PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Weisfeiler-Lehman Graph Kernel for Binary Function Analysis

blog.quarkslab.com | research | #reverse-engineering | #binary-analysis | #machine-learning | #graph-kernel | #function-similarity | #weisfeiler-lehman
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A method applying the Weisfeiler-Lehman graph kernel to control-flow graphs, comparing binary functions against large known-function databases for classification, clustering and near-duplicate detection.
Published
Collected

Related coverage

tool · blog.quarkslab.com
From P-Code to GNN: extract binary code semantics
This coverage gives security teams current context for monitoring, validation, and remediation.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
research · blog.quarkslab.com
QBDI vs TritonDSE against a VM: who will be the fastest?
Quarkslab solves a custom-VM CTF challenge twice — with symbolic execution engine TritonDSE and instrumentation framework QBDI — and compares which approach gets to the solution fastest.
research · blog.quarkslab.com
Introducing TritonDSE: A framework for dynamic symbolic execution in Python
Introducing TritonDSE, a Python library atop Triton for customizable dynamic symbolic execution: high-level program exploration primitives, hooks, and the base of PASTIS's white-box fuzzer.
research · blog.quarkslab.com
Quokka: A Fast and Accurate Binary Exporter
Quarkslab open-sources Quokka, a binary exporter that extracts a program's disassembly for offline analysis, letting users write complex analyses without disassembler APIs.
research · blog.quarkslab.com
Binbloom blooms: introducing v2
Introducing binbloom v2, Quarkslab's firmware reverse-engineering tool: a new method to determine the load base address of both 32- and 64-bit firmware binaries.
Back