For Binary Ninja 5.3, we’re bringing features and fixes across a number of areas. For improved interoperability, we’ve added Ghidra Export to the existing Ghidra Import code and have improved our IDB Import capability. For new architectures and platforms, we’ve added NDS32 to Ultimate, a new ILP32 ABI for AArch64, and a new set of APIs for “weird” architectures. And of course, we’ve made a number of improvements to the UI including a new Universal Mach-O loader UI, usability improvements to the container browser, and a new “super” command palette! Plus, changes to the debugger, enterprise features, new opt-in crash reporting to help us squash bugs faster, and so much more!

• Architecture / Platform
  • New Architecture APIs
  • NDS32
  • AArch64 ILP32 ABI
• UI
  • Mach-O Architecture Picker
  • Container Browser Improvements
  • Command Palette Refresh
• Types & Signatures
  • Type Library Utilities
  • WARP Improvements
• Interoperability
  • Ghidra Export
  • IDB Import Improvements
• Enterprise
• Debugger
  • Hardware and Conditional Breakpoints
  • New Debug Adapters
• Crash Reporting
• Open-Source Contributions
• Everything Else

Architecture / Platform

New Architecture APIs

Building on the new architecture APIs added in 5.1, we’ve added a new set of APIs to support standalone function-level lifting. Our initial design for Binary Ninja was optimized for multithreaded analysis with as little state as possible so that each basic block could potentially be analyzed in its own thread. However, for plenty of architectures (including a lot of VM-based ones such as Java, Python bytecode, .NET, etc.), there is far too much state or even metadata at the top of each function. The only way to handle such architectures is to enable a single thread to analyze the entire function. While the ABB feature in 5.1 added support for basic block recovery and analysis in a single thread, in 5.3 we now support full function-level lifting.

Internally, we’re using these APIs to work on our upcoming TMS320C6x support, but because we use the same APIs available to third parties, this also means other projects like banjo or some of the WASM plugins we’ve heard about could be updated for much better decompilation results using these new APIs.

Keep an eye out for an upcoming blog post explaining more about how you can leverage these APIs yourself!

NDS32

Ultimate customers will appreciate the brand new NDS32 support. We now have 18 officially supported architectures including full decompilation in our Ultimate/Enterprise edition!

AArch64 ILP32 ABI

It’s not enough to just have support for the instructions in a CPU architecture since there are lots of platforms or variants that need to be supported. For example, ILP32 adds a mode for AArch64 that has 32-bit pointers despite still using 64-bit mode. In 5.3, we’ve not only added the platform, but also updated our function recognizer for ILP32 PLT entries and fixed a bug related to the address size calculation.

UI

Mach-O Architecture Picker

While it’s long been possible to open a specific slice in a fat Mach-O or even adjust your settings to default to a particular slice, the UI around it was fairly painful, reusing our “Open With Options” dialog in a way that led to a lot of confusion.

In 5.3, you now get a much more streamlined dialog that lets you pick the architecture and, more importantly, makes it easy to set the default for future opens without having to dig through the settings! The dialog also shows the size of each slice, so you can quickly identify the one you need.

Container Browser Improvements

We first introduced the Container Browser in 5.2; however, we’ve made a number of improvements to both the container system and to the formats it supports!

Already Supported Formats: CaRT, Gzip, IntelHex, LZFSE, SRec, TiTxt, Zip, Zlib

New In 5.3: AR, Bzip2, CPIO, DMG (compression only), FIT, IMG4/KernelCache, LZ4Frame, LZMA, Tar, TRX, UImage, Universal Mach-O, XZ, Zstd

The Container Browser UI itself has also had a number of improvements, as well. It now remembers your most recent selection, can be triggered for files explicitly from the file menu (or by holding Ctrl+Alt and dragging/dropping), and the UI has been refreshed.

We’ve also added better documentation about the transform system and UI.

Command Palette Refresh

While we’ve had our command-palette for some time, in 5.3 we’ve turbocharged it with a ton of new features. You can prefix your search with various characters to get different behaviors. Note that the default CTRL/CMD-P hotkey defaults to “action search” (the previous behavior) but can be rebound to use any of the new behaviors.

• = Use the expression parser to calculate an address and navigate there (including a preview)
• > Action search, the previous default
• / Search recent files and projects, as well as open tabs
• @ Search function symbols (similar to searching in the symbol sidebar)
• ? Display available search prefixes
• t: Just search open tabs (useful as a bindable hotkey)
• " Search strings

For more details, check out our recent blog post about it.

Types & Signatures

Type Library Utilities

One of our major focus areas currently is our type system and how we collect, manage, and apply types. To that end, this release includes a new set of utilities to handle type libraries. This can be used to automatically create usable type libraries from a binary view or from files in a directory. For users with project support (currently commercial and above), type libraries can also be generated from files in a project.

