Finding Binary Clones with Opstrings & Function Digests: Part I
By Andrew Schulman, July 01, 2005
Reverse engineering is an invaluable engineering tool.
July, 2005: Finding Binary Clones with Opstrings & Function Digests: Part I
199 . FDC0933BEF8FEF46BBC801CEF9044EC7 hello.exe - ___sbh_heap_check
164 . FDE6365C1BD96441A9D11FEF5DE3C179 hello.exe - ___sbh_resize_block
140 . A60BAC1A238AB85A3BE509678459B543 hello.exe - _strncpy
129 . B0C0A7FB8E2DF2F7395C12B104823590 hello.exe - __read
113 . 5AC42E0A19DEA1A23BCA486032420B87 hello.exe - __ioinit
111 . 45287CFEDD4D9AAE9C8DE16AE174CF22 hello.exe - __setmbcp
98 . 156CEDE43BBF5A9FB890C2FD86906AEC hello.exe - __write
89 . 31C50F435876A5BF29E58B7E05EE530A hello.exe - ___crtGetEnvironmentStringsA
72 . 22ADC7AEE6DCB10FDFA978A5C4DD7387 hello.exe - _strcat
66 . 53AB78B2C866220949F86393731E0048 hello.exe - __XcptFilter
45 . DA586DD1E4B4F00BAAEC323B76E38299 hello.exe - __close
44 . FFE7B3C3E94F188C3BD3CB0785C81740 hello.exe - __setenvp
42 . 826B40AD485B9C7EB8961AC07A0CCD68 hello.exe - ___crtGetStringTypeA
<b>41 . 8D71CE1651AD88B045B36FB9EBE0109F hello.exe - _strlen</b>
...
Figure 3: Some function signatures for Microsoft C RTL functions.
