Version Tracking Exact Function Bytes/Instructions/Mnemonics Match Corelators don't match identical functions
0x6d696368 opened this issue · comments
Describe the bug
In Version Tracking the Exact Function Bytes/Instructions/Mnemonics Match Correlators don't match an identical function.
To Reproduce
Steps to reproduce the behavior:
- Download:
windows6.1-kb4512486-x86_4c88f71af8e9d07e5fb141d7aed0bcc7f532781e.msu
from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4512486 and extractrdpcorets.dll
- Download:
windows6.1-kb4520003-x86_86ac80d58f564c48502a7e2e65b64f7fd1fd2c10.msu
from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4520003 and extractrdpcorets.dll
- Start VT Session between the two
rdpcorets.dll
s - Add Function Bytes, Instructions and Mnemonics Match Corelators
- Function
_WPP_SF_DD@24
is not matched by any of the Correlators, even though the function is bit-identical.
Expected behavior
The function is matched.
Screenshots
Here is the function matched with my own custom Correlator, but the included Exact Correlators did not match the function:
Environment (please complete the following information):
- OS: CentOS 7
- Java Version: 11.0.4
- Ghidra Version: 9.1-BETA
I'll try to reduce this to a minimal example. But until then:
Is this a known issue? Anyone experienced this before? Anything I'm missing?
Edit: Are the multiple source and destination labels the issue? If so, this can be closed.
Edit: The Duplicate Function Instructions Match Correlator also did not match the function, hence, I don't think this is caused by the multiple labels.
I took a peek at this. Unfortunately, as the post is quite old, I was unable to the original binaries. I tried with similar binaries, but was unable to reproduce this issue.
I will close this for now. If anyone finds available binaries that exhibit the issue, then we can reopen this ticket.