Research on Comparison Technology of Executable Objects Based on Block Signature and n-Step Jump Relations

摘要

Plagiarism detection of executable objects is normally used for vulnerability mining and software version detection. The normally used software plagiarism technology is graph-based comparison algorithm, which compares the function control flow graphs to find functions with the same graph. One better developed graph-based comparison algorithm combines block signature and one-step basic block jump relations. The paper further improves this algorithm and puts forward a new one which combines basic block signature and n-step basic block jump relations to get the more accurate similarity of executable objects. Results show that the similarity decreases as step order increases, but maintains stable at a certain order. This demonstrates the n-step jump comparison is more accurate and better reflect the function control flow graph.