Structural Comparison of Executable Objects
Loading...
Date
2004-07
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Gesellschaft für Informatik
Abstract
A method to heuristically construct an isomorphism between the sets of
functions in two similar but differing versions of the same executable file is presented.
Such an isomorphism has multiple practical applications, specifically the ability to
detect programmatic changes between the two executable versions. Moreover, information
(function names) which is available for one of the two versions can also be
made available for the other .
A framework implementing the described methods is presented, along with empirical
data about its performance when used to analyze patches to recent security
vulnerabilities. As a more practical example, a security update which fixes a critical
vulnerability in an H.323 parsing component is analyzed, the relevant vulnerability
extracted and the implications of the vulnerability and the fix discussed.
Description
Table of contents
Keywords
Vulnerability Assessment
Citation
Flake, Halvar: Structural Comparison of Executable Objects. In Flegel, U.; Meier, M. (Eds.): Proc. of the International GI Workshop on Detection of Intrusions and Malware & Vulnerability Assessment, number P-46 in Lecture Notes in Informatics, pp. 161-174 , Dortmund, Germany, July 2004, Köllen Verlag; ISBN 3-88579-365-X.