SegmentInfo and SectionInfo dataclasses and helper functions to make add_user_segment, add_auto_segment, and section APIs more Pythonic
• Improvement: Added VariableList::updateCrossReferences declaration to the API
• Improvement: Added control over which address is used for instructions created when inlining during analysis
• Improvement: Added session settings override support to the Transform system and improved documentation
• Improvement: Added setters for NamedTypeReferenceBuilder properties in the Python API
• Improvement: Added [[nodiscard]] attribute to Structure/StructureBuilder GetMemberByName/GetMemberByOffset to catch ignored return values at compile time
• Improvement: Added ForEachField APIs to reduce copying of structure members
• Improvement: Added support for MLIL_SEPARATE_PARAM_LIST and MLIL_SHARED_PARAM_SLOT in Python copy_expr_to
• Improvement: Added type hints to Architecture flags fields in the Python API
• Improvement: Allow overriding the IL source location used by ILInstruction::CopyTo
• Improvement: Allows flexible user plugin install location via a CMake cache variable
• Improvement: Enhanced MemoryMap bindings and added support to re-enable disabled regions in the UI
• Improvement: Improved Confidence<T> move semantics to avoid unnecessary copies and reference count churn
• Improvement: Improved performance of canMakeString
• Improvement: Improved Python API for architectures and lifting
• Improvement: Specified fixed underlying types for core-exposed enums, shrinking several widely-used enums from 4 bytes to 1 byte
• Improvement: Updated QualifiedName constructor to accept a separator parameter
• Improvement: Updated Python API generator to detect flag enums and emit IntFlag instead of IntEnum
• Improvement: Use bn::base::function_ref instead of std::function for non-stored callback parameters to reduce overhead
• Fix: Fixed BinaryView.get_modification failing when passing a length argument
• Fix: Fixed LogTrace *FV/*F variants to respect the BN_ENABLE_LOG_TRACE compile guard instead of unconditionally calling fmt::vformat
• Fix: Fixed TypeError when slicing FunctionList/BasicBlockList with [:], [n:], or [:n]
• Fix: Fixed crash in show_message_box when description is None in Python
• Fix: Fixed GIL deadlock in QueueGenerator search APIs
• Fix: Fixed handling of None cases when empty strings are returned from core and corrected associated coreversion usage
• Fix: Fixed incorrect type hint and null string handling in the API
• Fix: Fixed many compiler warnings when building with GCC 15.2
• Fix: Fixed slice handling in TagList to match FunctionList/BasicBlockList behavior
• Fix: Fixed BinaryView types in Python API
• Fix: Fixed CallingConvention.get_incoming_flag_value in the Python API
• Fix: Fixed CoreVersionInfo API and added unit tests
• Fix: Fixed Function::StoreMetadata not marking the function as changed, ensuring dependent analysis is properly invalidated
• Fix: Fixed get_flag_write_low_level_il to properly extract LLIL flags in the Python API
• Fix: Fixed Platform.view_init passing the cffi object instead of the API object
• Fix: Fixed QualifiedName join from FFI and added NameSpace join support
• Fix: Fixed covariant user list types in Python API
• Fix: Fixed crashes when passing null to demangle APIs
• Fix: Fixed enums not being cast to their types in the Python bindings generator
• Fix: Fixed generator handling of sub-4-byte signed enums with negative members (affected InvalidILViewType)
• Fix: Fixed LLIL flags parameter type annotation to correctly reflect flag writes rather than flags
• Fix: Fixed missed mismatch detection for flag_name in Python API
• Fix: Fixed overriding Architecture.assemble in Python subclasses being broken
• Fix: Fixed Python QName separator method to use the correct name join to match the C++ API
• Fix: Fixed Python type issues and updated tests to account for new field in QualifiedName struct
• Fix: Fixed use-after-free bug in TypeBuilder.handle where the underlying object was deleted before the handle was used
• Fix: Relaxed type constraints on children passed into type factories in the Python API
• Fix: Fixed operand list iterators being invalidated when appending new instructions by storing offsets instead of pointers

