It appears that he looked for string similarity in the source and binaries. Another, and imho better, way to find code plagiarism is to build the call graph of the programs and perform graph isomoprhism to detect similarities. It is much harder to conceal plagiarism from that sort of analysis.