Collection of scripts to pinpoint obfuscated code
Author: Tim Blazytko
Automatically detect control-flow flattening and other state machines
Description:
Scripts and binaries to automatically detect control-flow flattening and other state machines in binaries.
Implementation is based on Binary Ninja. Check out the following blog post for more information:
Automated Detection of Control-flow Flattening
Usage
$ ./detect_flattening.py samples/finspy
Function 0x401602 has a flattening score of 0.9473684210526315.
Function 0x4017c0 has a flattening score of 0.9981378026070763.
Function 0x405150 has a flattening score of 0.9166666666666666.
Function 0x405270 has a flattening score of 0.9166666666666666.
Function 0x405370 has a flattening score of 0.9984544049459042.
Function 0x4097a0 has a flattening score of 0.9992378048780488.
Function 0x412c70 has a flattening score of 0.9629629629629629.
Function 0x412df0 has a flattening score of 0.9629629629629629.
Function 0x412f70 has