Enhancing Control Flow Graph Based Binary Function Identification
Clemens Jonischkeit, Julian Kirsch · 2017
Recognition of binary functions in compiled code is a major stepping stone towards any advanced binary analysis technique. Nucleus [1] is a novel algorithm based on the idea of using the Interprocedural Control Flow Graph (ICFG) to detect function boundaries. Building upon this technology we propose a new approach to address the related problem of identifying previously-seen known functions within a binary. Our idea is based on comparing the Control Flow Graphs (CFGs) of unknown functions from a binary to known functions from a previously generated database. Compared to traditional approaches, our method is aware of the underlying graph matching problem being performed on CFGs of binary code: First, it utilizes instruction level knowledge about basic blocks as additional constraints for graph isomorphism. Second, optimizations and transformations introduced by different compilers affecting the shape of the CFG are taken into account.