yueduan / DeepBinDiff

Official repository for DeepBinDiff
BSD 3-Clause "New" or "Revised" License
227 stars 49 forks source link

How deepbindiff deal with function names? #17

Open yasong opened 2 years ago

yasong commented 2 years ago

There are two types of function names. One of them is a string, and the other is a memory address. I didn't find how deepbindiff handles them. Thank you.

push       eax
call       memset
push       eax
call       sub_8084480

Does the function 'normalization' handle that?

def normalization(opstr, offsetStrMapping):
    optoken = ''

    opstrNum = ""
    if opstr.startswith("0x") or opstr.startswith("0X"):
        opstrNum = str(int(opstr, 16))

    # normalize ptr
    if "ptr" in opstr:
        optoken = 'ptr'
        # nodeToIndex.write("ptr\n")
    # substitude offset with strings
    elif opstrNum in offsetStrMapping:
        optoken = offsetStrMapping[opstrNum]
        # nodeToIndex.write("str\n")
        # nodeToIndex.write(offsetStrMapping[opstr] + "\n")
    elif opstr.startswith("0x") or opstr.startswith("-0x") or opstr.replace('.','',1).replace('-','',1).isdigit():
        optoken = 'imme'
        # nodeToIndex.write("IMME\n")
    elif opstr in register_list_1_byte:
        optoken = 'reg1'
    elif opstr in register_list_2_byte:
        optoken = 'reg2'
    elif opstr in register_list_4_byte:
        optoken = 'reg4'
    elif opstr in register_list_8_byte:
        optoken = 'reg8'
    else:
        optoken = str(opstr)
        # nodeToIndex.write(opstr + "\n")
    return optoken
yueduan commented 2 years ago

Hi, DeepBinDiff performs basic block level diffing. We do not handle function names.

yasong commented 2 years ago

Thank you for your answer. If I understand correctly, the basic block diff also encounters function calls. What I meant was how it is handled when a function call is encountered. Thanks again.