<story><title>Searching statically-linked vulnerable library functions in executable code</title><url>https://googleprojectzero.blogspot.com/2018/12/searching-statically-linked-vulnerable.html</url></story><parent_chain></parent_chain><comment><author>TACIXAT</author><text>It is totally awesome that function similarity is seeing the light of day. Google bought Zynamics way back when and their work has evolved a lot since then.&lt;p&gt;This sort of work has big implications in signature generation for malware samples, for clustering families of samples as well as finding common functions to generate detections on. You couldn&amp;#x27;t necessarily throw this into a detection engine, because we don&amp;#x27;t have a fast (dedicated) function recovery tool for binaries, but you can absolutely use it to generate byte based detection from a seed of a few samples.&lt;p&gt;Rather than having hash based signatures you could generate signatures that cover many samples (and likely new ones) in bulk. Normally a good signature like that requires manual effort from an analyst, this is a step toward machines doing it. As well, a central authoritative name database that could say &amp;quot;this is Petya&amp;quot; could force some sane naming convention on the industry (every AV wouldn&amp;#x27;t just be like &amp;quot;it&amp;#x27;s Zbot lol&amp;quot;).&lt;p&gt;This stuff can even aid manual reverse engineering. You could build a function naming database that uses this. Maybe a new engine for Talos FIRST. [1] Then if you opened up a file without debug symbols this could match it to known functions and really speed up reverse engineering efforts.&lt;p&gt;I look forward to reading it in more detail tomorrow. Thanks to Halvar for putting this out.&lt;p&gt;1. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.talosintelligence.com&amp;#x2F;first&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.talosintelligence.com&amp;#x2F;first&lt;/a&gt;</text></comment>
<story><title>Searching statically-linked vulnerable library functions in executable code</title><url>https://googleprojectzero.blogspot.com/2018/12/searching-statically-linked-vulnerable.html</url></story><parent_chain></parent_chain><comment><author>tomjakubowski</author><text>&amp;gt; An efficient implementation of a hash function (based on SimHashing) which calculates a 128-bit hash from disassembled functions - and which preserves similarity (e.g. “distance” of two functions can be calculated by simply calculating the hamming distance between two hashes - which translates to two XOR and two POPCNT instructions on x64).&lt;p&gt;Huh! This obviously desirable property of a good hash function for this application is one of the classic &lt;i&gt;undesirable&lt;/i&gt; properties of a good hash function for cryptography. I don&amp;#x27;t think that I was previously familiar with this sort of hash function, very cool.&lt;p&gt;Are space-filling curves related to these hash functions?</text></comment>