See the BNTL plugin menu for the available commands:

There’s also a command-line version for headless automation for customers with headless support:

/t/bntl_utils_cli > ./bntl_cli --help
Generate, inspect, and validate Binary Ninja type libraries (BNTL)

Usage: bntl_cli <COMMAND>

Commands:
  create    Create a new type library from a set of files
  dump      Dump the type library to a C header file
  diff      Generate a diff between two type libraries
  validate  Validate the type libraries for common errors
  help      Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help
  -V, --version  Print version
/t/bntl_utils_cli > ls -l
total 13728
-rwxr-xr-x  1 jwiens  wheel  5498296 Apr  9 11:23 bntl_cli*
drwxr-xr-x  4 jwiens  wheel      128 Apr  9 11:37 headers/
/t/bntl_utils_cli > ls -l headers/
total 1360
-rw-r--r--@ 1 jwiens  wheel  690055 Apr  9 11:35 sqlite3.h
-rw-r--r--  1 jwiens  wheel     286 Apr  9 11:37 stdarg.h
/t/bntl_utils_cli > ./bntl_cli create sqlite3.dll "windows-x86_64" ./headers/ ./output |grep -v "Loaded native"
2026-04-09T15:40:37.966972Z  WARN binaryninja: User plugins disabled from command-line override logger=Default
2026-04-09T15:40:39.381327Z  INFO binaryninja: 10021 bundled types for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.381337Z  INFO binaryninja: 0 bundled variables for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.381339Z  INFO binaryninja: 77 bundled functions for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.384452Z  INFO binaryninja: 1 types for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.384459Z  INFO binaryninja: 0 variables for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.384461Z  INFO binaryninja: 0 functions for platform windows-x86_64 loaded logger=Platform
2026-04-09T15:40:39.677619Z  INFO bntl_cli::create: Created type library 'sqlite3.dll': ./output/x86_64/sqlite3.dll.bntl

Keep an eye out for an upcoming blog post that will include more details about how these tools can make your life easier.

WARP Improvements

Last release, we added networked functionality to WARP, our tool for matching previously identified functions. This allowed users to push and pull function information from our server. Additionally, the v2 enterprise server release included a built-in WARP server for our enterprise customers. For this release we are continuing to improve the UX of interacting with the WARP server.

Pushing signatures is more straightforward with a new UI, and fetching signatures from the server uses less bandwidth by performing server-side matching.

For this release, we also deprecated SigKit (which can be re-enabled with analysis.signatureMatcher.autorun), with its removal scheduled for next release. To that end, we bundled signatures for common Linux libraries (libc6, libgcc, libstdc++) to finalize the migration from SigKit to WARP. These signatures are available for x86, x86_64, aarch64, and armv7.

Interoperability

Ghidra Export

We added Ghidra Import in Binary Ninja 5.2, and now we’ve come full circle with Ghidra Export capabilities in 5.3.

First, use the plugin menu to export a .gzf file:

Next, import the file into Ghidra:

That’s it! Now you’ll have all the types, symbols, bookmarks, comments, function starts, etc. that you had in Binary Ninja in Ghidra:

IDB Import Improvements

With this release, we overhauled our IDB (and TIL) import functionality. This new version processes more information and will work with many more IDA databases.

Enterprise

The biggest feature for Enterprise in 5.3 is that this is the first stable release since we launched our v2 Enterprise server. The new server comes with a number of major features:

• Bundled WARP server
• Server-wide search APIs
• Official rootless Podman support
• New deployment options

Check out the release blog post for more details. We encourage all Enterprise customers to migrate to v2, but we do plan to maintain the v1 server for some additional time to ease the transition.

Debugger

Hardware and Conditional Breakpoints

Two of our most requested debugger features are finally here: hardware breakpoints and conditional breakpoints, making your debugging workflow much more flexible.

To add a hardware breakpoint, press F3 or use Debugger / Add Hardware Breakpoint... (also available by right-clicking in the Breakpoint Widget). The dialog lets you pick the address, type (Hardware Execute, Read, Write, or Access), watchpoint size (1, 2, 4, or 8 bytes), and the entries show up in the Breakpoint Widget tagged HE/HR/HW/HA.

Conditional breakpoints attach to any existing breakpoint: right-click on a breakpoint (in either the Breakpoint Widget or the disassembly view) and choose Edit Condition.... Conditions support register names, arithmetic, comparisons, and memory dereferences (e.g., rax == 0x1234, [rsp + 0x20] != 0), and execution only pauses when the expression evaluates to non-zero.

New Debug Adapters

Two new debug adapters ship with 5.3:

The Windows Native Debug Adapter is a brand-new adapter built on top of the Windows debugging APIs and is now the default debugger on Windows. It comes with major performance improvements over the previous DbgEng-based adapter.

The GDB MI Adapter provides a new way to connect to GDB-compatible targets using the GDB Machine Interface protocol, fixing many corner cases in the previous GDB RSP adapter. It works seamlessly with gdbserver or GDB stubs such as those from QEMU, and includes support for TTD (Time Travel Debugging) via Mozilla’s rr. Currently Linux-only, with Windows and macOS support planned.

Crash Reporting

To ensure we can fix issues faster, in 5.3 we’ve added opt-in automatic crash reporting. The first time you launch 5.3 (unless you’ve already seen it on dev) you’ll see a prompt asking whether you’d like to share crash reports with us. In paid versions, it’s disabled by default. In the Free version, it’s enabled by default but you can still opt-out and you can change your mind at any time by changing the appropriate setting.

When enabled, a crash report contains:

• the OS version
• Binary Ninja version
• CPU architecture
• call stack at the time of the crash
• a list of loaded native libraries

No binary content or identifying information is intentionally included, though application and plug-in paths may contain your system username. Full details are in our privacy policy.