Rust API

• Feature: Added address_comments to BinaryViewExt in the Rust API
• Feature: Added BinaryViewExt::tags_all_scopes, tag_types, and tags_by_type to the Rust API
• Feature: Added BinaryViewExt::type_libraries to the Rust API
• Feature: Added From<BnString> impl for QualifiedName to simplify conversions
• Feature: Added Function::defined_symbol to retrieve a function’s symbol only when it is explicitly defined
• Feature: Added load_project_file and load_project_file_with_progress to open project-linked files and avoid detached binary views
• Feature: Added LowLevelILSSARegister type to the Rust API
• Feature: Added OwnedBackgroundTaskGuard for automatically finishing background tasks via RAII
• Feature: Added Platform::address_size to the Rust API
• Feature: Added Symbol::ordinal to the Rust API
• Feature: Added TypeBuilder::function and TypeBuilder::function_with_opts to the Rust API for constructing function types
• Feature: Added TypeBuilder::set_signed to the Rust API
• Feature: Implemented data notification API for Rust bindings
• Feature: Added TypeLibrary::remove_named_object and TypeLibrary::remove_named_type to the Rust API
• Feature: Added APIs to retrieve type archives for a binary view in Rust
• Improvement: Added miscellaneous TypeLibrary API improvements to the Rust bindings
• Improvement: Added more type library examples for the Rust API
• Improvement: Added dedicated TypeArchiveId type to prevent ID type confusion in the type archive API
• Improvement: Implemented Send and Sync for TypeLibrary to enable safe cross-thread usage
• Improvement: Improved API surrounding binary view type libraries in the Rust bindings
• Improvement: Added miscellaneous documentation to the Rust API
• Improvement: Added more architecture module documentation and misc cleanup to the Rust API
• Improvement: Added setters for creating NTR references in the Rust API
• Improvement: Added top-level documentation to the tracing and logger modules
• Improvement: Implemented BinaryViewEventHandler for Fn(&BinaryView), allowing closures to be passed directly to the register function
• Improvement: Implemented Debug for RemoteProject, RemoteFolder, and BinaryViewType
• Improvement: Implemented Display for Symbol, FileMetadata, and VersionInfo
• Improvement: Added PartialEq, Eq, and Hash for ProjectFile and Project
• Improvement: Implemented Send and Sync for RemoteFolder, CoreLanguageRepresentationFunctionType, RemoteProject, and RemoteFile
• Improvement: Made InstructionTextToken field expr_index optional via Option type
• Improvement: Refactored AnalysisProgress returned from BinaryViewExt::analysis_progress
• Improvement: Refactored FileMetadata to rename and retype filename and require it to be set at construction time
• Improvement: Removed UnusedRegisterStackInfo and updated architecture documentation in the Rust API
• Improvement: Removed redundant ArchAndAddr type in favor of Location
• Improvement: Replaced log with tracing for logging in the Rust API
• Improvement: Restructured type APIs into a types module for improved discoverability and documentation
• Improvement: Updated TagReference to optionally accept architecture and function parameters
• Improvement: Updated TypeBuilder::named_type to accept type_reference by reference instead of by value
• Improvement: Updated TypeParser to use PathBuf instead of String for include directory parameters
• Improvement: Updated debug info functions to return Array types for more consistent Rust API patterns
• Fix: Added precondition check to ensure metadata is pulled before pulling remote projects
• Fix: Fixed load_view_with_progress when options is None
• Fix: Fixed PartialEq and Hash impls for FileMetadata to use the unique session_id for comparisons and hashing
• Fix: Fixed QualifiedName::default() incorrectly creating a QualifiedName with an empty separator
• Fix: Fixed crash when calling LowLevelILFunction::generate_ssa_form without an owner function
• Fix: Fixed double free in analysis_info with function refs and added string reader helpers
• Fix: Fixed lifetime management of WebsocketClientCallback objects in the Rust API
• Fix: Fixed memory leak in Function::guided_source_blocks where BNFreeArchitectureAndAddressList was not called
• Fix: Fixed unbalanced ref returned in RemoteFile::core_file
• Fix: Fixed undefined behavior when passing include directories to CoreTypeParser
• Fix: Fixed untyped expr_idx within MLIL ILReferenceSource in the Rust API
• Fix: Fixed BinaryViewExt::address_comments memory leak and refactored implementation
• Fix: Fixed OwnedBackgroundTaskGuard to not require mutable self
• Fix: Fixed undefined behavior in basic block analysis context out parameters in the Rust API
• Deprecation: Removed deprecated MLIL functions from the Rust API

