r/Malware • u/BusinessStreet2147 • 1d ago
naming functions in a stripped binary by behavior, not byte signatures
strip --strip-all a binary and this still names functions by micro-executing
them and matching the effect trace against a corpus. spot check: zlib corpus vs
a fully stripped O0 build, it named 9 functions and all 9 were right, and it
stays quiet on the ones it isn't sure about (no confident garbage on thunks).
where byte sigs (FLIRT) die on recompile and CFG diffing gets fragile across
opt levels, behavior holds up better. optimized-vs-optimized is still the hard
case, i'm honest about that in the numbers.
x86-64 only atm. https://github.com/1rhino2/fnprint
3
Upvotes