Binary Ninja

How to play

✕

You are a reverse-engineer with a grappling gun, following a program's execution trace from its entry block to the end of the run. The route is solid. The obfuscator's invented control flow is not.

Controls

• A D move left and right
• Space jump — or let go of the line with a kick
• Mouse aim; the reticle fills in when a block is in range
• Left click hold to fire and hold the line, release to let go
• W / right click reel the line in
• S pay line out, or drop through the block you are standing on
• R restart at the last checkpoint
• Esc pause
• F1 analysis overlay

Swinging

• Aim past the gap, hold the button, and run off the edge. The line goes taut and you swing under the anchor.
• Holding the button also winches you in, which tightens the arc and lifts you toward the block. Let go near the top of the swing and your momentum carries you onto it.
• Releasing keeps every bit of your speed, so one swing can be launched straight into the next. Short gaps you can simply jump.
• The hook fires wherever you point it, hit or miss — and it is the line that catches, not just the tip, so a shot that flies past a block can still hook it as you swing across. Catch nothing and the hook simply comes back.

What will drop you

• Bogus blocks. Some code here was invented by the obfuscator to waste your time. Stand on one or hook it and it cracks, then falls. They look like everything else until you touch them, and no route ever needs one.
• Firewall gates pulse between open and lethal. Cross on the gap.
• Scanner beams sweep their chamber. Wait for the pass, then move.
• The watchdog advances from behind once the program arms it. Keep moving.

Checkpoints and the spawn are safe harbours — nothing can kill you inside one. Dying costs a retry and puts you back at the last one, with the collapsed blocks restored.

About the data

✕

Every code block you swing between is a real fragment of a compiled, Hikari-obfuscated x86-64 program. An offline analysis pipeline produced eight datasets — one per level — and the game loads them in the browser from web_game_data/index.json. Nothing in the page parses a PE file, an LLVM module, a control-flow graph or an emulator trace; that work happened before the game existed, and the game only reads its result.

What is real

• Addresses, entry RVAs and instruction listings on every block.
• The raw basic blocks each visible block stands for.
• String references, where the binary has any in plaintext.
• Semantic call sites — authentication, firewall, scanner, watchdog, transfer, navigation, reconvergence, cleanup.
• The chronological trace occurrences behind each block, and the real machine CFG edges out of each bogus one.
• Hikari provenance on the unstable blocks: each retains a strongly proven alteredBB classification from the obfuscator's own output.

One block is not one basic block

A visible platform is a chronological instance of a compact gameplay node. It commonly maps to several machine basic blocks, and where a program revisits the same logical node the trace gets a new forward platform with an incremented occurrence rather than a loop you have to walk backwards. The inspector shows the real count for whatever you are aiming at, and the analysis overlay (F1) shows the node and occurrence.

Which blocks crumble

Only blocks the dataset classifies as Hikari bogus control flow can collapse under you. Each one maps to a single machine block whose alteredBB label survived into the assembled object file. Legitimate code that simply was not executed on the traced run is not fake, and the game never treats it as fake. Every level's successful route is completable without ever touching a crumbling block — checked by a test that drives the game's own physics, and by a second that proves no step is left with a collapsing block as its only way across.

They are meant to tempt you. A bogus block is placed as an apparent shortcut, a stepping stone in a gap, an inviting anchor overhead or a recovery ledge under a drop, and it shows the same real disassembly as everything else. The only thing that gives it away is standing on it.

Two kinds of line

The analysis overlay draws two relationships that the dataset keeps strictly apart. Grapple links are physical gameplay reachability — where you can get to from where. Machine CFG edges are what the binary can actually branch to. A grapple link never asserts that a CFG edge exists, and several separately proven bogus blocks can be physically reachable in sequence without forming any connected chain in the program.

Blackout and Root have no strings

The fifth and eighth programs were built with string encryption, so their exported blocks carry no plaintext strings at all. The game does not restore them, and does not substitute guesses drawn from the semantic event metadata. Both missions are deliberately harder to read.

Layout is tuned; mappings are not

The delivered x/y coordinates passed an abstract reachability check that was explicitly not a rope-physics simulation, and at their supplied spacing several levels very nearly form a continuous walkway. The game widens the spacing between consecutive route platforms with a deterministic transform before play, in proportion to how horizontal each step already is — so the shaft in Quarantine stays a shaft and the climbs in Root stay climbs — and leaves every y, every width, every id and every binary fact untouched. Each decoy rides along on the pair of route blocks it was authored against. The analysis overlay reports the tuned and delivered coordinates side by side.