Debugger

• Feature: Added NextMemoryAccess/PrevMemoryAccess API and UI for TTD (Time Travel Debugging)
• Feature: Added container file detection and extraction support to the debugger
• Feature: Added execution count display for instructions in the code coverage analysis render layer
• Feature: Added manual rebasing support via debugger.autoRebase setting and a new Rebase to Remote Base action
• Feature: Added module names to the expression parser for address resolution
• Feature: Added process list viewing and selection for the esReven adapter
• Feature: Added setting to disable LLDB auto-install during remote debugging, addressing an issue where LLDB would delete the debugged binary
• Feature: Added support for bookmarking timestamps in TTD sessions
• Feature: Added time range filter option for TTD code coverage analysis to narrow coverage results to a specific execution window
• Feature: Added TTD attach to running process support
• Feature: Added TTD timestamp history navigation (back/forward) to allow stepping through recorded stop positions
• Feature: Enabled TTD menu and widgets on Linux and macOS
• Feature: Implemented GetCurrentTTDPosition and SetTTDPosition for the esReven adapter using rvn:get-current-transition and rvn:set-current-transition
• Feature: Implemented GetThreadList and GetFramesOfThread for the esReven adapter using the rvn:list-threads packet
• Feature: Implemented TTD memory access queries for the esReven adapter using rvn:get-memory-accesses
• Improvement: Added new icons for TTD back/forward controls
• Improvement: Added regex and case sensitivity options to FilterEdit in the debugger
• Improvement: Added row copy/paste support and multi-row selection to the registers widget
• Improvement: Added configurable ttd.maxSymbolsLimit setting (default 50, 0 for no limit) for esReven TTD wildcard symbol lookups
• Improvement: Improved TTD widget UI on macOS
• Improvement: Improved WinDbg/TTD installation process with quality-of-life enhancements
• Improvement: Updated DebugBreakpoint.__repr__ to include the condition when set
• Fix: Fixed ParseGdbValue to correctly handle vector/SIMD registers and unavailable values in GDB MI register output
• Fix: Fixed big-endian register parsing in the GDB RSP adapter for PowerPC and other big-endian targets
• Fix: Fixed concurrent access issue in g_debuggerControllers by replacing raw pointer management with thread-safe storage
• Fix: Fixed crash in uncaught exceptions thrown by code
• Fix: Fixed crash when attaching to a process if dbgeng fails to initialize
• Fix: Fixed crash when connecting to QEMU-PPC targets due to architecture string missing a hyphen after the colon
• Fix: Fixed multiple debugger bugs including Python FFI mismatches, mutex leak, thread state issues, and double notification
• Fix: Fixed potential null pointer dereferences when acquiring dynamic UI objects in the debugger
• Fix: Fixed sorting in TTD event widget
• Fix: Fixed view not refreshing after TTD coverage analysis completes
• Fix: Fixed delay-loading of Sentry to prevent dbghelp.dll from loading from System32 and breaking the dbgeng adapter
• Fix: Fixed error when accessing dbg.breakpoints
• Fix: Fixed conditional breakpoint evaluation when stepping onto a breakpoint in LLDB
• Fix: Fixed crash when retrieving breakpoint condition
• Fix: Fixed crash when toggling breakpoints with the GDB MI adapter
• Fix: Fixed TTD negotiation breaking regular debugging in the GDB MI adapter
• Fix: Fixed values wider than 8 bytes displaying as 0x0 in the TTD memory widget

