mandiant / mandiant/flare-floss
Import Detection Heuristics from `mrphrazer/obfuscation_detection` Repository
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.2k
- Forks
- 542
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 26
Description
This issue note aims to suggest the integration of detection heuristics from the mrphrazer/obfuscation_detection by @mrphrazer into the FLOSS tool, to enhance its capabilities in detecting and decoding obfuscated strings in malware samples. The mrphrazer/obfuscation_detection repository contains a comprehensive set of detection heuristics for various obfuscation techniques mentioned here.
Integrating these heuristics into FLOSS would allow the tool to recognize a wide range of obfuscation methods and ultimately improve its decoding performance.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the detection heuristics listed in the linked mrphrazer/obfuscation_detection repository and comparing them with FLOSS's current capabilities. Determine which heuristics can be integrated and how their detection and decoding behavior should fit into FLOSS. Done means the selected heuristics are integrated and improve obfuscated-string detection without regressing existing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100