If you want to help us fix bugs faster, we’d appreciate enabling crash reporting but absolutely understand for many this is not desired which is why we default to NOT sending this information.

Special thanks to the following open source contributors whose PRs were merged into this release:

• 3rdit [#941, #943, #944, #946, #947, #969, #1026]
• chedahub [#7552]
• ekilmer [#7547]
• jonpalmisc [#7933]
• mostobriv [#7751]
• NicoleFaye [#962, #983, #991]
• nullableVoidPtr [#6423, #7965]
• razaina [#1004, #1005, #1006]
• SmoothHacker [#7780, #7788]
• trumank [#7797, #7825]
• utkonos [#7748, #7773, #7776, #7839, #7855]
• WHW0x455 [#7842]

We appreciate your contributions!

Analysis / Core

• Feature: Added ZxTransform to the transform system
• Feature: Added work provider signals for activity eligibility in workflows
• Feature: Added backward constraint propagation support to the Value Set Analysis (VSA) system
• Feature: Added PossibleValueSet::Compare to resolve set and range comparisons to constants
• Improvement: Added PossibleValueSet operation APIs and fixed Python PossibleValueSet bindings
• Improvement: Extracted thunk analysis into a standalone pass, decoupling it from the sigkit plugin to prepare for sigkit deprecation
• Improvement: Improved entry point detection to differentiate between a 0x0 entry address and no entry at all
• Improvement: Improved GNU3 demangler with support for new special-name and type constructs
• Improvement: Improved RTTI virtual function discovery to allow extern functions in MSVC vtables
• Improvement: Improved auto-naming of variables using parameter names from tail call targets
• Improvement: Improved memory efficiency of operand lists and label maps within IL instructions by replacing UNDEF instruction chains with a more compact representation
• Improvement: Improved performance by generating structure padding lazily
• Improvement: Improved performance of canMakeString by avoiding large scans for null terminators in UTF-16 and UTF-32 strings
• Improvement: Improved performance of non-namespaced type lookup in large BNDBs
• Improvement: Improved type propagation around offset pointers for better type inference
• Improvement: Moved zero-length section filtering from SectionMap to section creation APIs for more consistent behavior
• Improvement: Reduced map lookups during MLIL SSA translation for a 2-5% improvement in total analysis time
• Improvement: Reduced memory usage of function objects by 70% and their analysis data by 40% by restructuring storage of infrequently set fields
• Improvement: Represent operand lists and label maps more efficiently within IL instructions, replacing chains of UNDEF instructions
• Improvement: Rewrote GNU3 demangler for improved performance using DemangledTypeNode
• Improvement: Scoped RTTI loggers to their associated view for cleaner log output
• Improvement: Simplified HLIL expressions (X << Y) u>> Y and (X u>> Y) << Y
• Fix: Added validation for zero-sized symbol or string tables to prevent potential issues during analysis
• Fix: Fixed crash when readLEB128 is passed a null pointer
• Fix: Fixed crash when displaying a variable with null type in Pseudo-C and Pseudo-Rust
• Fix: Fixed DWARF import incorrectly linking functions without addresses to externs
• Fix: Fixed DWARF import incorrectly wrapping pointer types in named type references
• Fix: Fixed DWARF import wrapping function parameter types in unnecessary named type references
• Fix: Fixed GNU3 demangler float literal decoding to be platform-independent by using big-endian hex via union type-punning
• Fix: Fixed headless mode being prompted with an interaction for mismatched PDB during PDB import
• Fix: Fixed PDB bitfield members importing with wrong offset
• Fix: Fixed PDB parsing issue by removing stale QualifiedName state
• Fix: Fixed potential hang in DWARF import when encountering unhandled DW_AT_location variants for DW_TAG_variable
• Fix: Fixed undefined evaluation order in GNU3 demangler expression builders by sequencing reader-advancing calls into named locals
• Fix: Fixed use of uninitialized stack data in ABB
• Fix: Fixed PDB vtable type name parsing
• Fix: Fixed Analysis::DeleteUnusedAutoFunctions hanging for many minutes on large binaries with over 1 million functions
• Fix: Fixed FloatType alternate name not rendering in tokens when set
• Fix: Fixed LowLevelILFunction::GetInstructionsAt not working on SSA form
• Fix: Fixed MLILSSATranslator not consulting the Platform for global register information
• Fix: Fixed WorkflowMachine task name when resuming from an inactive state
• Fix: Fixed additional invalid ELF parsing issues
• Fix: Fixed anonymous type names conflicting with existing anonymous types
• Fix: Fixed crash in OutlineResolver caused by cycles involving named type references
• Fix: Fixed crash in WorkflowMachine when a workflow activity threw an exception
• Fix: Fixed crash when mapping to HLIL with a void variable type and an MLIL pointer expression type
• Fix: Fixed crash when opening a BNDB that references a non-existent named workflow
• Fix: Fixed data races in Function that could cause crashes during analysis
• Fix: Fixed FlexHex high nibble wildcard matching false positives on 0x7c
• Fix: Fixed forward type propagation to preserve NamedTypeReferences instead of resolving them to raw structs
• Fix: Fixed hang on close during pointer sweep analysis
• Fix: Fixed HLIL call rendering to correctly consider call type adjustments when displaying calls and parameter strings
• Fix: Fixed incorrect file backing when a memory region starts past the segment data length
• Fix: Fixed infinite loop/crash when adding a zero-length section
• Fix: Fixed lookup of basic block labels for higher-level ILs when the IL block start differs from the native block start
• Fix: Fixed miscellaneous issues with vtable type information in PDB processing
• Fix: Fixed non-deterministic tail call detection caused by stale basic blocks
• Fix: Fixed offset pointers imported with __offset attribute losing their offset due to struct member relationship not being preserved
• Fix: Fixed outliner incorrectly outlining scalar struct member writes
• Fix: Fixed outliner incorrectly outlining scalar struct member writes in arrays-of-structs
• Fix: Fixed PDB bitfield members importing with incorrect offset when the bitfield is placed at a storage offset greater than zero
• Fix: Fixed preservation of global pointer register value across call-site stack invalidations
• Fix: Fixed Python ABB incorrectly triggering guided analysis
• Fix: Fixed Python exception in FunctionLifterContext
• Fix: Fixed resolution of named type references for child types in OutlineResolver
• Fix: Fixed template simplifier to correctly account for [api:...] annotations
• Fix: Fixed type filtering to correctly respect underscores in type names
• Fix: Fixed unintentional fallthrough in HLIL simplification that caused exceptions
• Fix: Improved OutlineResolver handling when merging different stream types while writing to fully-typed byte arrays

