Binary Code Similarity Detection

Binary code similarity detection is to detect the similarity of code at binary (assembly) level without source code. Existing work still has their limitation when dealing with mutated binary code with different compiling options. We proposed a novel approach to address this problem. By inspecting the binary code, we found that generally, within a function, some instructions aim to calculate (prepare) value for some other instructions. The latter instructions are defined by us the key instructions. Currently, we define four categories of key instructions: calling subfunctions, comparing instruction, returning instruction, and memory address writing instruction. Thus if we symbolically execute similar binary codes, the symbolic value at these key instructions should be similar. We implemented our idea into a tool. This prototype tool can: 1. symbolically execute binary code, 2. extract symbolic values at key instructions into a graph, and 3. compare the symbolic graph similarity. In our implementation, we also address some problems, including path explosion and loop handling.