fn_fuzzy: Fast Multiple Binary Diffing Triage With IDA

on YouTube ↗41m

" summary

Tool computes per-function ssdeep hash of code bytes (ignoring relocation/fixups) and a Machoc hash of call-flow, stores all hashes in one database file, then performs many-to-many comparisons to pick the most similar IDBs. Claims comparison overhead drops from minutes-or-hours with BinDiff/Diaphora/Kam1n0 to near real-time triage on the same VM, letting analysts import function names and prototypes from hundreds of prior IDBs into a target in bulk.

AI-written summary · about

" chapters (5)

1. 0:00Introduction to fn_fuzzy
2. 10:17Binary diffing with IDA
3. 20:33Demo of fn_fuzzy triage
4. 30:14Performance and results
5. 39:40Q&A and closing

" related talks

• 27mBinSim: Trace-based Semantic Binary Diffing...Dinghao Wu, Jiang Ming, Dongpeng Xu, Yufei Jiang · 26th USENIX Security Symposium (USENIX Security '17)
• 34mCan your diff(1) do this?! Improving software review and QA with diffoscopeChris Lamb · foss-north 2018
• 30mEnhancing CTI Processes with Code Search TechnologyCarlos Rubio, Jonas Wagner · FIRST Cyber Threat Intelligence Symposium 2022
• 25mEnhancing Malware Code Similarity Detection through Vectorsearch and TLSHRemco Sprooten · 2024 FIRST Cyber Threat Intelligence Conference
• 21mParDiff: Practical Static Differential Analysis of Network Protocol ParsersGuannan Wei, Qingkai Shi, Mingwei Zheng, Xuwei Liu, Xiangzhe Xu, Le Yu, Congyu Liu, Xiangyu Zhang · OOPSLA 2024
• 23mAn In-Depth Analysis of Disassembly on Full-Scale x86/x64 BinariesHerbert Bos, Xi Chen, Dennis Andriesse, Victor van der Veen, Asia Slowinska · USENIX Security '16
• 15mBin2Wrong: a Unified Fuzzing Framework for Uncovering Semantic Errors in Binary...Zao Yang, Stefan Nagy · USENIX ATC '25
• 11mIDFuzz: Intelligent Directed Grey-box FuzzingXingjian Zhang, Yiyang Chen, Chao Zhang, Long Wang, Wenyu Zhu, Changhua Luo, Nuoqi Gui, Zheyu Ma, Bingkai Su · USENIX Security '25