  Third-party libraries (TPLs) are extensively utilized by developers to
expedite the software development process and incorporate external
functionalities. Nevertheless, insecure TPL reuse can lead to significant
security risks. Existing methods are employed to determine the presence of TPL
code in the target binary. Existing methods, which involve extracting strings
or conducting function matching, are employed to determine the presence of TPL
code in the target binary. However, these methods often yield unsatisfactory
results due to the recurrence of strings and the presence of numerous similar
non-homologous functions. Additionally, they struggle to identify specific
pieces of reused code in the target binary, complicating the detection of
complex reuse relationships and impeding downstream tasks. In this paper, we
observe that TPL reuse typically involves not just isolated functions but also
areas encompassing several adjacent functions on the Function Call Graph (FCG).
We introduce LibAM, a novel Area Matching framework that connects isolated
functions into function areas on FCG and detects TPLs by comparing the
similarity of these function areas. Furthermore, LibAM is the first approach
capable of detecting the exact reuse areas on FCG and offering substantial
benefits for downstream tasks. Experimental results demonstrate that LibAM
outperforms all existing TPL detection methods and provides interpretable
evidence for TPL detection results by identifying exact reuse areas. We also
evaluate LibAM's accuracy on large-scale, real-world binaries in IoT firmware
and generate a list of potential vulnerabilities for these devices. Last but
not least, by analyzing the detection results of IoT firmware, we make several
interesting findings, such as different target binaries always tend to reuse
the same code area of TPL.
