Version Tracking Exact Function Bytes/Instructions/Mnemonics Match Corelators don't match identical functions #1135
Labels
Feature: Version Tracking
Reason: Cannot Reproduce
This issue could not be reproduced
Type: Bug
Something isn't working
Describe the bug
In Version Tracking the Exact Function Bytes/Instructions/Mnemonics Match Correlators don't match an identical function.
To Reproduce
Steps to reproduce the behavior:
windows6.1-kb4512486-x86_4c88f71af8e9d07e5fb141d7aed0bcc7f532781e.msu
from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4512486 and extractrdpcorets.dll
windows6.1-kb4520003-x86_86ac80d58f564c48502a7e2e65b64f7fd1fd2c10.msu
from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4520003 and extractrdpcorets.dll
rdpcorets.dll
s_WPP_SF_DD@24
is not matched by any of the Correlators, even though the function is bit-identical.Expected behavior
The function is matched.
Screenshots
Here is the function matched with my own custom Correlator, but the included Exact Correlators did not match the function:
Environment (please complete the following information):
I'll try to reduce this to a minimal example. But until then:
Is this a known issue? Anyone experienced this before? Anything I'm missing?
Edit: Are the multiple source and destination labels the issue? If so, this can be closed.
Edit: The Duplicate Function Instructions Match Correlator also did not match the function, hence, I don't think this is caused by the multiple labels.
The text was updated successfully, but these errors were encountered: