What is obfuscation_detection_ghidra?

This project is a plugin for Ghidra, a free tool made by the NSA for reverse engineering software, meaning taking apart a program to understand how it works without having its original source code. The plugin helps security researchers spot code that looks obfuscated or intentionally hidden, which is common in malware, software packers, and copy protection schemes. It is a Java port of an existing plugin originally built for a different reverse engineering tool called Binary Ninja. Instead of reading through an entire unfamiliar program by hand, the plugin scans it and flags specific patterns worth a closer look, things like code that behaves like a state machine, unusually complicated functions, loops that decrypt data using XOR operations, sections of the file with high randomness that often signal encrypted or compressed data, and code patterns typical of the RC4 encryption algorithm. It marks these findings directly inside Ghidra as tags and bookmarks so a researcher can jump straight to the interesting parts of a large binary. The README notes plainly that this repository was built almost entirely with AI assistance, and it deliberately left out a few features from the original Binary Ninja version because they did not translate cleanly to Ghidra. To use it, you build the extension using Gradle pointed at your own Ghidra installation, then install the resulting zip file through Ghidra's extension manager. Once enabled, its options appear in Ghidra's Tools menu, and results can also be produced from the command line in JSON format for scripting or automation, without needing to open the Ghidra graphical interface at all.