编程实现查找“貌似相同”的函数

元始天尊

给ida用的，处于实际需要，临时编写的代码：编程实现查找“貌似相同”的函数，纯字节码对比，用了散列

1. 
   
2. 
   
3. map={}
   
4. #scale/256  即为要比对的字节数大小   offset:离函数头偏移
   
5. scale=0x1000
   
6. offset=5
   
7. i=0
   
8. while(i<scale):
   
9.     map[i]=[0,""]
   
10.     i=i+1
    
11. addr=NextFunction(0)
    
12. while(addr<0xffffffff):
    
13.     sum=0
    
14.     i=0
    
15.     #确保函数足够大
    
16.     if(GetFunctionName(addr)==GetFunctionName(addr+0x20)):
    
17.         while(i<(scale/256)):
    
18.             #越过push ebp;mov ebp,esp
    
19.             sum=sum+Byte(addr+offset+i)
    
20.             i=i+1
    
21.         if(map[sum][0]==0):
    
22.          map[sum][1]=GetFunctionName(addr)
    
23.         else:
    
24.             map[sum][1]=map[sum][1]+" "+GetFunctionName(addr)
    
25.         map[sum][0]=map[sum][0]+1
    
26.     addr=NextFunction(addr)
    
27. i=0
    
28. while(i<scale):
    
29.     if(map[i][0]>=2):
    
30.         print map[i][1]
    
31.     i=i+1
    
32. 
    

复制代码

效果：
sub_204B0 sub_21270
FreeWritablePage sub_180E0 sub_193A0 sub_21180
__SEH_prolog4 __SEH_prolog4_GS
sub_111CF sub_151E0 sub_173B0 sub_1F630 sub_20330
sub_20400 sub_211D0
sub_16910 sub_17D50 sub_19010 sub_20B40
sub_16150 sub_198C0 sub_1FF00 sub_1FFD0 sub_200A0
GetProcessFileObjectName sub_17DB0 sub_19070 sub_1AA50 sub_1B5B0 sub_20BA0
sub_21770 sub_21BC0
GetSysModules GetRegVal sub_17840 sub_17F20 sub_18A40 sub_191E0 sub_1A690 sub_20D10 sub_20E60 sub_21D90
sub_165D0 sub_20900
sub_12599 sub_1D980
sub_10730 sub_26A40
sub_106D0 sub_14A2A
sub_153A0 sub_15510
sub_1CA70 sub_1D400
sub_17270 sub_183F0 sub_19C70 sub_1FBD0 sub_21680
sub_223C0 sub_22460
sub_19730 sub_1C0C0 sub_1C9B0 sub_1DEC0 CsqPeekNextIrp sub_22B20
sub_14B10 sub_1C000 sub_213D0
__aulldiv sub_18C50
sub_22190 sub_22210
sub_177D0 sub_203C0
sub_15440 sub_22860
FreeBuffer sub_17EF0 sub_191B0 sub_20CE0 sub_222D0
sub_1EED0 sub_20540 sub_206E0
sub_1DB20 sub_22070
sub_1AAF0 sub_1E6D0 sub_1EAA0 sub_225E0
sub_19F30 sub_1EFF0
sub_10620 sub_1F990
sub_105A0 sub_105E0
StartRoutine sub_182C0 sub_19B40 sub_21550 sub_229F0
sub_1E820 sub_1E980
sub_179F0 sub_18BF0 sub_1A840 sub_21F40
sub_1C1B0 sub_1C280 sub_1D3B0
sub_201F0 sub_22570
GetTimeDateStamp1 GetTimeDateStamp2 sub_184E0 sub_18640 GetTimeDateStamp3 GetTimeDateStamp4
sub_141A2 sub_1D000
sub_1C2E0 sub_1C330
sub_17A50 sub_18CA0 sub_19580 sub_1A8A0 sub_21FA0
sub_10530 sub_167B0 sub_17BF0 sub_18EB0 sub_209E0
sub_103E0 sub_17360
sub_1DA40 __alldiv
sub_18110 sub_19990 sub_20170
memcpy sub_10DF0
sub_13A77 sub_15DB0
sub_15330 sub_1CB80
sub_193D0 DriverEntry sub_22910
sub_16710 sub_17B50 sub_18E10 sub_20860
sub_1F660 sub_1FCD0
sub_17530 sub_187A0 sub_1A3F0 sub_21920
sub_17810 sub_1D910
sub_128B7 sub_138FD
sub_13C65 sub_1D7D0

0xAA55

论C艹的弊病