SCV: Structure and Constant Value based Binary Diffing

Binary diffing is a method to find differences in similar binary executables such as two different versions of security patches. Diffing methods using flow information detect control flow changes very fast, but they cannot track constant value changes. We present a binary diffing tool named SCV whic...

Full description

Saved in:
Bibliographic Details
Main Authors: Heewan Park, Seokwoo Choi, Sunae Seo, Taisook Han
Format: Conference Proceeding
Language:English
Subjects:
Assembly
Binary codes
Binary comparison
binary control-flow graph
binary diffing
Failure analysis
Information security
Information technology
Inspection
Lab-on-a-chip
Operating systems
Registers
Shape
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Binary diffing is a method to find differences in similar binary executables such as two different versions of security patches. Diffing methods using flow information detect control flow changes very fast, but they cannot track constant value changes. We present a binary diffing tool named SCV which utilizes both structure and value information. SCV summarizes structure and constant value information from disassembled code, and matches the summaries to find differences. By analyzing a Microsoft Windows security patch KB938827, we showed that SCV found necessary differences caused by constant value changes which the state-of- the-art binary diffing tool BinDiff 'failed to find.
DOI:10.1109/ISA.2008.29