classify_native_protection
Analyze a native binary's sections, imports, and signatures to classify its protection class, such as packer, VM, encrypted, or plain.
Instructions
Classify a native binary's protection class (category-only).
Combines get_sections + get_imports_exports +
the vendored native_packer_signatures regex catalog
entropy heuristics to label a binary's likely protection class. Returns one of:
"plain-pe"— no protection observed."packer-stub-wrapped"— UPX / ASPack / MPRESS / Petite / kkrunchy style (single non-standard section name)."vm-bytecoded-pe"— single.vmp0/.vmp1style section set."encrypted-vm-bytecode-interpreter"— the proprietary-engine section family (.arch/.xcode/.xtext/.sbss/.link/.xtls/.xpdata)."il2cpp-runtime"— large.idata+ tiny.text+GameAssembly.dllsibling."anti-debug-wrapped"— bare anti-debug surface but no packer."unpacked-debug-pe"— debug build (PDB section + lots of stdio / conio / assert symbols).
Args: path: file to classify
Returns::
{
"path": "...",
"protection_class": "...",
"evidence": [{"category": "...", "indicator": "...",
"section": "..."}, ...]
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |