angr.analyses.deobfuscator.api_obf_type2_finder

class angr.analyses.deobfuscator.api_obf_type2_finder.APIObfuscationType2

Bases: object

API Obfuscation Type 2 result.

resolved_func_name: str

resolved_func_ptr: MemoryLocation

resolved_in: Function

resolved_by: Function

__init__(resolved_func_name, resolved_func_ptr, resolved_in, resolved_by)

Parameters:

• resolved_func_name (str)

• resolved_func_ptr (MemoryLocation)

• resolved_in (Function)

• resolved_by (Function)

Return type:

None

class angr.analyses.deobfuscator.api_obf_type2_finder.APIObfuscationType2Finder

Bases: object

Finds global function pointers initialized by calls to dlsym/GetProcAddress and names them accordingly.

__init__(project, variable_kb=None)

Parameters:

• project (Project)

• variable_kb (KnowledgeBase | None)

results: list[APIObfuscationType2]

analyze()

Return type:

list[APIObfuscationType2]