二进制代码内联库函数识别

摘要

内联库函数识别是二进制代码分析的难点问题之一。主要的挑战来自在编译优化的作用下，内联库函数在目标函数中存在多态性和不连续性。本文构建函数的执行流图，将内联库函数识别问题转化为执行流图子图同构测试问题。实验中，对四个常被编译器内联的字符串操作函数，使用MSVC10和ICC14这两个编译器在5个开源软件中进行内联库函数识别测试。实验结果表明，本文方法可以有效识别二进制代码中的内联库函数。%Inline library functions identification is one of the difficult issues in binary code analysis.The main challenge comes from the polymorphism and discontinuity of inlined functions due to compiler optimizations.The paper builds execu-tion flow graphs of functions, converting inline library functions identification to subgraph isomorphism testings.In the eval-uation, four string operation functions, which are often inlined by a compiler, are evaluated by using MSVC10 and ICC14 with five open source programs.Experimental results show that the proposed approach is effective in inline library functions identification.