UI

• Feature: Added “Copy as Rust Array” to the right-click context menu
• Feature: Added go-to address support in the native triage view
• Feature: Added structure data variables as objects in linear view
• Improvement: Added regex and case sensitivity options to FilterEdit widget
• Improvement: Added regex toggle to the component tree FilterEdit widget
• Improvement: Excluded .bndb files from the triage file picker to avoid opening database files in triage mode
• Improvement: Improved performance of the types view
• Improvement: Improved triage view responsive layout to adapt better to different window sizes
• Improvement: Improved outliner to recursively resolve nested struct types
• Improvement: Improved performance of Bookmarks actions by avoiding full function iteration to check validity
• Improvement: Improved performance of the types view by removing recursive expansion, switching to unordered_map, and using uniform row heights
• Improvement: Made analysis conflict dialog labels selectable for easier copying
• Improvement: Made the cross-reference view non-modal when opened in dialog mode
• Improvement: Shows function tags in the linear view sticky header
• Improvement: Sorts menu actions case-insensitively for consistent ordering
• Improvement: Updated entropy tooltip to display file offset and fixed Python version compatibility
• Improvement: Updated triage view to only show libraries when appropriate
• Fix: Fixed MemoryRegionDialog incorrectly prepopulating length for file-backed regions
• Fix: Fixed crash in TypeDialog when parser results arrived at the wrong time
• Fix: Fixed Enter key in the base field of the Create Structure dialog to add the structure instead of dismissing the dialog
• Fix: Fixed long path truncation in triage view and prevented UI from shifting when starting BASE
• Fix: Fixed regression preventing navigation back from triage view
• Fix: Fixed section list in triage view not updating when sections change
• Fix: Fixed settings view layout and resize performance
• Fix: Fixed triage entropy graph navigation for mapped files
• Fix: Fixed bad indentation for single-line function header comments in Linear View
• Fix: Fixed bug preventing editing of data comments created at addresses
• Fix: Fixed crash in Linear View when attempting to define an array
• Fix: Fixed crash in settings view
• Fix: Fixed crash when get_choice_input is called without an active window
• Fix: Fixed crash when viewing MLIL debug report caused by basic block annotations using committed IL functions instead of active ones
• Fix: Fixed duplicated comments in Linear View for objects sharing the same address
• Fix: Fixed hang when rendering self-referential typedef
• Fix: Fixed linear view not refreshing when resized vertically
• Fix: Fixed linear view refresh behavior when resized vertically
• Fix: Fixed linear view to subscribe to section updates so it reflects changes correctly
• Fix: Fixed multiple bugs in triage view
• Fix: Fixed multiple issues in the triage view
• Fix: Fixed null pointer crashes in the Chat sidebar
• Fix: Fixed off-by-one error in the array Copy As action
• Fix: Fixed parsing of extraneous bytes in search result previews
• Fix: Fixed potential null pointer crashes in the User Positions sidebar
• Fix: Fixed single function linear view when the viewed function becomes undefined
• Fix: Fixed sort order in settings view for settings without a subgroup
• Fix: Fixed spin boxes consuming scroll events in the settings view
• Fix: Fixed stack view and variable list sidebars not broadcasting cross-reference selections
• Fix: Fixed text diffs not respecting UTF-16 encoding of QStrings
• Fix: Fixed tooltip struct offset resolution to use ResolveMemberOrBaseMember for improved accuracy
• Fix: Fixed view state restoration being incorrectly applied when opening files via triage

