Automatically detect obfuscated code and other state machines

Last update: Dec 04, 2022

Overview

Obfuscation Detection

Authored by: Tim Blazytko

Adapted by: mcdulltii

Automatically detect obfuscated code and other state machines

Description:

Scripts to automatically detect obfuscated code and state machines in binaries.

Implementation is based on IDA 7.4+ (Python3). Check out the following blog posts for more information on the Binary Ninja implementation:

Note:

Due to the recursive nature of plotting a dominator tree of every found function within the binary, the implementation and runtime overhead is expensive, though threading has been implemented.

MAX_FUNCTIONS = 50
MAX_NODES = 50
# --- snipped ---
if sum([1 for _ in idautils.Functions()]) > MAX_FUNCTIONS:
    detect.partial_heur()
else:
    detect.all_heur()
# --- snipped ---
if sum([1 for _ in FlowChart(get_func(ea))]) > MAX_NODES:
    pass

For more details on partial_heur() and all_heur():

all_heur() calls all heuristic functions on the binary, then prints an output of the heuristics of all functions within the binary.

partial_heur() calls all heuristic functions on the binary, then prints an output of the heuristics of the top 10% (or bounded by MAX_FUNCTIONS) functions within the binary.

Instruction overlapping heuristic algorithm makes use of mcsema disassembly code to follow jmp and call instructions for better coverage.

Since the script uses the IDA API, any functions that are missed by IDA will likely not be detected.

Usage

Copy the obfDetect directory and obfDetect.py into the IDA Plugins directory.

When IDA has successfully finished loading a binary, the script will print out its banner into the IDC/Python console. If not, the script can be re-loaded using alt-E and selecting it within the plugin dropdown.

The script can be run via the File toolbar as shown below. Alternatively, Ctrl-Shift-H.

Examples

A small binary with 2 scanned functions

Resilience test using a large binary obfuscated using O-LLVM

Instruction overlapping heuristic detection

Todo

GUI Implementation branch

You might also like...

A way to integrate Latex, VSCode, and Inkscape in macOS. Adopted the whole workflow from Gilles Castel.

VSCode-LaTeX-Inkscape A way to integrate LaTeX, VSCode, and Inkscape in macOS Abstract I use LaTeX heavily in past two years for both academic work an

62 Dec 14, 2022

A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.

PyArmor Homepage (中文版网站) Documentation(中文版) PyArmor is a command line tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine

1.9k Jan 1, 2023

A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.

PyArmor Homepage (中文版网站) Documentation(中文版) PyArmor is a command line tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine

1.9k Dec 30, 2022

High performance, easy-to-use, and scalable machine learning (ML) package, including linear model (LR), factorization machines (FM), and field-aware factorization machines (FFM) for Python and CLI interface.

What is xLearn? xLearn is a high performance, easy-to-use, and scalable machine learning package that contains linear model (LR), factorization machin

3k Jan 3, 2023

High performance, easy-to-use, and scalable machine learning (ML) package, including linear model (LR), factorization machines (FM), and field-aware factorization machines (FFM) for Python and CLI interface.

What is xLearn? xLearn is a high performance, easy-to-use, and scalable machine learning package that contains linear model (LR), factorization machin

2.8k Feb 12, 2021

High performance, easy-to-use, and scalable machine learning (ML) package, including linear model (LR), factorization machines (FM), and field-aware factorization machines (FFM) for Python and CLI interface.

What is xLearn? xLearn is a high performance, easy-to-use, and scalable machine learning package that contains linear model (LR), factorization machin

3k Jan 8, 2023

Collection of scripts to pinpoint obfuscated code

Obfuscation Detection (v1.0) Author: Tim Blazytko Automatically detect control-flow flattening and other state machines Description: Scripts and binar

230 Nov 26, 2022

Galvanalyser is a system for automatically storing data generated by battery cycling machines in a database

Galvanalyser is a system for automatically storing data generated by battery cycling machines in a database, using a set of "harvesters", whose job it

20 Sep 28, 2022

Generate obfuscated meterpreter shells

Generator Evade AV with obfuscated payloads Installation must install dotnet prior to running the script with net45 Running ./generator.py -ip Your-I

219 Nov 28, 2022

MODeflattener deobfuscates control flow flattened functions obfuscated by OLLVM using Miasm.

