Awesome

FingerMatch

IDA plugin for collecting functions, data, types and comments from analysed binaries and fuzzy matching them in another binaries.

author: Jan Prochazka<br> licence: none, public domain<br> home: https://github.com/jendabenda/fingermatch<br>

Usage

• fingerprint libraries and then match them in binaries you want to anlayze, you can focus only on unseen and interesting parts
• resume analysis when new version of previously analyzed binary is out, no need to reverse engineer everything from scratch
• anything what fits

Features

• fuzzy function matching
• data, types, comments matching
• can correctly match small functions
• easy to use

Installation

• works with IDA 7.4+, Python 3
• copy fingermatch.py into IDA plugins folder

UI

• menu View -> Collect fingerprints - collects fingerprints and save them into fingerprint database
• menu View -> Match fingerprints - loads fingerprints from filename and match them against analysed binary

Python API

• available from IDA console
• fingermatch_collect(fingerdb_path) - collects fingerprints and save them into fingerprint database
• fingermatch_match(fingerdb_path) - loads fingerprints from fingerprint database and match them against analysed binary

Libraries workflow

• compile library with debugging symbols (\Z7 or \Zi switch with msvc)
• autoanalyze binary with IDA and pdb symbols
• collect fingerprints with FingerMatch
• match fingerprints wherever you want
• you can download example databases (zlib, libpng, libtiff, openssl, cryptopp) from here

Resumption workflow

• open binary, analyze it
• collect fingerprints with FingerMatch
• when new binary version is out, open new version
• match saved fingerprints

Fingerprints

Function fingerprints are based on control flow traces allowing to match the same function with shuffled basic block starts, different register allocation or instruction scheduling. Fingerprints of data, types and comments are also matched. In addition matching considers whole reference graph, so it has high chance to pinpoint correct names. Matching is tuned to have low false positive matches.

Detailed documentation is at the begining of the fingermatch.py file.