| 摘要 |
<p>Methods and computing devices enable identifying particular software functions, modules or arithmetic blocks within a software binary image. Memory register and memory address references within the binary image are normalized. Functions within the binary image are identified. Each function within the binary image is compared against one or more reference function binary images to determine if there is a match. The function-to-reference function comparison may be accomplished by comparing bit patterns or by comparing hash values generated by applying a hash function to the selected function and the reference function. Component parts within functions in the binary image can be identified and compared to reference function component parts within a reference function or within a database of reference function component parts. Results of the comparisons may be used to determine a degree to which the software binary image matches reference functions and/or component parts.</p> |