138 Jan 7, 2023

OLOP: One-Line & Obfuscated Python

OLOP: One-Line & Obfuscated Python This repository contains useful python modules for one-line and obfuscated python. pip install olop-ShadowLugia650

1 Jan 9, 2022

We evaluate our method on different datasets (including ShapeNet, CUB-200-2011, and Pascal3D+) and achieve state-of-the-art results, outperforming all the other supervised and unsupervised methods and 3D representations, all in terms of performance, accuracy, and training time.

An Effective Loss Function for Generating 3D Models from Single 2D Image without Rendering Papers with code | Paper Nikola Zubić Pietro Lio University

213 Dec 27, 2022

A discord bot that can detect Nitro Scam Links and delete them to protect other users

A discord bot that can detect Nitro Scam Links and delete them to protect other users. Add it to your server from here.

9 Oct 20, 2022

A tool combining EasyOCR and LaMa to automatically detect text and replace it with an inpainted background.

EasyLaMa (WIP) This is a tool combining EasyOCR and LaMa to automatically detect text and replace it with an inpainted background. Installation For GP

3 Sep 17, 2022

Periodically check the manuscript state in the scholar one system and send email when finding a new state.

ScholarOne-manuscript-checker Periodically check the manuscript state in the scholar one system and send email when finding a new state. Parameters ne

2 Aug 18, 2022

A simple voice detection system which can be applied practically for designing a device with capability to detect a baby’s cry and automatically turning on music

Auto-Baby-Cry-Detection-with-Music-Player A simple voice detection system which can be applied practically for designing a device with capability to d

2 Dec 15, 2021

Automatically detect changes made to the official Telegram sites.

🕷 Telegram Web Crawler This project is developed to automatically detect changes made to the official Telegram sites. This is necessary for anticipat

115 Dec 31, 2022

Customised to detect objects automatically by a given model file(onnx)

LabelImg LabelImg is a graphical image annotation tool. It is written in Python and uses Qt for its graphical interface. Annotations are saved as XML

1 Jun 7, 2022

TensorFlowTTS: Real-Time State-of-the-art Speech Synthesis for Tensorflow 2 (supported including English, Korean, Chinese, German and Easy to adapt for other languages)

🤪 TensorFlowTTS provides real-time state-of-the-art speech synthesis architectures such as Tacotron-2, Melgan, Multiband-Melgan, FastSpeech, FastSpeech2 based-on TensorFlow 2. With Tensorflow 2, we can speed-up training/inference progress, optimizer further by using fake-quantize aware and pruning, make TTS models can be run faster than real-time and be able to deploy on mobile devices or embedded systems.

3k Jan 4, 2023

Comments

dict_keys error.

while using it against themida hanhelds , i got this :

func_list = list(reversed(sorted_functions.keys()))[:bound] if partial else list(reversed(sorted_functions.keys()))
TypeError: 'dict_keys' object is not reversible

bug

opened by ghost 2

Releases(v1.7)

v1.7(Mar 20, 2022)
What's Changed

Support for IDA 7.4+ (Including 7.7 onwards)

Added version check for deprecated API functions

Full Changelog: https://github.com/mcdulltii/obfDetect/compare/v1.6...v1.7
Source code(tar.gz)
Source code(zip)
obfDetect.zip(81.67 KB)
v1.6(Feb 19, 2022)
What's Changed

Refactor plugin handler

Removed duplicate banner print

Changed PLUGIN_FIX to PLUGIN_HIDE, user can just use Ctrl-Shift-H

Code cleanup in https://github.com/mcdulltii/obfDetect/pull/5

Full Changelog: https://github.com/mcdulltii/obfDetect/compare/v1.5...v1.6
Source code(tar.gz)
Source code(zip)
v1.5(Sep 6, 2021)
GUI Implementation