Documentation

• Improvement: Added documentation for hardware breakpoints
• Improvement: Added examples for execute_ APIs
• Improvement: Added explicit online privacy documentation covering data collection and network usage
• Improvement: Added module workflow hello world example
• Improvement: Added Windows Defender antivirus exception documentation
• Improvement: Added Windows Python workaround documentation for known compatibility issue
• Improvement: Added docs for __attr
• Improvement: Reorganized Quark documentation into a dedicated section to improve readability
• Improvement: Updated docs for using module names in the expression parser
• Improvement: Updated TTD documentation to cover new features
• Improvement: Updated Ghidra import documentation with minor tweaks and improved cross-references

Despite the list of changes getting bigger with almost every release, it still doesn’t cover everything that’s happened! If you want to see even more details, check out our closed milestone on GitHub.

Firmware analysis, malware triage, and embedded systems reverse engineering often require extracting files from nested container formats: TAR archives inside GZIP files, encrypted firmware wrapped in multiple compression layers, or password-protected ZIPs containing “infected” malware.

Manually peeling each layer with separate tools gets old fast.

Binary Ninja’s Container Transform system automates this workflow, handling detection, extraction, password management, and multi-layer nesting while preserving the structure and provenance of each stage.

The Nested Binary Challenge

Consider analyzing an Apple firmware update:

firmware.img4 (IMG4 container)
  └─ LZFSE compressed payload
      └─ Mach-O kernel

Traditionally you would:

1. Recognize the IMG4 format
2. Extract the payload
3. Identify and decompress LZFSE
4. Finally load the Mach-O

With Container Transforms, this entire chain resolves automatically during file load. Here’s the end result of this feature in action:

The Real Problem: Representation

This system began with a narrower feature: support for memory regions that store decoded data.

The initial impetus for this was performance-related (GitHub issue #7234). Decoded data flowing through the Undo buffer caused regressions because that system was designed for small user-driven edits, not large, derived byte streams.

But the deeper issue was not performance. It was representation itself.

Decoded data has:

• Provenance: how it was produced
• Structure: which container or encoding it came from
• Multiplicity: one input may produce many outputs

Flattening derived data into a linear memory view discards that information.

What was missing was a proper way to model derived artifacts: data that exists because it was decoded, decompressed, or extracted from something else, possibly across multiple stages.

The Container Transform system models each step as a contextual transformation instead of mutating data in place. The result is a navigable tree of derived artifacts that preserves structure, metadata, and history without special cases.

Architectural Direction

We considered several ways this could have been implemented:

• A completely new subsystem for extracted data
• Representing each stage as a BinaryView
• Extending the existing Transform system

Building a parallel subsystem could add unnecessary complexity. Modeling each stage as a BinaryView would have blurred the line between representation and analysis. A BinaryView implies analyzable program state, lifecycle semantics, and ownership that do not apply to intermediate decoding stages.

Instead, we leveraged our existing Transform system and extended it with explicit contextual representation. Transforms now produce context, not just bytes. That distinction enables nested containers, multi-output transforms, automatic and interactive workflows, and a clean separation between extraction and analysis.

What Are Container Transforms?

Container transforms are specialized transforms that decode structured formats. Unlike simple encodings (Base64, Hex), container transforms can:

1. Auto-detect formats using magic bytes or other signatures
2. Extract multiple outputs from a single input
3. Handle passwords and encryption
4. Chain across nested formats
5. Preserve provenance information

Mental Model: Trees, Not Pipelines

graph TD
    A["archive.tar.gz"] -->|Gzip| B["archive.tar"]
    B -->|Tar| C["README.md"]
    B -->|Tar| D["firmware.img4"]
    B -->|Tar| E["config.json"]
    D -->|IMG4| F["LZFSE payload"]
    F -->|LZFSE| G["Mach-O kernel"]

Container extraction forms a tree rather than a linear pipeline. Each node represents a transformation step; children represent derived artifacts. You can inspect intermediate layers instead of interacting only with a flattened final result.