Architectures and Platforms

• Feature: Added GetInstructionTextWithContext callback to the architecture class to share context between basic block recovery, lifting, and disassembly
• Feature: Added arm64 calling conventions for the Swift ABI, including repurposed callee-saved registers
• Feature: Added automatic and manual endianness override support for x86 ELF files
• Feature: Added Intel APX support for x86
• Feature: Added R_386_IRELATIVE relocation handling for x86 ELF binaries
• Feature: Added Swift initial demangling support for Swift symbols
• Feature: Added R_CKCORE_PCREL_JSR_IMM26BY2 relocation support for C-SKY architecture
• Feature: Allows architecture plugins to override function lifting and inlining via LiftFunction
• Feature: Detect Linux ro_after_init region and synthesize overlay section for improved kernel analysis
• Feature: Implemented DTPOFF64 and DTPMOD64 TLS relocations
• Improvement: Allow deserializing type libraries without registering them
• Improvement: Lifted new PPC instructions and fixed MIPS relocation handling
• Improvement: Updated AArch64 system registers based on ARM’s 2025-09 data
• Improvement: Added missing x86_64 relocations
• Fix: Fixed handling of relocations for self-bound data symbols in MachO binaries
• Fix: Fixed MIPS jalr instruction incorrectly receiving a default branch type
• Fix: Fixed si_split16 immediate decoding for PPC VLE I16A-form instructions
• Fix: Fixed calling convention applied to objc_retain_xN / objc_release_xN in the Objective-C runtime type library
• Fix: Fixed MachO chained fixup relocations not respecting addends
• Fix: Fixed MIPS jalr[.hb] $zero, $ra to be recognized as a return instruction
• Fix: Fixed MIPS64 relocation entry parsing
• Fix: Fixed operand order for several PPC floating point instructions that were reversed
• Fix: Fixed rounding flag emission on certain x86 floating point instructions
• Fix: Fixed FreeFunctionArchContext error logs on Linux
• Fix: Fixed LIST_ENTRY type specializations for AMD64 Windows platform
• Fix: Fixed C-SKY targets and improved Cpop instruction output
• Fix: Fixed crash on Windows when setting thread name with invalid characters
• Fix: Fixed crash when a platform is not registered in the global platform registry
• Fix: Fixed duplicate type libraries losing named types and objects
• Fix: Fixed import address symbol size to use platform address size instead of a hardcoded value (except linux-x32 which retains 8-byte pointers)
• Fix: Fixed lifting bug in Hexagon predicated jumps with intra-packet p0 dependencies
• Fix: Fixed logic bug affecting ldq/stq instruction handling in M-CORE architecture
• Fix: Fixed panic in C-SKY lifter when setting IL register
• Fix: Improved register handling safety in C-SKY and M-CORE lifting

Core Plugins

• Feature: Added initial version of a Swift support plugin
• Feature: Added PE resource information parsing and display in triage view
• Feature: Added support for applying parameter and return types during Swift demangling (disabled by default)
• Feature: Added whole-file entropy calculation to the triage view
• Feature: Added LZMA, LZMA2, LZ4 (Block/Frame), LZF, and ZStandard compression transforms
• Feature: Added support for loading stored files in AES encrypted zips
• Feature: Added UImage, FIT, and TRX firmware transforms
• Feature: Added quick export action to BinExport plugin
• Improvement: Added type propagation from objc_alloc_init and related functions in the Obj-C plugin
• Improvement: Added NRF52840 to Firmware Ninja board descriptions
• Improvement: Added support for loading Ghidra 12.0 databases in the Ghidra importer
• Improvement: Renamed corePlugins.ghidraImport to corePlugins.ghidra
• Improvement: Improved DSC section creation performance by deferring section map rebuilds until all sections are added
• Improvement: Improved KernelCache section creation performance by wrapping bulk section additions in BeginBulkAddSegments/EndBulkAddSegments to defer section map rebuilds
• Improvement: Improved Mach-O section type identification by properly masking flags with SECTION_TYPE
• Improvement: Improved Obj-C analysis to set return types on objc_msgSend calls that send an init message to a known class
• Improvement: Improved performance of loading many images from the shared cache after introduction of SectionMap
• Improvement: Improved Zlib transform diagnostics by surfacing inflate errors and warning on likely false positive decompression
• Improvement: Removed the add bitfield setting from SVD Import as bitfields are now always included with correct type system representation
• Improvement: Set segment flags for MachO kernel images based on how XNU initially maps them
• Fix: Fixed crash when parsing ELF files with empty .interp or .dynamic sections
• Fix: Fixed DSC symbols to correctly reflect local, global, or weak binding
• Fix: Fixed incorrect handling of BIND_SPECIAL_DYLIB_\*_LOOKUP modes in MachO chained fixups where negative-encoded library values were mishandled
• Fix: Fixed intermittent unrelocated pointers in DSC caused by FileAccessorCache LRU eviction discarding mapped files
• Fix: Fixed Obj-C plugin overriding the core.function.metaAnalysis workflow description
• Fix: Fixed Objective-C metadata not being processed when loading a DSC view from a .bndb
• Fix: Fixed reading dynamic string tables at large offsets in ELF files
• Fix: Fixed SVD import mapper issue where unordered register fields caused spurious __offset fields to appear in structures
• Fix: Fixed Ghidra import to use address size from the Ghidra database for default pointer width
• Fix: Fixed Ghidra importer generating empty function types when function parameters are uncommitted
• Fix: Fixed MachO weak bound symbols being incorrectly resolved to their import address
• Fix: Fixed nondeterminism in WARP matching by allowing multi-round matching to resolve function dependencies during parallelized analysis
• Fix: Fixed WARP relocatable region selection to properly fall back to section collection when segment list is used
• Fix: Fixed WARP server URL sanitization to handle malformed inputs
• Fix: Fixed WARP sidebar not showing selected function when opening the sidebar for the first time
• Fix: Fixed warp_headless example not linking binaryninjacore, which prevented it from loading

