You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Similarity score is capped at 0.65 for binaries with no flow graph edges #90
Describe the bug
The CallGraph overload of GetSimilarityScore() in bindiff/differ.cc weights the CFG edge match ratio at 0.35 of the total program similarity score. When a binary has no flow graph edges, that term is 0.35 * 0 = 0, so the score can never exceed 0.65 even when the binary is diffed against itself.
Assemble the attached no_jumps.asm with NASM (or use the attached no_jumps binary). It contains a single function with one basic block, so the binary has no flow graph edges. With no calls, the call graph MD index is also trivially equal on both sides, which isolates the edge term.
Export it with BinExport from IDA Pro, or use the attached no_jumps.BinExport.
Diff the export against itself: bindiff no_jumps.BinExport no_jumps.BinExport
Observe similarity of 64.565% (0.65 × 0.9933 confidence) despite 1/1 functions matched and both sides being identical.
Expected behavior
A self-diff should report similarity ≈ 1.0.
Screenshots
Environment:
OS and version: Ubuntu 24.04 LTS
Locale: en-US
Disassembler and version: IDA Pro 9.3
BinDiff: built from 4b643a1
Additional context
Attached: no_jumps.asm, no_jumps (the compiled binary), and no_jumps.BinExport.
Suggested fix: when both kFlowGraphEdgesPrimaryNonLibrary and kFlowGraphEdgesSecondaryNonLibrary are 0, treat the edge term as a full match (contribute 0.35), since there is nothing to disagree about. When only one side has 0 edges, keep the current behavior of contributing 0, since the two binaries differ in control flow. Happy to send a PR if that approach is acceptable.
Yes, roughly. But for more complex binaries this is not guaranteed. When discovering fixed points, we simply may skip over some due to heuristics.
Suggested fix: when both kFlowGraphEdgesPrimaryNonLibrary and kFlowGraphEdgesSecondaryNonLibrary are 0, treat the edge term as a full match (contribute 0.35), since there is nothing to disagree about. When only one side has 0 edges, keep the current behavior of contributing 0, since the two binaries differ in control flow. Happy to send a PR if that approach is acceptable.
Activity
cblichmann commentedon Sep 11, 2026
Yes, roughly. But for more complex binaries this is not guaranteed. When discovering fixed points, we simply may skip over some due to heuristics.
That sounds reasonable, happy to review a PR.