Cross-Platform Software Birthmarking for Real-World Binaries via Intermediate Representation
For security researchers and forensic analysts, this work provides a practical cross-platform birthmarking approach with quantified performance, though it is incremental over existing IR-based methods.
The paper proposes a unified software birthmarking method using Ghidra P-code intermediate representation to detect plagiarism across different CPU architectures, achieving high consistency (r=0.9846) and identifying a dilution effect in Windows binaries.
Software birthmarking detects plagiarism through characteristic program features, yet cross-platform resilience remains under-evaluated. This paper proposes a unified birthmarking approach for real-world binaries by lifting disparate formats into a common intermediate representation via Ghidra P-code. Experiments across diverse platforms and languages demonstrate exceptional consistency across CPU architectures ($r=0.9846$), independent of ISA (Instruction Set Architecture) specific details. The study also identifies a ``dilution effect'' in Windows binaries, in which the proliferation of library-derived functions degrades similarity scores. Despite this noise, the Simpson index demonstrates superior discriminative power. These findings clarify the practical capabilities and essential requirements for robust cross-platform birthmarking.