Authored by: Tim Blazytko
Adapted by: mcdulltii
Automatically detect obfuscated code and other state machines
Scripts to automatically detect obfuscated code and state machines in binaries.
Implementation is based on IDA 7.4+ (Python3). Check out the following blog posts for more information on the Binary Ninja implementation:
- Automated Detection of Control-flow Flattening
- Automated Detection of Obfuscated Code
- Referenced Repository
Due to the recursive nature of plotting a dominator tree of every found function within the binary, the implementation and runtime overhead is expensive. As such, the flattening heuristic is omitted when the binary loaded has more than 50 functions. Functions will be skipped if the ctree structure is too large to prevent crashes.
MAX_FUNCTIONS = 50
# --- snipped ---
if sum([1 for i in idautils.Functions()]) > MAX_FUNCTIONS:
detect.partial_heur()
else:
detect.all_heur()For more details on partial_heur() and all_heur():
all_heur() calls all heuristic functions on the binary, then prints an output of the heuristics of all functions within the binary.
partial_heur() calls cyclomatic complexity, basic block size and instruction overlapping heuristic functions on the binary, then prints an output of the heuristics of the top 10% functions within the binary.
Since the script uses the IDA API, any functions that are missed by IDA will likely not be detected.
Copy the obfDetect directory and obfDetect.py into the IDA Plugins directory.
When IDA has successfully finished loading a binary, the script will print out its banner into the IDC/Python console. If not, the script can be re-loaded using alt-E and selecting it within the plugin dropdown.
The script can be run via the File toolbar as shown below. Alternatively, Ctrl-Shift-H.
- A small binary with 2 scanned functions
- Resilience test using a large binary obfuscated using O-LLVM
- Optimize flow flattening algorithm (Any help is welcomed)