GUI Features:

QTable Heuristic result view

Node limiting

Single/All function heuristic search

Heuristic result export

Heuristic Features:

Control-Flow Flattening

Cyclomatic Complexity

Basic Block Size

Instruction Overlapping

Source code(tar.gz)
Source code(zip)
obfDetect.zip(81.64 KB)
v1.4(Aug 29, 2021)
Heuristic Features:

Control-Flow Flattening

Cyclomatic Complexity

Basic Block Size

Instruction Overlapping

Source code(tar.gz)
Source code(zip)
obfDetect.zip(78.77 KB)

Automatically detect obfuscated code and other state machines

Related tags

Overview

Obfuscation Detection

Description:

Note:

Usage

Examples

Todo

You might also like...

A way to integrate Latex, VSCode, and Inkscape in macOS. Adopted the whole workflow from Gilles Castel.

A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.

A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.

High performance, easy-to-use, and scalable machine learning (ML) package, including linear model (LR), factorization machines (FM), and field-aware factorization machines (FFM) for Python and CLI interface.

High performance, easy-to-use, and scalable machine learning (ML) package, including linear model (LR), factorization machines (FM), and field-aware factorization machines (FFM) for Python and CLI interface.

High performance, easy-to-use, and scalable machine learning (ML) package, including linear model (LR), factorization machines (FM), and field-aware factorization machines (FFM) for Python and CLI interface.

Collection of scripts to pinpoint obfuscated code

Galvanalyser is a system for automatically storing data generated by battery cycling machines in a database

Generate obfuscated meterpreter shells

MODeflattener deobfuscates control flow flattened functions obfuscated by OLLVM using Miasm.

OLOP: One-Line & Obfuscated Python

We evaluate our method on different datasets (including ShapeNet, CUB-200-2011, and Pascal3D+) and achieve state-of-the-art results, outperforming all the other supervised and unsupervised methods and 3D representations, all in terms of performance, accuracy, and training time.

A discord bot that can detect Nitro Scam Links and delete them to protect other users

A tool combining EasyOCR and LaMa to automatically detect text and replace it with an inpainted background.

Periodically check the manuscript state in the scholar one system and send email when finding a new state.

A simple voice detection system which can be applied practically for designing a device with capability to detect a baby’s cry and automatically turning on music

Automatically detect changes made to the official Telegram sites.

Customised to detect objects automatically by a given model file(onnx)

TensorFlowTTS: Real-Time State-of-the-art Speech Synthesis for Tensorflow 2 (supported including English, Korean, Chinese, German and Easy to adapt for other languages)

Comments

dict_keys error.

Releases(v1.7)

v1.7(Mar 20, 2022)

What's Changed

v1.6(Feb 19, 2022)

What's Changed

v1.5(Sep 6, 2021)

GUI Implementation

GUI Features:

Heuristic Features:

v1.4(Aug 29, 2021)

Heuristic Features:

Owner

Aaron

VSCode Development Container Template

Run context-aware commands from your source code comments

Integrate clang-format with Sublime Text

A GitHub Action hosted Python IDE!

Multi-user server for Jupyter notebooks

notebookJS: seamless JavaScript integration in Python Notebooks

CTO (Call Tree Overviewer) is an IDA plugin for creating a simple and efficiant function call tree graph

Spyder - The Scientific Python Development Environment

Gaphor is a UML and SysML modeling application written in Python.

Kite IntelliJ plugin

Joy is a tiny creative coding library in Python.

Clarity mode is a single-notebook interface built with existing JupyterLab components.

cottonformation is a Python tool providing best development experience and highest productivity

A Python code editor that looks like GNU Emacs.

Blender add-on for baking your scene to textures

This is code for IDLE python/ Magic8Ball Code

💻 Open recent VS Code folders and files using Ulauncher

pyiron - an integrated development environment (IDE) for computational materials science.

VSCode extension to sort and refactor python imports using reorder-python-imports.

ROS2 Docker tutorial with VSCode