BinSim: Trace-based Semantic Binary Diffing...
summary
BinSim prototype implements system call sliced segments equivalence checking by combining enhanced dynamic slicing with symbolic execution to compare only the instructions that affect system call arguments. It detects conditional equivalence and similarities that span basic block boundaries, uses heuristics to identify and approximate cryptographic functions, and reports precise differing instruction regions. An offline checker analyzes traces from the sandbox and the evaluation on over 1,000 malware samples including ransomware shows higher resilience and accuracy than prior tools.
AI-written summary · about
chapters (20)
- 0:00Start
- 1:08Security-relevant Software Analysis for Binary Code
- 1:52Binary Difference Analysis (Binary Diffing)
- 2:18Security Applications of Binary Diffing
- 3:39Challenge: Code Obfuscation
- 4:40Compare Runtime Execution Behavior
- 6:02Basic Block Semantics Modeling
- 9:18Block-Centric Limitation (1)
- 10:32Block-Centric Limitation (2)
- 13:08BinSim Overview
- 14:13BinSim Advantages
- 15:11BinSim Core Method
- 17:33BinSim Architecture
- 19:12System Call Alignment
- 20:39Dynamic Slicing Binary Code (1)
- 22:52Handling Cryptographic Functions
- 23:42Ground Truth Dataset
- 24:22Comparative Evaluation Results
- 25:02Analyzing Wild Malware Variants
- 25:59BinSim Limitations
related talks
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
41mfn_fuzzy: Fast Multiple Binary Diffing Triage With IDA
15mBin2Wrong: a Unified Fuzzing Framework for Uncovering Semantic Errors in Binary...
30mEnhancing CTI Processes with Code Search Technology
51mReverse Engineering Binaries
16mTooling Design and Lessons Learned from Systematic Evaluations of the Preservation of(…)
25mEnhancing Malware Code Similarity Detection through Vectorsearch and TLSH
50mVerify your software for security bugs