关键词: 二进制代码比?, 函数控制流图, 恶意软件分析

Abstract: Executable objects comparison technology compares two different but similar executable objects to show their difference and similarity.It can be used for analysing malware variants ,porting recovered information between different disassemblies,locating changes in security updates. A method based on character comparison is presented in this article.Executable object is described by two kinds of graph:call graph of an executable and control flow graphs of functions. Characters of functions and basic blocks are defined and acquired from the graphs.Fixedpoint of nodes are located and propagated in the graphs.Results are mappings between the functions and basic blocks in the two executable objects.A frame work implementing the described methos is presented alone with two actual apllications in analysing malware variants and security updates analysing.

Key words: Executable Comparison, Control Flow Graph, Malware analysis