Method for constructing function correspondence between firmware based on candidate function group - Ruiqing XIAO; Yuefei ZHU; Shengli LIU; Bin LU (网络与信息安全学报)
Due to the characteristics of firmware, traditional binary comparison methods are prone to mismatches during the propagation of the matching function.Aiming at the problem that the matching function propagation algorithm is not ideal, a method for constructing function correspondence based on candidate function groups was designed, and the concept of function matching in n layer local network is supplemented.Then, three candidate function group construction strategies and candidate function group matching methods are proposed, and the time overhead were analyzed.Finally, a prototype system was implemented based on the method and compared with Bindiff.Through random sampling and manual check, 86.04% of the matching results of the proposed method are consistent with Bindiff matching results, while 11.3% can correct Bindiff matching errors.