Can I read A static API birthmark for Windows binary executables on EtoBox?

A static API birthmark for Windows binary executables by Seokwoo Choi; Heewan Park; Hyun-il Lim; Taisook Han is a Computer Science article available to read on EtoBox.

What is A static API birthmark for Windows binary executables about?

A software birthmark is the inherent characteristics of a program extracted from the program itself. By comparing birthmarks, we can detect whether a program is a copy of another program or not. We propose a static API birthmark for Windows executables that utilizes sets of API calls identified by a disassembler statically. By comparing 49 Windows executables, we show that our birthmark can distinguish similar programs and detect copies. By comparing binaries generated by various compilers, we also demonstrate that our birthmark is resilient. We compare our birthmark with a previous Windows dynamic birthmark to show that it is more appropriate for GUI applications.

Who reads A static API birthmark for Windows binary executables?

Author

Seokwoo Choi; Heewan Park; Hyun-il Lim; Taisook Han

Publisher

Elsevier Science; Elsevier ; Elsevier BV (ISSN 0164-1212)

Published

2009

Language

EN

Field

Computer Science (Physical Sciences)