Binary Ninja ships with detection-enabled transforms for:

• Compression: Gzip, Zlib, Bzip2, LZMA, LZ4 (Frame), Zstd, XZ, LZFSE
• Archives: Zip, Tar, CPIO, AR, CaRT
• Binary Containers: IMG4, Universal (Fat Mach-O)
• Firmware Containers: UImage, FIT, TRX
• Disk Images: DMG
• Text Encodings: IntelHex, SRec, TiTxt

>>> [x.name for x in Transform if getattr(x, "supports_detection", False)]
['Gzip', 'Zlib', 'Bzip2', 'LZMA', 'LZ4Frame', 'Zstd', 'XZ', 'Zip', 'CaRT', 'Tar', 'AR', 'CPIO', 'DMG', 'UImage', 'FIT', 'TRX', 'IntelHex', 'SRec', 'TiTxt', 'IMG4', 'LZFSE', 'Universal']

Other Transforms

The transforms listed above support automatic detection, meaning Binary Ninja can recognize the format and incorporate it into the container resolution tree during file loading.

Binary Ninja also provides many additional transforms that are not detection-enabled. These transforms can still be applied manually but are not automatically considered during container discovery.

Common examples include:

• Raw compression primitives (e.g., Deflate, LZ4Block, LZF)
• Encodings (Base64, HexDump, RawHex)
• Text / language representations (CArray, RustArray, IntList)
• Cryptographic transforms (AES, DES, RC4, etc.)
• Simple reversible transforms (XOR, ROL, arithmetic transforms)

These transforms typically require parameters, lack reliable file signatures, or would otherwise produce too many false positives if attempted automatically.

They remain accessible through the Transform system and can be applied programmatically:

Transform["Base64"].decode(data)
Transform["Deflate"].decode(data)
Transform["XOR"].decode(data, {"key": b"\x42"})

This design keeps automatic container discovery reliable while still exposing the full transform toolkit for manual analysis workflows.

Invocation Model

Container transforms participate directly in the standard file loading pipeline, both in the UI and through the load() API. When a file is opened, Binary Ninja evaluates whether the input represents a container and recursively resolves any nested transforms.

The process consists of four stages:

1. Detection identifies container formats applicable to the input.
2. Transform Resolution applies matching transforms and recursively evaluates their outputs.
3. Context Tree Construction builds a transformation context tree representing all discovered extraction paths.
4. Context Selection chooses a final derived artifact for analysis.

This model allows Binary Ninja to transparently handle arbitrarily nested formats such as compressed archives, firmware containers, or multi-architecture binaries while preserving the full provenance of each transformation step.

Automatic vs Prompted Resolution

Container resolution may complete automatically or require user input depending on the available choices and required parameters.

• Automatic resolution occurs when there is exactly one valid extraction path and no additional parameters (such as passwords) are required. In this case, Binary Ninja opens the derived artifact directly.

• Prompted resolution occurs when multiple candidate artifacts exist or when parameters must be provided. The Container Browser presents the available options and allows the user to select the desired artifact or provide required inputs.

Both resolution modes operate on the same underlying context tree.

The Container Browser also remembers previous selections to streamline repeated workflows. Preferences are cached both per container type and per specific file, allowing Binary Ninja to automatically default to the previously chosen entry when reopening similar containers or the same file again.

Configuration

Container behavior can be adjusted through several settings that control how container detection and resolution occur.

• files.container.mode Controls how container layers are discovered during file loading.

  • Disabled: open the input file without applying container transforms.
  • Full (DEFAULT): discover all possible extraction paths before prompting for selection.
  • Interactive: resolve container layers step-by-step, prompting the user at each stage.

• files.container.autoOpen Determines whether a single unambiguous extraction path opens automatically or still requires confirmation. Defaults to True.

• files.container.defaultPasswords Provides a list of passwords to attempt automatically when opening password-protected containers. Passwords are tried in order before prompting the user. The default setting is: ["infected","password","123456","admin","test","secret","flare","hackthebox","crackmes.de","crackmes.one"]

• files.container.excludedTransforms Specifies container transforms that should be ignored during automatic detection. Files requiring those transforms will fall back to the standard BinaryView loading path. This can also be overridden per session through load options. Defaults to an empty list.

