Technical Study of ARM Library Identification Based on Dynamic Signature

Library function identification plays a significant part in decompilation process. Based on studying recent achievements on static library functions, combining with the binary coding formats of ARM and Thumb assemble codes, a method for dynamically obtaining library functions' characteristic files on binary level is described, which deals with applications working on ARM processor. Firstly function modules are extracted from applications, then recognized functions in applications will be matched with dynamic signatures of library functions by hashing. This paper makes deep study on obtaining and matching function modules in ARM static library functions identification and presents with strategy on dynamic signature's generating and static matching, which solves the problem of massive library files and matching efficiency. The results prove effective through testing.