IDA plugin for collecting functions, data, types and comments from analysed binaries and fuzzy matching them in another binaries.

author: Jan Prochazka
licence: none, public domain
home: https://github.com/jendabenda/fingermatch

• fingerprint libraries and then match them in binaries you want to anlayze, you can focus only on unseen and interesting parts
• resume analysis when new version of previously analyzed binary is out, no need to reverse engineer everything from scratch
• anything what fits

• fuzzy function matching
• data, types, comments matching
• can correctly match small functions
• easy to use

• works with IDA 7.4+, Python 3
• copy fingermatch.py into IDA plugins folder

• menu View -> Collect fingerprints - collects fingerprints and save them into fingerprint database
• menu View -> Match fingerprints - loads fingerprints from filename and match them against analysed binary

• available from IDA console
• fingermatch_collect(fingerdb_path) - collects fingerprints and save them into fingerprint database
• fingermatch_match(fingerdb_path) - loads fingerprints from fingerprint database and match them against analysed binary

• compile library with debugging symbols (\Z7 or \Zi switch with msvc)
• autoanalyze binary with IDA and pdb symbols
• collect fingerprints with FingerMatch
• match fingerprints wherever you want
• you can download example databases (zlib, libpng, libtiff, openssl, cryptopp) from here

• open binary, analyze it
• collect fingerprints with FingerMatch
• when new binary version is out, open new version
• match saved fingerprints

Function fingerprints are based on control flow traces allowing to match the same function with shuffled basic block starts, different register allocation or instruction scheduling. Fingerprints of data, types and comments are also matched. In addition matching considers whole reference graph, so it has high chance to pinpoint correct names. Matching is tuned to have low false positive matches.

Detailed documentation is at the begining of the fingermatch.py file.