Hashashin: A Fuzzy Matching Tool for Binary Ninja
This tool detects similar functions between binaries, and ports annotations (currently only in the form of tags) for matching basic blocks.
Installation in Docker
- Download a Linux version of Binary Ninja (commercial or headless)
BinaryNinja.zipfrom Vector35 and place at
- Place your license file at
Then, build the provided Docker containers as described here:
docker build -t safedocs/base/static-light -f Dockerfile.base . docker build -t safedocs/hashashin:local -f Dockerfile.dev .
Due to how the Developer docker is setup below, your code changes will sync into it and you do not need to rebuild unless dependencies change. Launch and enter the container:
docker run -it --rm -v"$(pwd):/processor" --name dev-hashashin safedocs/hashashin:local
The Docker method is supported to enable more consistent development envrionments. However, you should be able to run locally as long as the dependencies are installed:
- BinaryNinja headless
- Python numpy
Provide a Binary Ninja database with tags applied to it which you want to identify.
./src/generate_signatures.py <input_bndb> <signature_file>
./src/generate_signatures.py tests/test1_annotated.bndb test1_annotated.sig.
NOTE: On sizeable files with many functions, this process will take time.
./src/apply_signatures.py <input_binary> <signature_file>
This will output to a file at the same path as the
which is the annotated Binary Ninja database as a result of applying signatures.