Robust Function Matching with Control-Flow Analysis
The source code for the CFG SigMaker is available on GitHub. Only IDA Pro 9 is currently supported. Introduction Pattern matching is commonly used in reverse engineering to locate known instruction sequences inside compiled binaries. Traditional scanners usually rely on byte signatures built from a function’s machine code, with wildcard bytes used for values such as addresses, displacements, and relative branch offsets. This approach works well when the generated code remains mostly unchanged. However, its reliability decreases once the same source code is rebuilt with a different compiler version, optimization level, or build configuration. Compilers may reorder instructions, replace operations with equivalent alternatives, merge or remove branches, unroll loops, inline functions, or eliminate code that is no longer required. These transformations can significantly change the final byte sequence without changing the behavior of the function. ...