obfuscation_detection

Obfuscation Detection v2.4 Author: Tim Blazytko Automatically detect obfuscated code and other interesting code constructs Description: Obfuscation Detection is a Binary Ninja plugin to detect obfuscated code and interesting code constructs e.g., state machines in binaries. Given a binary, the...

APKiD

APKiD APKiD gives you information about how an APK was made. It identifies many compilers, packers, obfuscators, and other weird stuff. It's PEiD for Android. For more information on what this tool can be used for, check out: Android Compiler Fingerprinting Detecting Pirated and Malicious Android...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

aco-prompt-shield

aco-prompt-shield 🛡️ Stop prompt injection attacks before they reach your LLM — zero API costs, runs entirely locally, integrates in 2 minutes. Prompt injection is the 1 security risk for LLM applications. aco-prompt-shield catches known jailbreak patterns, understands semantic intent via ML, and...

obfDetect

混淆检测 作者：mcdulltii 自动检测混淆代码和其他状态机 描述： 用于自动检测二进制文件中混淆代码和状态机的脚本。 实现基于 IDA 7.4+ Python3。查看以下博客文章以获取更多关于 Binary Ninja 实现的信息： 控制流扁平化的自动检测 混淆代码的自动检测 参考仓库 注意： 启发式值基于上述博客文章生成，并在（以 所有功能 模式运行时）根据其启发式复杂度从上到下排序。 由于在二进制文件中绘制每个已找到函数的支配树的递归性质，实现和运行时开销较大，尽管已经实现了多线程。 使用 PyQt 可视化插件，用户可以进一步自定义二进制文件上的启发式函数分析。 依赖项...

obfuscation_detection

混淆检测 v2.4 作者：Tim Blazytko 自动检测混淆代码及其他有趣的代码结构 描述： Obfuscation Detection 是一个 Binary Ninja 插件，用于检测二进制文件中的混淆代码和有趣的代码结构（例如状态机）。给定一个二进制文件，该插件通过识别在逆向工程中可能值得仔细查看的代码位置来简化分析。 基于各种启发式规则，该插件定位包含复杂或罕见代码结构的函数。此类代码结构可能实现： 混淆代码 状态机和协议 C&C 服务器通信 字符串解密例程 加密算法 以下博客文章提供了有关底层启发式规则的更多信息并展示了它们的用例： 自动化检测控制流平坦化 自动化检测混淆代码...

Obfuscated Command Line Detection Using Machine Learning

This blog post presents a machine learning ML approach to solving an emerging security problem: detecting obfuscated Windows command line invocations on endpoints. We start out with an introduction to this relatively new threat capability, and then discuss how such problems have traditionally bee...

Revoke-Obfuscation - PowerShell Obfuscation Detection Framework

Revoke-Obfuscation is a PowerShell v3.0+ compatible PowerShell obfuscation detection framework. Authors Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes Research Blog Post: https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html White Paper:...