|Main Archive Page > Month Archives > full-disclosure-uk archives|
I can see what you're saying, it could be useful for finding differences in different versions of the same binary but from what I can see Joxean's app is meant to group files of the same 'type,' not provide 'diff' capabilities.
On Tue, Jan 5, 2010 at 9:51 AM, Dan Kaminsky <firstname.lastname@example.org> wrote:
> I looked into a fair amount of this sort of normalization back when I was
> playing with dotplots. The idea was to upgrade from simple Levenshtein
> string comparison (with no knowledge of variable length x86 instructions,
> pointers that shift from compile to compile, etc) to something with at least
> some domain specific knowledge. What I found, somewhat surprisingly, was
> that dumb string comparison was more than enough. In fact, when I compared
> pre-patch and post-patch builds, it was easy to directly see when content
> was added, removed, shifted in location, etc. Joxean's going to have much
> the same result -- as basic as his similarity metric is, he'll get the broad
> strokes just fine.
> Ultimately the best approach is to build a graph of how functions interact
> and measure graph isomorphism, but of course Halvar figured that out years
> ago :)
> On Tue, Jan 5, 2010 at 3:41 PM, T Biehn <email@example.com> wrote:
>> Wouldn't it be more useful to the sec community to have a algorithm
>> that abstracts at the -interpreted- content level? That is when
>> analyzing binaries I wouldn't think that this would classify two with
>> near identical functionality together, even though it is removing a
>> significant chunk of information during the hash pass.
>> I would largely assume that your algorithm, as is, works best on
>> uncompressed bitmaps. Is there something I'm missing?
>> On Sun, Jan 3, 2010 at 6:37 AM, Joxean Koret <firstname.lastname@example.org> wrote:
>> > Hi all,
>> > I'm happy to announce the very first public release of the open source
>> > project DeepToad, a tool for computing fuzzy hashes from files.
>> > DeepToad can generate signatures, clusterize files and/or directories
>> > and compare them. It's inspired in the very good tool ssdeep  and, in
>> > fact, both projects are very similar.
>> > The complete project is written in pure python and is distributed under
>> > the LGPL license .
>> > Links:
>> > Project's Web Page http://code.google.com/p/deeptoad/
>> > Download Web Page http://code.google.com/p/deeptoad/downloads/list
>> > Wiki http://code.google.com/p/deeptoad/w/list
>> > References:
>> >  http://ssdeep.sourceforge.net/
>> >  http://www.gnu.org/licenses/lgpl.html
>> > Regards && Happy new year!
>> > Joxean Koret
>> > _______________________________________________
>> > Full-Disclosure - We believe in it.
>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> > Hosted and sponsored by Secunia - http://secunia.com/
>> FD1D E574 6CAB 2FAF 2921 F22E B8B7 9D0D 99FF A73C
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
-- FD1D E574 6CAB 2FAF 2921 F22E B8B7 9D0D 99FF A73C http://pgp.mit.edu:11371/pks/lookup?search=tbiehn&op=index&fingerprint=on http://pastebin.com/f6fd606da _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/