AI product Open source
BINNY is an open-source agent harness for reverse engineering. It connects a selected hosted or local language model to decompiled functions, strings, imports, data, Ghidra analysis, and other analysis tools, then runs a triage, investigation, and report-drafting loop against a binary. It can classify samples using the STIX 2.1 malware vocabulary, apply malware or vulnerability-research playbooks, record findings, and save checkpoints after each step for later resumption.
BINNY supports autonomous, supervised, and collaborative operating modes, as well as an interactive question-and-answer mode for checking existing report claims or inspecting individual functions. Its sandbox executes analysis scripts in a Docker container with no network, read-only mounts, dropped capabilities, and resource limits. Local Ghidra decompilation runs on the user's machine, and projects can include multiple samples. The tool supports hosted providers and local models through Ollama, LM Studio, llama.cpp, or vLLM, provided the model supports tool calling.
It is distributed as cross-platform binaries and can also be built from source. BINNY is licensed under the GNU Affero General Public License version 3 or later.
1 use taken from transcripts — each links to the moment in the video.
Connects an AI model to reverse engineering tools and turns binary analysis into a reviewable report. It reads decompiled functions, strings, and imports, records findings, and saves progress after each step, with local Ghidra decompilation and analysis scripts run in a restricted network-less Docker sandbox.
1 in the library.