Compiler Independent Hash for Binary Component Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying open source licensed code in compiled binaries are inefficient, as they often rely on compiler-specific comparisons, which fail when compiled with different compilers or optimization flags, making them unusable for larger binaries or those with many components.
Innovation Solution
The development of a compiler-independent hash approach that analyzes procedures and sub-procedures in compiled binaries, generating hashes based on consistent features across compilers and optimization levels, allowing for efficient identification of open source licensed code by comparing these hashes to a library of known code samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If compiler-specific comparison methods are used to identify open source licensed code, then identification accuracy for specific compiler versions is improved, but the method fails when code is compiled with different compilers or optimization flags
Solution Approach 1:
The patent transforms the identification approach from using compiler-specific parameters (exact binary comparisons, signature hashes) to using compiler-invariant parameters (control flow graphs, data flow patterns, instruction sequences). This parameter transformation allows the same identification method to work across different compilers and optimization levels while maintaining identification accuracy.
Solution Approach 2:
The patent creates a universal identification method that works across multiple compilers (GCC, Clang, MSVC) and optimization levels. By using abstract representations like control flow graphs and data flow patterns that are invariant to compiler-specific implementations, the system achieves multi-functionality where a single identification approach serves all compiler types rather than requiring separate methods for each compiler.
2Measurement precision
If byte-by-byte comparison or signature comparison is performed on compiled binaries, then open source code identification is attempted, but the approach fails due to compiler optimization differences
Solution Approach 1:
The patent introduces an intermediary representation layer (control flow graphs, data flow patterns, instruction sequences) between the raw compiled binary and the identification process. This intermediary abstraction layer filters out compiler-specific variations while preserving the essential structural characteristics of the code, enabling reliable and consistent identification across different compilation scenarios.
Solution Approach 2:
The patent changes the comparison parameters from surface-level binary characteristics (byte sequences, signature hashes) to deep structural parameters (control flow topology, data flow patterns). These structural parameters remain consistent across compiler optimizations, thereby improving both identification accuracy and reliability.
3Measurement precision
If traditional code scanning tools are used to analyze compiled binaries, then open source licensed code identification is attempted, but the tools are inefficient for larger binaries with many components
Solution Approach 1:
The patent segments the binary analysis into independent procedure-level control flow graph extractions rather than attempting whole-binary analysis. Each procedure is analyzed independently and its characteristics are stored in a database, allowing for efficient querying and comparison. This segmentation enables parallel processing and reduces the computational complexity from quadratic to linear time relative to the number of components.
Solution Approach 2:
The patent performs preliminary action by pre-extracting and storing control flow graph characteristics for each procedure in a database during the analysis phase. This pre-computation allows for rapid querying and comparison during the identification phase, significantly improving productivity when analyzing large binaries with many components.
Data Source
AI summary
Disclosed are various embodiments for compiler independent identification of application components. A procedure in a compiled binary application is identified. Then, a first compiler independent hash value for the procedure is generated, the compiler independent hash value representing a set of memory dereferences occurring in a heap, and the set of memory dereferences relying in part on a set of inputs for the procedure. Next, it is determined whether the first compiler independent hash value matches a second compiler independent hash value associated with a known procedure in a known source code file.