Collaboration / Projects

• Feature: Added table view and miscellaneous fixes and improvements to the Project Browser
• Feature: Added support for function value stores in collaboration
• Improvement: Added Open Selected Files with Container Browser... option to the project browser context menu
• Improvement: Improved container-aware display names in projects
• Improvement: Improved Save As behavior when working with project files
• Improvement: Separated recent file and project states to track them independently
• Fix: Fixed HTTP requests retrying during shutdown to prevent hangs or errors on exit
• Fix: Fixed improper variable cast in databasesync.py
• Fix: Fixed crash when failing to retrieve the current snapshot while saving a collaboration database
• Fix: Fixed default path for Create Type Archive dialog when used with a project file
• Fix: Fixed hang when checking floating license validity while unable to reach the Enterprise server
• Fix: Fixed minor issues in the collaboration Python API
• Fix: Fixed persistent User Positions errors
• Fix: Fixed save dialog proposing the container name instead of the entry name for container files in projects
• Fix: Fixed spurious crashes caused by unexpected WebSocket connection lifetime issues in collaboration
• Fix: Fixed stale display name and virtual path information when saving a file

API

• Feature: Added get_metadata() method to BinaryView, Function, and Project, and made query_metadata() raise KeyError consistently
• Feature: Added mutex and recursive_mutex to bn::base, using os_unfair_lock on Apple platforms
• Feature: Added TransformSession constructor that adopts an existing TransformContext
• Feature: Added global plugin command type for registering plugins available outside the context of a binary view
• Feature: Added QualifiedName.separator property to the Python API
• Feature: Added a hook for BinaryView subclasses to run code after snapshot data is applied
• Feature: Added missing LowLevelILFunction::AddOverFlow API
• Feature: Added support for calling conventions to specify required registers for heuristic calling convention detection
• Feature: Added support for ephemeral session-time settings for TransformSession
• Feature: Exposed BNDetectSearchMode to the Python API for search mode testing
• Feature: Introduced an RAII type for managing bulk symbol modifications to simplify batched symbol updates
• Feature: Added TypeLibrary.remove_named_object and TypeLibrary.remove_named_type to the Python API
• Feature: Added API to remove data from type libraries, useful when relocating information between type libraries before finalization
• Feature: Added GetNamedTypeSource API to type libraries
• Feature: Added TypeLibrary::Register to allow loading type libraries programmatically from scripts
• Feature: Added missing TypeLibrary.duplicate API to Python bindings
• Improvement: Allow decompressing standalone TypeLibrary objects without requiring them to be written to disk first
• Improvement: Updated function signatures of some type library APIs in Python
• Improvement: Added BN_DEPRECATED macro to annotate deprecated C++ APIs with compiler warnings
• Improvement: Added ProjectFile type annotation to the Python load function
• Improvement: Added SegmentInfo and SectionInfo dataclasses and helper functions to make add_user_segment, add_auto_segment, and section APIs more Pythonic
• Improvement: Added VariableList::updateCrossReferences declaration to the API
• Improvement: Added control over which address is used for instructions created when inlining during analysis
• Improvement: Added session settings override support to the Transform system and improved documentation
• Improvement: Added setters for NamedTypeReferenceBuilder properties in the Python API
• Improvement: Added [[nodiscard]] attribute to Structure/StructureBuilder GetMemberByName/GetMemberByOffset to catch ignored return values at compile time
• Improvement: Added ForEachField APIs to reduce copying of structure members
• Improvement: Added support for MLIL_SEPARATE_PARAM_LIST and MLIL_SHARED_PARAM_SLOT in Python copy_expr_to
• Improvement: Added type hints to Architecture flags fields in the Python API
• Improvement: Allow overriding the IL source location used by ILInstruction::CopyTo
• Improvement: Allows flexible user plugin install location via a CMake cache variable
• Improvement: Enhanced MemoryMap bindings and added support to re-enable disabled regions in the UI
• Improvement: Improved Confidence<T> move semantics to avoid unnecessary copies and reference count churn
• Improvement: Improved performance of canMakeString
• Improvement: Improved Python API for architectures and lifting
• Improvement: Specified fixed underlying types for core-exposed enums, shrinking several widely-used enums from 4 bytes to 1 byte
• Improvement: Updated QualifiedName constructor to accept a separator parameter
• Improvement: Updated Python API generator to detect flag enums and emit IntFlag instead of IntEnum
• Improvement: Use bn::base::function_ref instead of std::function for non-stored callback parameters to reduce overhead
• Fix: Fixed BinaryView.get_modification failing when passing a length argument
• Fix: Fixed LogTrace *FV/*F variants to respect the BN_ENABLE_LOG_TRACE compile guard instead of unconditionally calling fmt::vformat
• Fix: Fixed TypeError when slicing FunctionList/BasicBlockList with [:], [n:], or [:n]
• Fix: Fixed crash in show_message_box when description is None in Python
• Fix: Fixed GIL deadlock in QueueGenerator search APIs
• Fix: Fixed handling of None cases when empty strings are returned from core and corrected associated coreversion usage
• Fix: Fixed incorrect type hint and null string handling in the API
• Fix: Fixed many compiler warnings when building with GCC 15.2
• Fix: Fixed slice handling in TagList to match FunctionList/BasicBlockList behavior
• Fix: Fixed BinaryView types in Python API
• Fix: Fixed CallingConvention.get_incoming_flag_value in the Python API
• Fix: Fixed CoreVersionInfo API and added unit tests
• Fix: Fixed Function::StoreMetadata not marking the function as changed, ensuring dependent analysis is properly invalidated
• Fix: Fixed get_flag_write_low_level_il to properly extract LLIL flags in the Python API
• Fix: Fixed Platform.view_init passing the cffi object instead of the API object
• Fix: Fixed QualifiedName join from FFI and added NameSpace join support
• Fix: Fixed covariant user list types in Python API
• Fix: Fixed crashes when passing null to demangle APIs
• Fix: Fixed enums not being cast to their types in the Python bindings generator
• Fix: Fixed generator handling of sub-4-byte signed enums with negative members (affected InvalidILViewType)
• Fix: Fixed LLIL flags parameter type annotation to correctly reflect flag writes rather than flags
• Fix: Fixed missed mismatch detection for flag_name in Python API
• Fix: Fixed overriding Architecture.assemble in Python subclasses being broken
• Fix: Fixed Python QName separator method to use the correct name join to match the C++ API
• Fix: Fixed Python type issues and updated tests to account for new field in QualifiedName struct
• Fix: Fixed use-after-free bug in TypeBuilder.handle where the underlying object was deleted before the handle was used
• Fix: Relaxed type constraints on children passed into type factories in the Python API
• Fix: Fixed operand list iterators being invalidated when appending new instructions by storing offsets instead of pointers

