Dr. Dobb's is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Channels ▼
RSS

Tools

Finding Binary Clones with Opstrings & Function Digests: Part III

Source Code Accompanies This Article. Download It Now.


September, 2005: Finding Binary Clones With Opstrings & Function Digests: Part III

(a)

test,jz,call,and,loc,test,jz,call,and,loc,test,jz,call,and,loc,ret


(b)
...
16 . BE52429A4DB568969503A30A27D4CB24 rtcshare.exe- [email protected]@[email protected]
16 . BE52429A4DB568969503A30A27D4CB24 rend.dll - [email protected]@[email protected]
16 . BE52429A4DB568969503A30A27D4CB24 [email protected]@@AAEXXZ
16 . BE52429A4DB568969503A30A27D4CB24 qedit.dll - [email protected]@@QAEXXZ
 ...


(c)
7D9D7AFB             	[email protected]@@AAEXXZ: ;;; query.dll
7D9D7AFB 8BFF         		mov 	edi,edi
7D9D7AFD 56              		push  	esi
7D9D7AFE 8BF1              		mov  	esi,ecx
7D9D7B00 8B06           		mov  	eax,[esi]
7D9D7B02 85C0            		test 	eax,eax
7D9D7B04 7409            		jz  	loc_7D9D7B0F
7D9D7B06 50              		push 	eax
7D9D7B07 E81EC40B00       		call 	[email protected]
7D9D7B0C 832600          		and  	dword ptr [esi],0
7D9D7B0F             	loc_7D9D7B0F:
7D9D7B0F 8B4604          		mov  	eax,[esi+4]
7D9D7B12 85C0            		test 	eax,eax
7D9D7B14 740A             		jz  	loc_7D9D7B20
7D9D7B16 8B08            		mov  	ecx,[eax]
7D9D7B18 50             		push 	eax
7D9D7B19 FF5108         		call  	dword ptr [ecx+8]
7D9D7B1C 83660400       		and   	dword ptr [esi+4],0
7D9D7B20               	loc_7D9D7B20:
7D9D7B20 8B4608       		mov  	eax,[esi+8]
7D9D7B23 85C0          		test  	eax,eax
7D9D7B25 740A           		jz   	loc_7D9D7B31
7D9D7B27 50               		push 	eax
7D9D7B28 E8FDC30B00        		call 	[email protected]
7D9D7B2D 83660800        		and  	dword ptr [esi+8],0
7D9D7B31             	loc_7D9D7B31:
7D9D7B31 5E            		pop  	esi
7D9D7B32 C3              		ret


(d)
5DA13F91            	[email protected]@[email protected]: ;;; rend.dll
5DA13F91 56              		push  	esi
5DA13F92 8BF1            		mov  	esi,ecx
5DA13F94 8B4604         		mov  	eax,[esi+4]
5DA13F97 85C0            		test 	eax,eax
5DA13F99 C706AC17A15D    		mov  	dword ptr [esi],offset 
   [email protected]@[email protected]@@
5DA13F9F 740B             		jz   	loc_5DA13FAC
5DA13FA1 50              		push 	eax
5DA13FA2 E819EF0000       		call	[email protected]@Z
5DA13FA7 83660400       		and	dword ptr [esi+4],0
5DA13FAB 59              		pop 	ecx
5DA13FAC             	loc_5DA13FAC:
5DA13FAC 8B460C         		mov 	eax,[esi+0Ch]
5DA13FAF 85C0            		test	eax,eax
5DA13FB1 740A             		jz  	loc_5DA13FBD
5DA13FB3 8B08             		mov 	ecx,[eax]
5DA13FB5 50              		push 	eax
5DA13FB6 FF5108          		call  	dword ptr [ecx+8]
5DA13FB9 83660C00        		and  	dword ptr [esi+0Ch],0
5DA13FBD               	loc_5DA13FBD:
5DA13FBD 8B4610           		mov 	eax,[esi+10h]
5DA13FC0 85C0             		test 	eax,eax
5DA13FC2 740B             		jz   	loc_5DA13FCF
5DA13FC4 50                		push 	eax
5DA13FC5 E8F6EE0000      		call  	[email protected]@Z
5DA13FCA 83661000         		and  	dword ptr [esi+10h],0
5DA13FCE 59              		pop 	ecx
5DA13FCF               	loc_5DA13FCF:
5DA13FCF 5E              		pop  	esi
5DA13FD0 C3              		ret

Figure 3: A false positive: (a) a function digest; (b) a few of the 30 functions in XP with this digest; and (c) and (d) two disassemblies showing that the code doesn't really match.


Related Reading


More Insights






Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

Dr. Dobb's encourages readers to engage in spirited, healthy debate, including taking us to task. However, Dr. Dobb's moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing or spam. Dr. Dobb's further reserves the right to disable the profile of any commenter participating in said activities.

 
Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.