angr.analyses.unpacker

class angr.analyses.unpacker.ObfuscationDetector

Bases: Analysis

This analysis detects, usually in ways that are more robust than section name matching or signature matching, the existence of obfuscation techniques in a binary.

__init__(cfg=None)
Parameters:

cfg (CFGModel | None)

analyze()
class angr.analyses.unpacker.PackingDetector

Bases: Analysis

This analysis detects if a binary is likely packed or not. We may extend it to identify which packer is in use in the future.

PACKED_MIN_BYTES = 256
PACKED_ENTROPY_MIN_THRESHOLD = 0.88
__init__(cfg=None, region_size_threshold=32)
Parameters:
packed: bool
region_size_threshold: int
analyze()

Submodules

obfuscation_detector

packing_detector