关键词: 补丁比对, 安全漏洞, 逆向工程, 结构化比对

Abstract:

Structural comparison is one of the core components of patch comparison. This paper improves the classic algorithm of structural comparison. Compared with the classic algorithm, the improved algorithm calculates the value of similarity between functions. Therefore, the problem of contradiction between the consistency and exclusiveness of signature is solved. Furthermore, a structural comparison tool named as NBD (NCNIPC binary differ), which gets a higher score compared with other popular tools during the exam towards some patches of microsoft, is constructed based on the improved algorithm.

Key words: patches comparison, security vulnerability, reverse engineering, structural comparison