Finding Binary Clones with Opstrings & Function Digests: Part I
By Andrew Schulman, July 01, 2005
Reverse engineering is an invaluable engineering tool.
July, 2005: Finding Binary Clones with Opstrings & Function Digests: Part I
744 . ECD500E1A7A5B8EF213539EB00EA7DB7 cmpbk32.dll - jmp_GetOSVersion
744 . D2ED9FAAF554B24E15CA26F0AF33B6F4 riched20.dll - off_74E50E08
744 . C56930F2796C78605C6399317B2E83AC dmintf.dll - off_6CA231EA
744 . 63215108C3F4923AD61AFE8766A3C265 opengl32.dll - off_5ED6ECBA
744 . 1048805DE9ABC21DC0D3FB4733C00C01 user32.dll - off_77D7E38A
744 . 4050EB94076376FEF53CEFF95777A784 cewmdm.dll - fn_6F64F43D
744 . 4050EB94076376FEF53CEFF95777A784 dlimport.exe - <b>_SHATransformNS@8</b>
744 . 4050EB94076376FEF53CEFF95777A784 drmclien.dll - fn_41B1F4CD
744 . 4050EB94076376FEF53CEFF95777A784 drmv2clt.dll - fn_5186C71D
744 . 4050EB94076376FEF53CEFF95777A784 dxmasf.dll - <b>_SHATransformNS@8</b>
744 . 4050EB94076376FEF53CEFF95777A784 encdec.dll - fn_55DF218D
744 . 4050EB94076376FEF53CEFF95777A784 licdll.dll - fn_55AA6A36
744 . 4050EB94076376FEF53CEFF95777A784 moviemk.exe - fn_6008A35D
744 . 4050EB94076376FEF53CEFF95777A784 mspmsp.dll - fn_6008087D
... [more like this, including mssap.dll, msscp.dll, mstlsapi.dll,
msvidctl.dll, mswmdm.dll, qasf.dll, rdpwd.sys, shmedia.dll...]
744 . 4050EB94076376FEF53CEFF95777A784 wmv8dmod.dll - fn_58FB23FD
744 . 4050EB94076376FEF53CEFF95777A784 wmvcore.dll - fn_4F57FD4D
744 . 4050EB94076376FEF53CEFF95777A784 wmvcore2.dll - <b>_SHATransformNS@8</b>
744 . 4050EB94076376FEF53CEFF95777A784 wmvdmod.dll - fn_58F4C6BD
744 . 4050EB94076376FEF53CEFF95777A784 wmvdmoe.dll - fn_58E8813D
743 . E84B4BF7E900767D5E2E33DFDF1B7C5B d3dim700.dll - fn_7396CE20
743 . 90786D0DD5B4C01419F0D8938D1CF3D1 wmvcore2.dll - fn_56038355
743 . 94E0CD7A8AD1A53BCFE9CB60A0214F0F srrstr.dll - fn_5C02CE8B
Figure 1: Excerpt from function database: _SHATransformNS@8 and duplicates throughout XP.
