Features

CPU architectures

Malcat is not IDA: it does not try to handle all CPU architectures, but only to support the ones that are used by most malware. For performance reason, the disassemblers are currently written in CPP and users cannot add new architectures, but python-based disassembler support may be added in the future. You can find below the current list of supported architectures:

Disassembler:

can machine code be analyzed

Decompiler:

can source code be recovered

Strings identification:

if and how does Malcat identify the strings of the program. scan means that a standard linear sweep string search algorithm is used, the one you can find in most tools.

Function discovery:

if program methods/functions are identified.

File formats

Malcat supports a large amount of file formats, using its python-based file parsers. When a format is supported, it means that you will be able to see its internal structures and also identify it when embeded inside larger files (aka file carving). And for archives/file systems, in-app unpacking is also often supported.

Note that anyone can easily add support for a new file format by adding new scripts to Malcat's data directories.

Programs

Here you can find the current list of supported executable formats:

Structures parsing:

if the file format parser identifies (most of) the binary structures of the file format

Debug informations:

if debug informations are parsed

Resources:

if the program embeds resource, can Malcat identify and extract them?

Archives / File Systems / Databases

While Malcat has no pretension of being a full-fledged archive opener, it supports most archive types used by malware. Some file format parsers are more advanced than others and even allow the user to open archive member directly inside Malcat. Here is a list of supported file formats:

Structures parsing:

if the file format parser identifies (most of) the binary structures of the file format

In-application unpacking:

if the file format parser can directly extract and open archive members. Inside Malcat, one can then open a file by double-clicking them inside the Virtual File System tab.

Summary:

if Malcat displays a summary report in the Summary view

Multimedia / Documents

Document/pictures identification is very useful for malware analysis. A lot of obfuscators love to disguise their payloads as multimedia files. Or hide it inside a multimedia file, in some unused space.

Structures parsing:

if the file format parser identifies (most of) the binary structures of the file format

Metadata:

if most metadata (author, comments, time, etc.) are extracted

Roadmap

Development of Malcat just started and you can expect its features list to grow. So beside the regular bug fixes, QOL improvements and signatures updates, here is a list of the big improvements that are planned so far. Note that this list may change in the future, depending on the user feedback and the state of sales.

Short term

FLIRT signatures:

Scan for FLIRT signatures and label matching functions accordingly (done)

RTTI analysis:

Extract type information for MSVC (done) and GCC

Mid term

SVG export:

Export content views into an SVG file for online publication

PDB files:

Support loading external PDB debug information into Malcat.

.NET and .PYC decompilers:

That would be a lot of work, but having a native decompiler for those language would definitely be nice (even if it's unlikely to be on par with the .NET-based ones)

Function parameters analysis:

Identify function parameters at call sites. For known APIs, label them using a knowledge base.

ARM support:

If a nice disasm library which does not weight 5MB (hi capstone) can be found.

Long term

Collaborative function signatures:

Malcat could benefit from a function signature format that allows fuzzy matching and collaboration between users based on an online database. This obviously requires a lot of work and careful thinking to handle conflicts between users.

Type analysis:

That would be nice. The question is how much would it slow down the analysis.

Keystone integration:

Allows users to assemble code using the keystone assembler