Skip to content

Commit 903b227

Browse files
committed
add binaryview to important concepts
1 parent b91f466 commit 903b227

File tree

1 file changed

+21
-0
lines changed

1 file changed

+21
-0
lines changed

docs/dev/concepts.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,26 @@
11
# Important Concepts
22

3+
## Binary Views
4+
5+
The highest level analysis object in Binary Ninja is a [BinaryView](https://api.binary.ninja/binaryninja.binaryview-module.html#binaryninja.binaryview.BinaryView) (or `bv` for short). You can think of a `bv` as the Binary Ninja equivalent of what an operating system does when loading an executable binary. These `bv`'s are the top-level analysis object representing how a file is loaded into memory as well as debug information, tables of function pointers, and many other structures.
6+
7+
When you are interacting in the UI with an executable file, you can access `bv` in the python scripting console to see the representation of the current file's BinaryView:
8+
9+
```python
10+
>>> bv
11+
<BinaryView: '/bin/ls', start 0x100000000, len 0x182f8>
12+
>>> len(bv.functions)
13+
140
14+
```
15+
16+
???+ Info "Tip"
17+
Note the use of `bv` here as a shortcut to the currently open BinaryView. For other "magic" variables, see the [user guide](../guide/index.md#magic-console-variables)
18+
19+
If you want to start writing a plugin, most top-level methods will exist off of the BinaryView. Conceptually, you can think about the organization as a hierarchy starting with a BinaryView, then functions, then basic blocks, then instructions. There are of course lots of other ways to access parts of the binary but this is the most common organization. Check out the tab completion in the scripting console for `bv.get<TAB>` for example (a common prefix for many APIs):
20+
21+
![Tab Completion ><](../img/getcompletion.png "Tab Completion")
22+
23+
Some BinaryViews have parent views. The view used for decompilation includes memory mappings through segments and sections for example, but the "parent_view" property is a view of the original file on-disk.
324

425
## REPL versus Scripts
526

0 commit comments

Comments
 (0)