Skip to content

Unify tagging, structured reports, JSON output, and detection naming - #12

Merged
mrphrazer merged 16 commits into
mainfrom
tagging
May 20, 2026
Merged

Unify tagging, structured reports, JSON output, and detection naming#12
mrphrazer merged 16 commits into
mainfrom
tagging

Conversation

@mrphrazer

@mrphrazer mrphrazer commented May 20, 2026

Copy link
Copy Markdown
Owner

This MR adds function tagging, structured report generation, JSON output for headless usage, and a consistent naming scheme for all heuristics and utilities. It also adds
focused pytest coverage for pure helper logic, loop analysis, tagging behavior, and script JSON output.

Main Changes

  • Added centralized tagging support in obfuscation_detection/tagging.py.
  • Added tag type and tag description constants for all heuristics and utilities.
  • All tag types intentionally use the Heuristic: prefix, including utility detections, for a uniform machine-readable surface.
  • Added legacy tag cleanup for renamed tags:
    • Heuristic: Control Flow Flattening
    • Heuristic: RC4-KSA
    • Heuristic: RC4-PRGA
  • Added structured report generation in obfuscation_detection/reports.py.
  • JSON report sections now include stable machine-readable id fields plus human-readable name fields.
  • JSON findings include tag_type and description where applicable.
  • Renamed the former control-flow-flattening-facing detection to State Machine in UI, tags, reports, README, and tests.
  • Renamed flattening_score output to state_machine_score.
  • Replaced scripts/detect_flattening.py with scripts/detect_state_machine.py.
  • Updated scripts/detect_obfuscation.py:
    • supports --json
    • emits all heuristics and utilities together under detections
    • text mode also runs heuristics and utilities together
  • Updated plugin menu behavior:
    • Obfuscation Detection\All runs all heuristics and all utilities
    • individual utilities remain under Obfuscation Detection\Utils...
  • Standardized public names across UI, print headers, README, JSON, and tags:
    • State Machine
    • Complex Function
    • Large Basic Block
    • Uncommon Instruction Sequence
    • Overlapping Instruction
    • Most Called Function
    • Loop Frequency
    • Irreducible Loop
    • XOR Decryption Loop
    • Complex Arithmetic Expression
    • Duplicate Subgraph
    • Entry Function
    • Leaf Function
    • Recursive Function
    • Section Entropy
    • RC4 KSA
    • RC4 PRGA
  • Added package modernization:
    • pyproject.toml
    • setup.cfg
    • minimal setup.py shim
  • Updated CI to install test extras, run ruff, run pytest, build package artifacts, and run twine check.
  • Updated README and examples for the new naming, tagging behavior, unified All behavior, and JSON headless output.
  • Fixed minor typos in helper comments/docs.

Testing

  • Added unit tests for graph/helper logic.
  • Added extensive loop-analysis tests with complex graph variants.
  • Added tagging tests with fake Binary Ninja objects:
    • tag type creation
    • tag cleanup
    • legacy tag cleanup
    • expected tag data per heuristic/utility
    • synchronous run_heuristics_and_utils() behavior
  • Added JSON script tests:
    • detect_obfuscation.py --json
    • detect_state_machine.py --json
    • stable detection IDs and names
  • Added Binary Ninja stubs in tests/conftest.py so pure tests run without Binary Ninja installed.

Verification

python3 -m pytest
python3 -m ruff check .
python3 -m ruff format --check .
python3 setup.py --name && python3 setup.py --version && python3 setup.py check --metadata --strict
python -m build --sdist --wheel
python -m twine check dist/*

@mrphrazer mrphrazer changed the title Tagging Unify tagging, structured reports, JSON output, and detection naming May 20, 2026
@mrphrazer
mrphrazer merged commit 6ee78b6 into main May 20, 2026
2 checks passed
@mrphrazer
mrphrazer deleted the tagging branch May 21, 2026 17:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants