horsicq/Detect-It-Easy
Detect It Easy
Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats.
The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families.
The toolkit provides capabilities for low-level binary analysis, including machine opcode calculation for x86 and x64 architectures, debug symbol extraction, and system structure inspection. It also includes an unpacker emulation feature to execute unpacking routines and binary format editing to modify executable structures.
Automation is supported through a command-line interface for batch file processing and automated sample triage.
Features
- Binary Format Identifiers - Determines executable and archive formats using combined signature matching and heuristic analysis.
- Binary Signature Matchers - Identifies executable and archive formats by comparing binary data against a database of known magic bytes.
- Android Analysis - Includes specialized detectors for locating and identifying APK and DEX files across different operating systems.
- Low Level Tools - Examines machine opcodes and system structures to understand how compiled programs operate at the hardware level.
- Packer Detection Tools - Identifies specific packers, protections, and virus families within executable binaries for forensic analysis.
- Unpacking and Deobfuscation - Implements a simulation feature that executes unpacking routines to reveal the original code of packed files.
- Binary Analysis Tools - Offers a comprehensive set of utilities for opcode calculation, debug symbol extraction, and system structure inspection.
- Binary File Inspectors - Determines the format of executables and archives using signature matching and heuristics.
- Compilation Tool Identifiers - Determines the specific linker, compiler, or packer used to create a binary file.
- Instruction-Level Emulators - Simulates CPU behavior to execute unpacking routines and reveal the original code of packed executable binaries.
- Binary Signature Engines - Implements a scripting system for defining and applying custom detection rules to identify specific binary patterns.
- Custom Detection Rules - Implements a domain-specific language allowing users to define custom detection logic for binary pattern matching.
- File Type Inference - Combines structural analysis and metadata patterns to identify file types when explicit signatures are missing.
- Proprietary Format Analyzers - Allows the definition of specialized detection rules to identify proprietary or non-standard file structures.
- Android Analysis Tools - Provides specialized detectors for locating and identifying APK and DEX files across different operating systems.
- Batch Processing Pipelines - Provides automated workflows for sequentially processing and identifying large batches of binary files via a command line interface.
- File Processing Utilities - Ships a command-line interface for the automated analysis of multiple binary samples to identify file types.
- Debug Symbol Extractors - Retrieves metadata and symbolic information from program database files to resolve binary offsets.
- Debug Symbol Parsers - Extracts metadata and variable names from program database files to map binary offsets to human-readable labels.
- Machine Opcode Calculations - Provides capabilities to compute x86 and x64 operation codes for low-level binary analysis and instruction mapping.
- Opcode Generators - Translates x86 and x64 assembly instructions into raw machine bytes to facilitate the creation of binary signatures.
- Sample Triage Tools - Processes large batches of files to quickly categorize samples by type and origin for automated triage.
- Structure Inspections - Allows for the examination of internal system layouts to understand operating system data and memory organization.
- Detection and Classification - Identifies file types, compilers, and linkers.
- iOS and macOS Utilities - File type identification tool for Windows, Linux, and macOS.
- Reverse Engineering - Identifies file types and compiler information for binaries.
- Reverse Engineering Tools - Identifies file types and compiler information for various platforms.
- Essential Security Tools - Utility to identify compilers, linkers, and packers in binaries.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
