一句话：提出基于关键指令符号值图的二进制代码相似性检测方法，可应对不同编译选项导致的代码变异。
二进制代码相似性检测旨在无源码条件下判断二进制（汇编）级代码的相似性，但现有方法在面对使用不同编译选项变异后的二进制代码时仍有局限。本文观察到，函数内部某些指令旨在为其他指令计算（准备）取值，作者将后者定义为关键指令，并归纳为四类：调用子函数、比较指令、返回指令以及内存地址写入指令。其核心思想是：若对相似二进制代码进行符号执行，则在这些关键指令处的符号值应当相似。作者据此实现原型工具，流程包括：符号执行二进制代码、将关键指令处的符号值抽取为图、比较符号图相似度；实现中还处理了路径爆炸与循环处理等问题。
Binary code similarity detection is to detect the similarity of code at binary (assembly) level without source code. Existing work still has their limitation when dealing with mutated binary code with different compiling options. We proposed a novel approach to address this problem. By inspecting the binary code, we found that generally, within a function, some instructions aim to calculate (prepare) value for some other instructions. The latter instructions are defined by us the key instructions. Currently, we define four categories of key instructions: calling subfunctions, comparing instruction, returning instruction, and memory address writing instruction. Thus if we symbolically execute similar binary codes, the symbolic value at these key instructions should be similar. We implemented our idea into a tool. This prototype tool can: 1. symbolically execute binary code, 2. extract symbolic values at key instructions into a graph, and 3. compare the symbolic graph similarity. In our implementation, we also address some problems, including path explosion and loop handling.
DOI 原文 ·
@inproceedings{paperbot6492,
title = {Binary Code Similarity Detection},
author = {Zian Liu},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678518}
}