Seer

seer is a tool that recognizes the architecture of a binary file and visualizes a windrose chart for a visual comparison. See the images directory for diagram samples.

How does it work?

Each processor architecture has a unique byte histogram fingerprint, which others have described previously. This is because in machine code some types of opcodes are used more frequently than others (Register/memory move, comparison, jump/branch/call are usually the most common.) This gives each architecture a unique balance of bytes reflecting the designer’s choice of representation of common and uncommon opcodes. [1]

Requirements

• Python3
• Plotly
• SciPy

Usage

$ pip3 install -r requirements.txt

$ python3 seer.py -h
usage: seer.py [-h] [-w] filename

positional arguments:
  filename        binary to analyze

optional arguments:
  -h, --help      show this help message and exit
  -w, --windrose  show windrose chart

Example

$ python3 seer.py ~/vx5 
MIPS32          99
MIPS64          77
SH4             70
ARM64           60
M68K            59
PPC32           57
I686            53
ARM32           52
PPC64           50
X86_64          46

Notes

[1] Based on Windrose Fingerprinting of Code Architecture [PDF] (PoC||GTFO 0x21)