These settings modify workflow behavior without changing the underlying container resolution model. For example, malware analysts may prefer fully automatic unwrapping with a predefined password list, while users exploring unfamiliar firmware images may prefer step-by-step resolution at each container layer.

For complete settings documentation, see the Container Settings Reference.

The Transform API

First, let’s check out an example using the structure we showed above, then we’ll talk about the components that make it up:

from binaryninja import TransformSession, load

# Stages 1-3: Detection, transform resolution, and context tree construction
session = TransformSession("archive.tar.gz")
session.process()

# Walk the resolved context tree
def walk(ctx, depth=0):
    label = ctx.transform_name or ctx.filename or "root"
    print(f"{'  ' * depth}{label}  ({ctx.child_count} children)")
    for child in ctx.children:
        walk(child, depth + 1)

walk(session.root_context)
# Gzip  (1 children)
#   Tar  (3 children)
#     README.md  (0 children)
#     config.json  (0 children)
#     IMG4  (1 children)
#       LZFSE  (1 children)
#         extracted  (0 children)

# Stage 4: Find the deepest leaf and load it
def find_leaf(ctx):
    if ctx.is_leaf:
        return ctx
    return find_leaf(ctx.children[-1])

leaf = find_leaf(session.root_context)
session.set_selected_contexts(leaf)

with load(leaf.input) as bv:
    print(bv.file.virtual_path)
    # Gzip(.../archive.tar.gz)::Tar()::IMG4(firmware.img4)::LZFSE(krnl...)::extracted
    print(bv.view_type)
    # Mach-O

The system is built on three core types:

• Transform: capability
• TransformContext: representation
• TransformSession: orchestration

Transform: Capability

A Transform defines what can decode what. Key properties:

• supports_detection: can the transform auto-select for a given input?
• supports_context: can it operate in context-aware mode for multi-output extraction?
• parameters: additional inputs required (encryption keys, passwords, etc.)

# Enumerate all transforms
list(Transform)

# Look up a transform by name
zlib = Transform["Zlib"]

Simple transforms operate directly on bytes:

sha512 = Transform["SHA512"]
rawhex = Transform["RawHex"]
rawhex.encode(sha512.encode("test string"))

Some transforms require parameters:

xor = Transform["XOR"]
xor.encode(b"Original Data", {"key": b"XORKEY"})

For container formats, the important entry point is decode_with_context, which allows a transform to enumerate files, request user selection, and produce extracted child contexts.

TransformContext: Representation

A TransformContext is a node in the extraction tree. It captures:

• An input BinaryView that represents the bytes at this stage (context.input)
• The name of the transform that produced the data (context.transform_name), which can also be set manually via set_transform_name() to specify a transform for non-auto-detected formats
• Transform parameters such as passwords or keys
• Metadata associated with the transformation (context.metadata_obj)
• Extraction and transform status, including structured result codes and human-readable messages
• Parent and child relationships that define the container hierarchy

Together these fields preserve the provenance of derived artifacts and make the container hierarchy explicit.

Execution Model

Container transforms operate in two phases:

1. Discovery: the transform enumerates available artifacts, populates available_files, and returns False to request user selection.
2. Extraction: the transform processes requested_files, creates child contexts for each extracted artifact, and returns True when extraction is complete.

Context Metadata

Each TransformContext can also carry format-specific metadata through its metadata_obj property. This allows transforms to preserve structured information about the extraction process beyond the raw bytes.

Examples include archive attributes, compression details, encryption parameters, timestamps, or other format-specific information that may be useful to downstream transforms or analysis plugins.

While most current container transforms focus primarily on producing extracted artifacts, the metadata mechanism provides an extensibility point for richer communication between transformation stages when needed.

TransformSession: Orchestration

TransformSession drives the extraction workflow over the TransformContext tree using the available Transforms.

It coordinates container detection, transform execution, and context selection as nested containers are processed. The session advances extraction automatically when possible and pauses when user input or artifact selection is required.

A session is responsible for:

• Detecting and applying transforms for each context
• Traversing nested containers and multi-stage formats
• Constructing and maintaining the context tree
• Managing user selection and transform parameters
• Selecting one or more final contexts for analysis

In effect, TransformSession acts as the policy layer of the container system, controlling how extraction progresses and which derived artifacts ultimately become inputs to analysis.

