Obfuscation Analysis

Obfuscation Analysis (v1.2)

Authors: **Tim Blazytko & Nicolò Altamura**

_Analyze and simplify obfuscated code_

Description:

_Obfuscation Analysis_ is a Binary Ninja plugin that takes the pain out of working with heavily protected binaries. It bundles a handful of focused helpers that let you

• simplify Mixed-Boolean Arithmetic (MBA) expressions in one click (based on msynth)
• locate and scrub functions with broken disassembly

Some example use cases can be found in [examples](./examples). Furthermore, the REcon talk "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" demonstrates some use cases. The slides can be found [here](./presentation/recon25_mba_obfuscation.pdf). The plugin complements [Obfuscation Detection](https://github.com/mrphrazer/obfuscation_detection/): once suspicious functions are flagged, _Obfuscation Analysis_ helps you clean and understand them. More helpers will be added over time.

Core Features

• simplify Mixed-Boolean Arithmetic obfuscation in Binary Ninja's decompiler view
• identify and remove functions with broken disassembly
• inline functions in the decompiler view
• efficient and architecture-agnostic implementation
• runs as a background task
• careful error handling: concise user messages, full trace in the Debug log

Installation

The tool can be installed using Binary Ninja's plugin manager.

For a manual installation, follow these steps in Binary Ninja's plugin folder:

git clone https://github.com/mrphrazer/obfuscation_analysis.git
cd obfuscation_analysis

# optionally: use a virtual environment
python -m venv obfana-env
source obfana-env/bin/activate

# install requirements
pip install -r requirements.txt

If you use a virtual environment, you'll need to manually set the `site-packages` path in the Binary Ninja settings.

Usage

The plugin is available from **Binary Ninja’s** top-bar menu under `Plugins -> Obfuscation Analysis`.