Graph-based comparison of Executable Objects

摘要: A method to construct an optimal isomorphism between the sets of instructions, basic blocks and functions in two differing but similar executables is presented. This can be used for porting recovered information different disassemblies, recover changes made by security updates detect code theft. The most interesting applications realm are malware analysis where a family trojans or viruses reduced analyzing differences variants, recovering details fixed vulnerabilities when vendor patch refuses disclose details. framework implementing described methods presented, along with empirical data about it’s performance multiple variants same vulnerability from updates.