Skip to content

Commit

Permalink
Added 7.4+ Support
Browse files Browse the repository at this point in the history
Added IDA Version check for deprecated function
  • Loading branch information
mcdulltii committed Mar 20, 2022
1 parent 0e80fa1 commit 8c2c237
Show file tree
Hide file tree
Showing 3 changed files with 14 additions and 7 deletions.
4 changes: 1 addition & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,7 @@ _Automatically detect obfuscated code and other state machines_

Scripts to automatically detect obfuscated code and state machines in binaries.

<strong>Implementation is based on IDA 7.7 (Python3). For IDA 7.4 - 7.6 (Python3), refer to [ObfDetect Version 1.6](../../tree/v1.6)</strong>

Check out the following blog posts for more information on the Binary Ninja implementation:
Implementation is based on IDA 7.4+ (Python3). Check out the following blog posts for more information on the Binary Ninja implementation:

* [Automated Detection of Control-flow Flattening](https://synthesis.to/2021/03/03/flattening_detection.html)
* [Automated Detection of Obfuscated Code](https://synthesis.to/2021/08/10/obfuscation_detection.html)
Expand Down
4 changes: 2 additions & 2 deletions obfDetect.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@
from obfDetect import gui

PLUGIN_VERSION = "1.7"
IDAVERISONS = "IDA PRO 7.7"
IDAVERSIONS = "IDA PRO 7.4+"
AUTHORS = "mcdulltii"
DATE = "2022"

def banner():
banner_options = (PLUGIN_VERSION, AUTHORS, DATE, IDAVERISONS)
banner_options = (PLUGIN_VERSION, AUTHORS, DATE, IDAVERSIONS)
banner_titles = "Obfuscation Detection v%s - (c) %s - %s - %s" % banner_options
# print plugin banner
print("\n---[" + banner_titles + "]---\n")
Expand Down
13 changes: 11 additions & 2 deletions obfDetect/mcsema_disass/util.py
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,18 @@

FUNC_LSDA_ENTRIES = collections.defaultdict()

IS_ARM = "ARM" in _INFO.procname
IDA_VERSION = idaapi.IDA_SDK_VERSION

# Check for IDA Version number
if int(IDA_VERSION) >= 770:
# procName is deprecated from IDA Version 7.7 onwards
IS_ARM = "ARM" in _INFO.procname
IS_SPARC = "sparc" in _INFO.procname
else:
# Revert to procName for IDA Version 7.4 to 7.6
IS_ARM = "ARM" in _INFO.procName
IS_SPARC = "sparc" in _INFO.procName

IS_SPARC = "sparc" in _INFO.procname

# True if we are running on an ELF file.
IS_ELF = (idaapi.f_ELF == _INFO.filetype) or \
Expand Down

0 comments on commit 8c2c237

Please sign in to comment.