Awesome Open Source
Awesome Open Source

Obfuscation Detection

Authored by: mcdulltii

Automatically detect obfuscated code and other state machines

Description:

Scripts to automatically detect obfuscated code and state machines in binaries.

Implementation is based on IDA 7.4+ (Python3). Check out the following blog posts for more information on the Binary Ninja implementation:

Note:

Heuristic values are generated based on the above blog posts, and are sorted (when run in All Functions mode) top down based on their heuristic complexities.

Due to the recursive nature of plotting a dominator tree of every found function within the binary, the implementation and runtime overhead is expensive, though threading has been implemented.

Using PyQt to visualize the plugin, users are able to further customize the heuristic function analysis on the binary.

Dependencies (Python3)

PyQt5

Installation

Copy the obfDetect directory and obfDetect.py into the IDA Plugins directory.

When IDA has successfully finished loading a binary, the script will print out its banner into the IDC/Python console.

The script can be run via the File toolbar as shown below. Alternatively, Ctrl-Shift-H.

Toolbar

Features

  • Function names in output table can be renamed using n, and will thus update IDA's function names specified by its function address

  • Export filename input box when clicked, will open a file selection pop-up which can be navigated into a custom save location

Usage

  1. Select Heuristic function
  2. Select number/address of binary function to run heuristic function on
  3. (Optional) Filter out binary functions with a maximum node size
  4. Click Run button to start analysis
  5. (Optional) Click on Export filename input box to select export location, and click Export button to export table to csv format

Screenshots

  • Base GUI selection

Base GUI

  • Heuristic GUI analysis

Heuristic analysis

  • Single function heuristic GUI analysis

Single heuristic analysis

Todo

  • QTableWidget selected item export
Related Awesome Lists
Top Programming Languages
Top Projects

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Python (807,156
Ida (1,161
Ida Pro (252
Idapython (185
Ida Plugin (131
Idapython Plugin (28
Obfuscation Detection (3