bnsql

Query Binary Ninja databases with SQL to interrogate functions, xrefs, and strings.

2|Updated Feb 4, 2026
One-click install
npx skills add https://github.com/0xeb/anthropic-xsql-tools-plugin --skill bnsql
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: bnsql
Source: https://github.com/0xeb/anthropic-xsql-tools-plugin/tree/main/skills/bnsql
Command: npx skills add https://github.com/0xeb/anthropic-xsql-tools-plugin --skill bnsql

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables analysts to query Binary Ninja databases using SQL, accelerating reverse-engineering workflows by turning heterogeneous data into actionable insights.

Core Features & Use Cases

  • Direct SQL queries: Run SQL against Binary Ninja data like funcs, xrefs, strings, imports, and decompilation outputs.
  • Multi-database analysis: Compare results across multiple BND databases in a single workflow.
  • Use Case: Imagine investigating a malware sample across several binaries; use bnsql to quickly list functions, references, and strings that match a pattern.

Quick Start

Install Binary Ninja and ensure bnsql.exe is in PATH. Then run a basic query against a Binary Ninja database, for example: bnsql program.bndb -c "SELECT name, address FROM funcs ORDER BY address LIMIT 5"

Frequently Asked Questions about bnsql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Binary Ninja databases using SQL?

You can query Binary Ninja databases using SQL by running the bnsql CLI against .bndb files to interrogate functions, xrefs, strings, and decompilation outputs directly.

Can I compare functions and xrefs across multiple Binary Ninja databases?

Yes, you can compare functions and xrefs across multiple Binary Ninja databases by starting bnsql in HTTP server mode, which maintains persistent sessions for multi-database analysis.

What do I need to run SQL queries against Binary Ninja decompilation results?

To run SQL queries against Binary Ninja decompilation results, you need Binary Ninja installed with its DLLs in PATH and the bnsql.exe executable accessible in your system PATH.

How do I list functions and addresses from a Binary Ninja database via command line?

You list functions and addresses from a Binary Ninja database by executing a direct CLI query, such as: bnsql program.bndb -c "SELECT name, address FROM funcs ORDER BY address LIMIT 5".

What is the best way to scale reverse-engineering analysis when querying Binary Ninja data?

The best way to scale reverse-engineering analysis when querying Binary Ninja data is to use pre-built views like callers and callees, which optimize SQL exploration of large databases.

Does bnsql work with standard SQL syntax for reverse engineering tasks?

Yes, bnsql works with standard SQL syntax to filter reverse-engineering data, allowing you to run SELECT statements against tables representing funcs, xrefs, strings, and imports.