Rust API

• Feature: Added address_comments to BinaryViewExt in the Rust API
• Feature: Added BinaryViewExt::tags_all_scopes, tag_types, and tags_by_type to the Rust API
• Feature: Added BinaryViewExt::type_libraries to the Rust API
• Feature: Added From<BnString> impl for QualifiedName to simplify conversions
• Feature: Added Function::defined_symbol to retrieve a function’s symbol only when it is explicitly defined
• Feature: Added load_project_file and load_project_file_with_progress to open project-linked files and avoid detached binary views
• Feature: Added LowLevelILSSARegister type to the Rust API
• Feature: Added OwnedBackgroundTaskGuard for automatically finishing background tasks via RAII
• Feature: Added Platform::address_size to the Rust API
• Feature: Added Symbol::ordinal to the Rust API
• Feature: Added TypeBuilder::function and TypeBuilder::function_with_opts to the Rust API for constructing function types
• Feature: Added TypeBuilder::set_signed to the Rust API
• Feature: Implemented data notification API for Rust bindings
• Feature: Added TypeLibrary::remove_named_object and TypeLibrary::remove_named_type to the Rust API
• Feature: Added APIs to retrieve type archives for a binary view in Rust
• Improvement: Added miscellaneous TypeLibrary API improvements to the Rust bindings
• Improvement: Added more type library examples for the Rust API
• Improvement: Added dedicated TypeArchiveId type to prevent ID type confusion in the type archive API
• Improvement: Implemented Send and Sync for TypeLibrary to enable safe cross-thread usage
• Improvement: Improved API surrounding binary view type libraries in the Rust bindings
• Improvement: Added miscellaneous documentation to the Rust API
• Improvement: Added more architecture module documentation and misc cleanup to the Rust API
• Improvement: Added setters for creating NTR references in the Rust API
• Improvement: Added top-level documentation to the tracing and logger modules
• Improvement: Implemented BinaryViewEventHandler for Fn(&BinaryView), allowing closures to be passed directly to the register function
• Improvement: Implemented Debug for RemoteProject, RemoteFolder, and BinaryViewType
• Improvement: Implemented Display for Symbol, FileMetadata, and VersionInfo
• Improvement: Added PartialEq, Eq, and Hash for ProjectFile and Project
• Improvement: Implemented Send and Sync for RemoteFolder, CoreLanguageRepresentationFunctionType, RemoteProject, and RemoteFile
• Improvement: Made InstructionTextToken field expr_index optional via Option type
• Improvement: Refactored AnalysisProgress returned from BinaryViewExt::analysis_progress
• Improvement: Refactored FileMetadata to rename and retype filename and require it to be set at construction time
• Improvement: Removed UnusedRegisterStackInfo and updated architecture documentation in the Rust API
• Improvement: Removed redundant ArchAndAddr type in favor of Location
• Improvement: Replaced log with tracing for logging in the Rust API
• Improvement: Restructured type APIs into a types module for improved discoverability and documentation
• Improvement: Updated TagReference to optionally accept architecture and function parameters
• Improvement: Updated TypeBuilder::named_type to accept type_reference by reference instead of by value
• Improvement: Updated TypeParser to use PathBuf instead of String for include directory parameters
• Improvement: Updated debug info functions to return Array types for more consistent Rust API patterns
• Fix: Added precondition check to ensure metadata is pulled before pulling remote projects
• Fix: Fixed load_view_with_progress when options is None
• Fix: Fixed PartialEq and Hash impls for FileMetadata to use the unique session_id for comparisons and hashing
• Fix: Fixed QualifiedName::default() incorrectly creating a QualifiedName with an empty separator
• Fix: Fixed crash when calling LowLevelILFunction::generate_ssa_form without an owner function
• Fix: Fixed double free in analysis_info with function refs and added string reader helpers
• Fix: Fixed lifetime management of WebsocketClientCallback objects in the Rust API
• Fix: Fixed memory leak in Function::guided_source_blocks where BNFreeArchitectureAndAddressList was not called
• Fix: Fixed unbalanced ref returned in RemoteFile::core_file
• Fix: Fixed undefined behavior when passing include directories to CoreTypeParser
• Fix: Fixed untyped expr_idx within MLIL ILReferenceSource in the Rust API
• Fix: Fixed BinaryViewExt::address_comments memory leak and refactored implementation
• Fix: Fixed OwnedBackgroundTaskGuard to not require mutable self
• Fix: Fixed undefined behavior in basic block analysis context out parameters in the Rust API
• Deprecation: Removed deprecated MLIL functions from the Rust API

