Multi-architecture binary similar code detection system and method

Abstract

A multi-architecture binary similar code detection system and method are provided. The system comprises a preprocessing module, a parameter identification module, a Switch indirect jump identification module, a meaning generation module and a comparison module; the preprocessing module receives binary codes to be processed and outputs a binary function to the parameter identification module, the Switch indirect jump identification module and the meaning generation module; the parameter identification module extracts an ordering table from the binary function and outputs the ordering table to the meaning generation module; the indirect jump identification module extracts Switch indirect jump statements from the binary function and outputs the statements to the meaning generation module; according to the parameter information generated by the parameter identification module, the meaning generation module performs simulating execution of the binary function and extracts and outputs the meaning feature sequence to the comparison module; the comparison module adopts sequence alignment mode to compare the received meaning feature sequence and outputs similarity values. By automatically locating similar codes, the analyzed code information is synchronously migrated to different platforms, reduces the additional manual analysis cost and increases the analysis efficiency.

Description

technical field [0001] The present invention relates to a technology in the computer field, in particular to a multi-architecture binary similarity code detection system and method. Background technique [0002] With the popularity and application of smart devices, more and more programs have been migrated from desktop platforms to embedded devices based on ARM, MIPS, etc. Although the binary program analysis technology of desktop platforms (such as x86) has been relatively mature, However, because different architectures have huge differences in instruction sets, code offsets, and calling conventions, it is difficult to migrate program information analyzed by these techniques from one architecture (such as x86) to another architecture (such as ARM). Contents of the invention [0003] Aiming at the defect that the existing technology cannot match program codes lacking API semantic information and cannot realize cross-architecture matching, the present invention proposes a ...

AI Technical Summary

Problems solved by technology

[0003] Aiming at the defect that the existing technology cannot match program codes lacking API semantic information and cannot realize cross-architecture matching, the present invention proposes a multi-architecture binary similar code detection system and method, and automatically locates similar codes, thereby analyzing completed Code information is migrated to different platforms synchronously, reducing additional manual analysis costs and improving analysis efficiency

Images