fnprint
A behavioral function matcher for binaries that identifies code by side effects rather than byte signatures or control-flow graphs.
0 projects
About fnprint
fnprint is a command-line tool designed to match functions in binaries based on their behavior. It operates by running functions in a privilege-separated emulator using deterministic inputs to record side effects, which are then hashed into a fingerprint. This approach allows for matching across different compilers, optimization levels, and CPU architectures, as the behavioral model is architecture-neutral. The tool is specifically designed for security research and can safely analyze malware. Its emulator runs in a worker under a seccomp jail that forbids execution, sockets, and file operations. It supports x86-64 and aarch64 ELF binaries. Key workflows include indexing known functions into a database, querying stripped binaries against a corpus to recover function names, and performing n-day triage by comparing a target against known-vulnerable and patched corpora. It provides a global 1:1 alignment using both behavior and call-graph analysis to distinguish between similar functions.
Summarised from the official page linked above.