一句话:将二进制函数匹配建模为调用图上的网络对齐问题,并用最大积信念传播求解,QBinDiff 优于现有二进制差分工具。
二进制差分中的一个常见任务是建立两个二进制程序函数之间的匹配。本文将该问题重新表述为程序调用图上的图编辑问题,其中匹配质量同时考虑函数内容相似性与调用图结构相似性,并证明该表述等价于网络对齐问题。作者提出基于最大积信念传播的求解策略,并实现原型工具 QBinDiff。大量评估表明,该方法在函数匹配准确率上优于当前最先进的二进制差分工具。
In this paper, we address the problem of finding a correspondence, or matching, between the functions of two programs in binary form, which is one of the most common task in binary diffing. We introduce a new formulation of this problem as a particular instance of a graph edit problem over the call graphs of the programs. In this formulation, the quality of a mapping is evaluated simultaneously with respect to both function content and call graph similarities. We show that this formulation is equivalent to a network alignment problem. We propose a solving strategy for this problem based on max-product belief propagation. Finally, we implement a prototype of our method, called QBinDiff, and propose an extensive evaluation which shows that our approach outperforms state of the art diffing tools.