Function prelude detection plugin

A common problem in binary analysis is function detection. One method is searching for function preludes. Preludes are a sequence of instructions commonly found at the beginning of a function. These preludes perform tasks like setting up the stack, or initializing registers to values as defined in the architecture’s ABI. It is very common to hard-code these prelude patterns and match instructions against them. These patterns get outdated, are tedious to update, and have to be written for each architecture. Also because these signatures are generic, they are highly prone to false positives especially on x86/x86_64 binaries. This project aims to augment static signature based approach with a dynamic, multi-stage statistical heuristic pipeline. Weighted Prefix Trie will be used for matching and then filtering through 2-signal validation approach (frequency distribution analysis + shannon entropy) for removing noise. Hence the plugin will automatically learn directly from functions identified by initial CFG (Control Flow Graph) analysis in the target binary. This approach also enables the discovery of orphaned or hidden functions that standard CFG analysis often misses in stripped or obfuscated binaries.