[boulos]

The presence of AES instructions would be easy just from static analysis. Also loops of shifts and xors that are accumulating, etc. You could easily map the structure of various encryption algorithms into a static analysis tool. (I feel like the dynamic analysis proposed below about watching outputs being random is clever, but much more difficult).

[dmichulke]

> Also loops of shifts and xors that are accumulating, etc.

I think the problem is then to avoid punishing binaries for, e.g., using a hashmap :)