.png){kind=icon}
Return
A static API birthmark for Windows binary executables
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jss.2008.11.848.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
A software birthmark is the inherent characteristics of a program extracted from the program itself. By comparing birthmarks, we can detect whether a program is a copy of another program or not. We propose a static API birthmark for Windows executables that utilizes sets of API calls identified by a disassembler statically. By comparing 49 Windows executables, we show that our birthmark can distinguish similar programs and detect copies. By comparing binaries generated by various compilers, we also demonstrate that our birthmark is resilient. We compare our birthmark with a previous Windows dynamic birthmark to show that it is more appropriate for GUI applications. (C) 2008 Elsevier Inc. All rights reserved.
Keywords:
Software birthmark
Software theft detection
Software security
Static analysis
Reverse engineering
Journal
IF:
4.1
Papers:
5.5K
Citations:
8.4K
Organization
No organization information available
Cited Papers
Stimulation of craniofacial muscle afferents induces prolonged facilitatory effects in trigeminal nociceptive brain-stem neurones.png)
Pain
PainIF0
PREAI
ShareSaveEmerging role of noncanonical polycomb repressive complexes in normal and malignant hematopoiesis
OAAI
OAAIShareSaveShareSaveShareSaveNovel κ light-chain gene rearrangements in mouse λ light chain-producing B lymphocytesNature
NatureIF0
PREAI
ShareSaveShareSave
View more