Home

Awesome

Obfuscation Detection

Authored by: mcdulltii

Automatically detect obfuscated code and other state machines

Description:

Scripts to automatically detect obfuscated code and state machines in binaries.

Implementation is based on IDA 7.4+ (Python3). Check out the following blog posts for more information on the Binary Ninja implementation:

Note:

Heuristic values are generated based on the above blog posts, and are sorted (when run in All Functions mode) top down based on their heuristic complexities.

Due to the recursive nature of plotting a dominator tree of every found function within the binary, the implementation and runtime overhead is expensive, though threading has been implemented.

Using PyQt to visualize the plugin, users are able to further customize the heuristic function analysis on the binary.

Dependencies (Python3)

PyQt5

Installation

Copy the obfDetect directory and obfDetect.py into the IDA Plugins directory.

When IDA has successfully finished loading a binary, the script will print out its banner into the IDC/Python console.

The script can be run via the File toolbar as shown below. Alternatively, Ctrl-Shift-H.

Toolbar

Features

Usage

  1. Select Heuristic function
  2. Select number/address of binary function to run heuristic function on
  3. (Optional) Filter out binary functions with a maximum node size
  4. Click Run button to start analysis
  5. (Optional) Click on Export filename input box to select export location, and click Export button to export table to csv format

Screenshots

Base GUI

Heuristic analysis

Single heuristic analysis

Todo