Find Code Caves

July 20, 2026 · View on GitHub

A Binary Ninja plugin that scans all executable segments of a loaded binary for "code caves" — contiguous runs of filler bytes (0x90 NOP, 0xCC INT3, or 0x00 NULL) large enough to be useful for static patching or shellcode injection.

Features

  • Scans every executable segment in the binary
  • Detects runs of NOP, INT3, or NULL bytes
  • Configurable minimum cave size via Binary Ninja Settings (default: 20 bytes)
  • Sorts results by size, largest first
  • Prints a summary table (address, size, byte type, containing segment) to the Binary Ninja log
  • Reports total cave count and total available space

Usage

Run Tools > Find Code Caves (or via the command palette) after loading a binary. Results are printed to the Binary Ninja log window.

Settings

This plugin registers a setting under Edit > Preferences > Settings > Find Code Caves:

SettingKeyTypeDefaultDescription
Minimum Cave Sizefindcodecaves.minSizenumber20Minimum number of contiguous filler bytes required for a run to be reported as a code cave.

Adjust this value to filter out small, less useful caves, or lower it to surface smaller gaps for tighter patches.

Example Output

[Default] ============================================================
[Default] Searching for code caves...
[Default] ============================================================
[Default] Searching segment: 0x7ff660f01000 - 0x7ff661de4510
[Default]
[Default] ============================================================
[Default] Found 150 code caves (>= 20 bytes)
[Default] ============================================================
[Default] Address            Size     Type     Segment
[Default] ------------------------------------------------------------
[Default] 0x007ff660f1af3f  193      NOP      0x007ff660f01000
[Default] 0x007ff660f6edcc  116      NOP      0x007ff660f01000
[Default] 0x007ff660f6e89a  102      INT3     0x007ff660f01000
[Default] 0x007ff660f2dc9b  101      NOP      0x007ff660f01000
[Default] 0x007ff660f44fb1  79       INT3     0x007ff660f01000
[Default] 0x007ff660f3e982  62       INT3     0x007ff660f01000
[Default] 0x007ff660f264c5  59       INT3     0x007ff660f01000
[Default] 0x007ff660f22946  58       NOP      0x007ff660f01000
[Default] 0x007ff660f08987  57       NULL     0x007ff660f01000
[Default] 0x007ff660f30ec7  57       NULL     0x007ff660f01000
...
[Default]
[Default] ============================================================
[Default] Largest cave: 193 bytes at 0x7ff660f1af3f
[Default] Total caves: 150
[Default] Total space: 4983 bytes
[Default] ============================================================

Notes

This is a static analysis tool — it only reads segment data as loaded by Binary Ninja's analysis; it does not modify the binary.

License

MIT