Debugger

• Feature: Added NextMemoryAccess/PrevMemoryAccess API and UI for TTD (Time Travel Debugging)
• Feature: Added container file detection and extraction support to the debugger
• Feature: Added execution count display for instructions in the code coverage analysis render layer
• Feature: Added manual rebasing support via debugger.autoRebase setting and a new Rebase to Remote Base action
• Feature: Added module names to the expression parser for address resolution
• Feature: Added process list viewing and selection for the esReven adapter
• Feature: Added setting to disable LLDB auto-install during remote debugging, addressing an issue where LLDB would delete the debugged binary
• Feature: Added support for bookmarking timestamps in TTD sessions
• Feature: Added time range filter option for TTD code coverage analysis to narrow coverage results to a specific execution window
• Feature: Added TTD attach to running process support
• Feature: Added TTD timestamp history navigation (back/forward) to allow stepping through recorded stop positions
• Feature: Enabled TTD menu and widgets on Linux and macOS
• Feature: Implemented GetCurrentTTDPosition and SetTTDPosition for the esReven adapter using rvn:get-current-transition and rvn:set-current-transition
• Feature: Implemented GetThreadList and GetFramesOfThread for the esReven adapter using the rvn:list-threads packet
• Feature: Implemented TTD memory access queries for the esReven adapter using rvn:get-memory-accesses
• Improvement: Added new icons for TTD back/forward controls
• Improvement: Added regex and case sensitivity options to FilterEdit in the debugger
• Improvement: Added row copy/paste support and multi-row selection to the registers widget
• Improvement: Added configurable ttd.maxSymbolsLimit setting (default 50, 0 for no limit) for esReven TTD wildcard symbol lookups
• Improvement: Improved TTD widget UI on macOS
• Improvement: Improved WinDbg/TTD installation process with quality-of-life enhancements
• Improvement: Updated DebugBreakpoint.__repr__ to include the condition when set
• Fix: Fixed ParseGdbValue to correctly handle vector/SIMD registers and unavailable values in GDB MI register output
• Fix: Fixed big-endian register parsing in the GDB RSP adapter for PowerPC and other big-endian targets
• Fix: Fixed concurrent access issue in g_debuggerControllers by replacing raw pointer management with thread-safe storage
• Fix: Fixed crash in uncaught exceptions thrown by code
• Fix: Fixed crash when attaching to a process if dbgeng fails to initialize
• Fix: Fixed crash when connecting to QEMU-PPC targets due to architecture string missing a hyphen after the colon
• Fix: Fixed multiple debugger bugs including Python FFI mismatches, mutex leak, thread state issues, and double notification
• Fix: Fixed potential null pointer dereferences when acquiring dynamic UI objects in the debugger
• Fix: Fixed sorting in TTD event widget
• Fix: Fixed view not refreshing after TTD coverage analysis completes
• Fix: Fixed delay-loading of Sentry to prevent dbghelp.dll from loading from System32 and breaking the dbgeng adapter
• Fix: Fixed error when accessing dbg.breakpoints
• Fix: Fixed conditional breakpoint evaluation when stepping onto a breakpoint in LLDB
• Fix: Fixed crash when retrieving breakpoint condition
• Fix: Fixed crash when toggling breakpoints with the GDB MI adapter
• Fix: Fixed TTD negotiation breaking regular debugging in the GDB MI adapter
• Fix: Fixed values wider than 8 bytes displaying as 0x0 in the TTD memory widget

Documentation

• Improvement: Added documentation for hardware breakpoints
• Improvement: Added examples for execute_ APIs
• Improvement: Added explicit online privacy documentation covering data collection and network usage
• Improvement: Added module workflow hello world example
• Improvement: Added Windows Defender antivirus exception documentation
• Improvement: Added Windows Python workaround documentation for known compatibility issue
• Improvement: Added docs for __attr
• Improvement: Reorganized Quark documentation into a dedicated section to improve readability
• Improvement: Updated docs for using module names in the expression parser
• Improvement: Updated TTD documentation to cover new features
• Improvement: Updated Ghidra import documentation with minor tweaks and improved cross-references

Despite the list of changes getting bigger with almost every release, it still doesn’t cover everything that’s happened! If you want to see even more details, check out our closed milestone on GitHub.