bnsql

Query Binary Ninja databases with SQL to interrogate functions, xrefs, and strings.

2|Updated Feb 4, 2026
One-click install
npx skills add https://github.com/0xeb/anthropic-xsql-tools-plugin --skill bnsql
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bnsql
Source: https://github.com/0xeb/anthropic-xsql-tools-plugin/tree/main/skills/bnsql
Command: npx skills add https://github.com/0xeb/anthropic-xsql-tools-plugin --skill bnsql

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables analysts to query Binary Ninja databases using SQL, accelerating reverse-engineering workflows by turning heterogeneous data into actionable insights.

Core Features & Use Cases

  • Direct SQL queries: Run SQL against Binary Ninja data like funcs, xrefs, strings, imports, and decompilation outputs.
  • Multi-database analysis: Compare results across multiple BND databases in a single workflow.
  • Use Case: Imagine investigating a malware sample across several binaries; use bnsql to quickly list functions, references, and strings that match a pattern.

Quick Start

Install Binary Ninja and ensure bnsql.exe is in PATH. Then run a basic query against a Binary Ninja database, for example: bnsql program.bndb -c "SELECT name, address FROM funcs ORDER BY address LIMIT 5"

Frequently Asked Questions about bnsql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Binary Ninja databases using SQL?▼

You can query Binary Ninja databases using SQL by running the bnsql CLI against .bndb files to interrogate functions, xrefs, strings, and decompilation outputs directly.

Can I compare functions and xrefs across multiple Binary Ninja databases?▼

Yes, you can compare functions and xrefs across multiple Binary Ninja databases by starting bnsql in HTTP server mode, which maintains persistent sessions for multi-database analysis.

What do I need to run SQL queries against Binary Ninja decompilation results?▼

To run SQL queries against Binary Ninja decompilation results, you need Binary Ninja installed with its DLLs in PATH and the bnsql.exe executable accessible in your system PATH.

How do I list functions and addresses from a Binary Ninja database via command line?▼

You list functions and addresses from a Binary Ninja database by executing a direct CLI query, such as: bnsql program.bndb -c "SELECT name, address FROM funcs ORDER BY address LIMIT 5".

What is the best way to scale reverse-engineering analysis when querying Binary Ninja data?▼

The best way to scale reverse-engineering analysis when querying Binary Ninja data is to use pre-built views like callers and callees, which optimize SQL exploration of large databases.

Does bnsql work with standard SQL syntax for reverse engineering tasks?▼

Yes, bnsql works with standard SQL syntax to filter reverse-engineering data, allowing you to run SELECT statements against tables representing funcs, xrefs, strings, and imports.