Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Similarity score is capped at 0.65 for binaries with no flow graph edges

Abierto Apto para principiantes
  • ¿Algo no está bien?
#90 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
78/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
cpp
Área
reverse-engineering

Línea de trabajo

Empieza en bindiff/differ.cc, en la sobrecarga de CallGraph de GetSimilarityScore(), especialmente en el cálculo de coincidencia de aristas del grafo de flujo mencionado en el issue. Reproduce el self-diff con no_jumps.BinExport y verifica después que los binarios con cero aristas en ambos lados obtengan aproximadamente 1.0, mientras que un caso con cero aristas en un solo lado conserve el comportamiento actual.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

Describe the bug
The CallGraph overload of GetSimilarityScore() in bindiff/differ.cc weights the CFG edge match ratio at 0.35 of the total program similarity score. When a binary has no flow graph edges, that term is 0.35 * 0 = 0, so the score can never exceed 0.65 even when the binary is diffed against itself.

Relevant code from commit 4b643a1:

similarity +=
    0.35 * counts[Counts::kFlowGraphEdgeMatchesNonLibrary] /
    (std::max(1.0,
              0.5 * (counts[Counts::kFlowGraphEdgesPrimaryNonLibrary] +
                     counts[Counts::kFlowGraphEdgesSecondaryNonLibrary])));

To Reproduce
Steps to reproduce the behavior:

  1. Assemble the attached no_jumps.asm with NASM (or use the attached no_jumps binary). It contains a single function with one basic block, so the binary has no flow graph edges. With no calls, the call graph MD index is also trivially equal on both sides, which isolates the edge term.
  2. Export it with BinExport from IDA Pro, or use the attached no_jumps.BinExport.
  3. Diff the export against itself: bindiff no_jumps.BinExport no_jumps.BinExport
  4. Observe similarity of 64.565% (0.65 × 0.9933 confidence) despite 1/1 functions matched and both sides being identical.

Expected behavior
A self-diff should report similarity ≈ 1.0.

Screenshots

Image

Environment:

  • OS and version: Ubuntu 24.04 LTS
  • Locale: en-US
  • Disassembler and version: IDA Pro 9.3
  • BinDiff: built from 4b643a1

Additional context
Attached: no_jumps.asm, no_jumps (the compiled binary), and no_jumps.BinExport.

no_jumps.zip

Suggested fix: when both kFlowGraphEdgesPrimaryNonLibrary and kFlowGraphEdgesSecondaryNonLibrary are 0, treat the edge term as a full match (contribute 0.35), since there is nothing to disagree about. When only one side has 0 edges, keep the current behavior of contributing 0, since the two binaries differ in control flow. Happy to send a PR if that approach is acceptable.

Lenguaje dominante
Java
Estrellas
3.2k
Forks
240
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de google/bindiff

Todos los issues de google/bindiff

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.