The session API is intentionally small and focused. The most important operations are:

• current_view, the current BinaryView for this session
• current_context, the current TransformContext being processed
• process(), which advances the extraction workflow and returns True when processing is complete
• process_from(context), which resumes processing from a specific context after input or selection has been provided
• set_selected_contexts(...), which marks one or more contexts as the intended outputs

Filename Resolution

Container extraction introduces multiple naming layers that serve different roles:

For files opened directly from disk (without container transforms), these values are typically identical. For extracted artifacts, they diverge:

# ZIP containing file3.bin, nested inside a .tar.xz
bv.file.virtual_path    # → 'XZ(/path/to/archive.tar.xz)::Tar()::file3.bin'
bv.file.display_name    # → '/path/to/archive/file3.bin'

# IMG4 firmware component
bv.file.virtual_path    # → 'IMG4(/path/to/firmware.v59)::LZFSE(krnl.1)::extracted'
bv.file.display_name    # → '/path/to/firmware.v59.krnl.1.extracted'

virtual_path preserves the provenance chain describing how the artifact was produced. display_name provides a concise label suitable for UI presentation.

Example: Nested Archive

from binaryninja import TransformSession, load

# Create a session for the nested archive
session = TransformSession("backup.tar.gz")

# Process the entire extraction chain
if session.process(): # Returns True if extraction completed successfully
    # Select and load the final extracted file
    session.set_selected_contexts(session.current_context)

    with load(session.current_view) as bv:
        print(bv.file.virtual_path)
        # 'Gzip(/path/to/backup.tar.gz)::Tar()::data.bin::extracted'

Example: Manual Transform Selection

Some encodings (such as Base64) do not have reliable signatures for automatic detection. Because they are designed to resemble ordinary text, they must often be applied manually.

from binaryninja import TransformSession, load

# First, extract the ZIP archive
session = TransformSession("encoded_payload.zip")
session.process()

# The extracted file contains Base64-encoded data
extracted_ctx = session.current_context

# Manually specify the Base64 transform
extracted_ctx.set_transform_name("Base64")

# Process the transform
if session.process_from(extracted_ctx): # Returns True when decoding succeeds
    # Successfully decoded the Base64 data
    session.set_selected_contexts(session.current_context)

    with load(session.current_view) as bv:
        print(f"Transform chain: {bv.file.virtual_path}")
        # Example: 'Zip(/path/to/encoded_payload.zip)::Base64(payload.txt)::extracted'

This approach is useful when working with obfuscated malware, custom encodings, or formats that lack reliable signatures for automatic detection.

A Reference Implementation: ZipPython

Binary Ninja includes a complete Python container transform implementation in the public repository: ZipPython.

It demonstrates:

• Signature-based detection via can_decode
• Context-aware decoding using decode_with_context
• The two-phase discovery and extraction model
• Multi-file handling and password support
• Creation of child TransformContext objects

If you’re implementing a custom container transform, ZipPython is the best starting point.

Future Directions

We’re continuing to expand container format support based on user feedback. We’re also exploring ways to improve the Container Browser UI with better visualization of transform chains and metadata inspection.

Conclusion

Container Transforms eliminate the tedious manual extraction workflows that previously required multiple tools and steps. Whether you’re analyzing firmware, triaging malware, or exploring disk images, Binary Ninja automatically handles detection, extraction, password management, and multi-layer nesting.

Instead of flattening extracted bytes into memory, the system models container processing as a structured transformation pipeline that preserves provenance and context throughout the analysis process.

The Transform API provides both high-level convenience through load() and fine-grained control through TransformSession, giving you the flexibility to handle everything from simple archives to deeply nested container formats.

We welcome feedback on these features and suggestions for additional container formats or capabilities that would improve your reverse engineering workflow.

API Reference

For complete API documentation, see:

• Transform - Base transform class
• TransformContext - Container extraction context
• TransformSession - Multi-stage extraction workflow
• TransformResult - Extraction result codes