  Binary code clone analysis is an important technique which has a wide range
of applications in software engineering (e.g., plagiarism detection, bug
detection). The main challenge of the topic lies in the semantics-equivalent
code transformation (e.g., optimization, obfuscation) which would alter
representations of binary code tremendously. Another chal- lenge is the
trade-off between detection accuracy and coverage. Unfortunately, existing
techniques still rely on semantics-less code features which are susceptible to
the code transformation. Besides, they adopt merely either a static or a
dynamic approach to detect binary code clones, which cannot achieve high
accuracy and coverage simultaneously. In this paper, we propose a
semantics-based hybrid approach to detect binary clone functions. We execute a
template binary function with its test cases, and emulate the execution of
every target function for clone comparison with the runtime information
migrated from that template function. The semantic signatures are extracted
during the execution of the template function and emulation of the target
function. Lastly, a similarity score is calculated from their signatures to
measure their likeness. We implement the approach in a prototype system
designated as BinMatch which analyzes IA-32 binary code on the Linux platform.
We evaluate BinMatch with eight real-world projects compiled with different
compilation configurations and commonly-used obfuscation methods, totally
performing over 100 million pairs of function comparison. The experimental
results show that BinMatch is robust to the semantics-equivalent code
transformation. Besides, it not only covers all target functions for clone
analysis, but also improves the detection accuracy comparing to the
state-of-the-art solutions.
