Binary code similarity detection is to detect the similarity of code at binary (assembly) level without source code. Existing works have their limitations when dealing with mutated binary code generated by different compiling options. In this paper, we propose a novel approach to addressing this problem. By inspecting the binary code, we found that generally, within a function, some instructions aim to calculate (prepare) values for other instructions. The latter instructions are defined by us as key instructions. Currently, we define four categories of key instructions: calling subfunctions, comparing instruction, returning instruction, and memory-store instruction. Thus if we symbolically execute similar binary codes, symbolic values at these key instructions are expected to be similar. As such, we implement a prototype tool, which has three steps. First, it symbolically executes binary code; Second, it extracts symbolic values at defined key instructions into a graph; Last, it compares the symbolic graph similarity. In our implementation, we also address some problems, including path explosion and loop handling.

翻译：二进制代码相似性检测是在没有源代码的情况下，检测二进制（汇编）级别代码相似性的技术。现有方法在应对由不同编译选项生成的变异二进制代码时存在局限性。本文提出了一种解决该问题的新方法。通过分析二进制代码，我们发现通常在一个函数内部，某些指令旨在为其他指令计算（准备）数值。我们将后者定义为关键指令。目前，我们定义了四类关键指令：子函数调用指令、比较指令、返回指令和内存存储指令。因此，若对相似二进制代码进行符号执行，这些关键指令处的符号值预计会具有相似性。基于此，我们实现了一个原型工具，该工具包含三个步骤：首先，对二进制代码进行符号执行；其次，将定义的关键指令处的符号值提取为图；最后，比较符号图的相似性。在实现过程中，我们还解决了路径爆炸和循环处理等问题。