workflow module¶
|
|
|
|
|
|
|
|
- class Activity(configuration: str = '', handle: LP_BNActivity | None = None, action: Callable[[Any], None] | None = None)[source]¶
Bases:
object
Activity
in Binary Ninja represents an individual analysis or action to be performed on aBinaryView
orFunction
object.Activities are the fundamental units of execution within a
Workflow
. Each Activity encapsulates a specific task and defines its own behavior, dependencies, and eligibility criteria. Activities are executed in the context of anAnalysisContext
, which provides access to binary data, analysis state, and utility functions.- Parameters:
- class AnalysisContext(handle: LP_BNAnalysisContext)[source]¶
Bases:
object
AnalysisContext
is a proxy object that provides access to the current analysis context, including the associatedBinaryView
,Function
, and intermediate language (IL) representations. It provides APIs to retrieve and modify the in-progress analysis state and allows users to notify the analysis system of any changes or updates.- Parameters:
handle (LP_BNAnalysisContext) –
- property basic_blocks: BasicBlockList¶
function.BasicBlockList of BasicBlocks in the current function (writable)
- property hlil: HighLevelILFunction¶
HighLevelILFunction used to represent High Level IL (writable)
- property lifted_il: LowLevelILFunction¶
LowLevelILFunction used to represent lifted IL (writable)
- property llil: LowLevelILFunction¶
LowLevelILFunction used to represent Low Level IL (writable)
- property mlil: MediumLevelILFunction¶
MediumLevelILFunction used to represent Medium Level IL (writable)
- property view: BinaryView¶
BinaryView for the current AnalysisContext (writable)
- class Workflow(name: str = '', handle: LP_BNWorkflow | None = None, query_registry: bool = True, object_handle: LP_BNFunction | LP_BNBinaryView | None = None)[source]¶
Bases:
object
class Workflow
in Binary Ninja defines the set of analyses to perform on a binary, including their dependencies and execution order.Workflows are represented as Directed Acyclic Graphs (DAGs), where each node corresponds to an
Activity
(an individual analysis or action). Workflows are used to tailor the analysis process forBinaryView
orFunction
objects, providing granular control over analysis tasks at module or function levels.A Workflow starts in an unregistered state, either by creating a new empty Workflow or by cloning an existing one. While unregistered, it is possible to add and remove
Activity
objects, as well as modify the execution strategy. To apply a Workflow to a binary, it must be registered. Once registered, the Workflow becomes immutable and is available for use.- Example:
# Define the custom activity configuration configuration = json.dumps({ "name": "analysis.plugins.xorStringDecoder", "title": "XOR String Decoder", "description": "This analysis step transforms XOR-encoded strings within the current function.", "eligibility": { "auto": { "default": False } } }) # Clone the meta function workflow for customization workflow = Workflow("core.function.metaAnalysis").clone() # Register a new activity workflow.register_activity(Activity( configuration, action=lambda analysis_context: log_warn( f"Decoder running for function: {hex(analysis_context.function.start)}" # Insert decoder logic here :P ) )) # Insert the new activity before the "generateHighLevelIL" step workflow.insert("core.function.generateHighLevelIL", ["analysis.plugins.xorStringDecoder"]) # Register the modified meta function workflow workflow.register()
- Parameters:
- activity_roots(activity: Activity | str = '') List[str] [source]¶
activity_roots
Retrieve the list of activity roots for the Workflow, or if specified just for the givenactivity
.
- assign_subactivities(activity: Activity, activities: List[str]) bool [source]¶
assign_subactivities
Assign the list ofactivities
as the new set of children for the specifiedactivity
.
- clear() bool [source]¶
clear
Remove all Activity nodes from this Workflow.- Returns:
True on success, False otherwise
- Return type:
- clone(name: str | None = None, activity: Activity | str = '') Workflow [source]¶
clone
Clone a new Workflow, copying all Activities and the execution strategy.
- configuration(activity: Activity | str = '') str [source]¶
configuration
Retrieve the configuration as an adjacency list in JSON for the Workflow, or if specified just for the givenactivity
.- Parameters:
activity (ActivityType) – if specified, return the configuration for the
activity
- Returns:
an adjacency list representation of the configuration in JSON
- Return type:
- contains(activity: Activity | str) bool [source]¶
contains
Determine if an Activity exists in this Workflow.- Parameters:
activity (ActivityType) – the Activity name
- Returns:
True if the Activity exists, False otherwise
- Return type:
- eligibility_settings() List[str] [source]¶
eligibility_settings
Retrieve the list of eligibility settings for the Workflow.
- get_activity(activity: Activity | str) Activity | None [source]¶
get_activity
Retrieve the Activity object for the specifiedactivity
.
- graph(activity: Activity | str = '', sequential: bool = False, show: bool = True) FlowGraph | None [source]¶
graph
Generate a FlowGraph object for the current Workflow and optionally show it in the UI.- Parameters:
- Returns:
FlowGraph object on success, None on failure
- Return type:
- insert(activity: Activity | str, activities: List[str]) bool [source]¶
insert
Insert the list ofactivities
before the specifiedactivity
and at the same level.
- register(configuration: str = '') bool [source]¶
register
Register this Workflow, making it immutable and available for use.
- register_activity(activity: Activity, subactivities: List[Activity | str] = []) Activity | None [source]¶
register_activity
Register an Activity with this Workflow.
- replace(activity: Activity | str, new_activity: List[str]) bool [source]¶
replace
Replace the specifiedactivity
.
- show_topology() None [source]¶
show_topology
Show the Workflow topology in the UI.- Return type:
None
- subactivities(activity: Activity | str = '', immediate: bool = True) List[str] [source]¶
subactivities
Retrieve the list of all activities, or optionally a filtered list.
- property machine¶
- class WorkflowMachine(handle: LP_BNFunction | LP_BNBinaryView | None = None)[source]¶
Bases:
object
- Parameters:
handle (LP_BNFunction | LP_BNBinaryView) –
- class WorkflowMachineCLI(machine: WorkflowMachine)[source]¶
Bases:
Cmd
- Parameters:
machine (WorkflowMachine) –
- do_run(line)[source]¶
Run the workflow machine and generate a default configuration if the workflow is not configured.
- precmd(line)[source]¶
Hook method executed just before the command line is interpreted, but after the input prompt is generated and issued.
- aliases = {'a': 'abort', 'b': 'breakpoint', 'c': 'resume', 'd': 'dump', 'h': 'halt', 'l': 'log', 'm': 'metrics', 'o': 'override', 'q': 'quit', 'r': 'run', 's': 'step'}¶
- intro = "Welcome to the Workflow Orchestrator. Type 'help' to list available commands."¶
- prompt = '(dechora) '¶