3

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do.

I have tried to use the Radare2 framework to solve this task:

$ radiff2 original.efi patched.efi

Buffer truncated to 283136 bytes (1024 not compared)
0x000000d8 e129 => d52e 0x000000d8
0x000099d0 35 => 00 0x000099d0
0x0000eefb 3637 => 3730 0x0000eefb
0x0000ef03 3031323538 => 3330353136 0x0000ef03

I have then opened two windows side by side and run radare2 on each file:

$ radare2 original.efi

[0x0000a66c] aaa
[0x0000a66c] s 0x000000d8
[0x000000d8] pd 10

$ radare2 patched.efi

[0x0000a66c] aaa
[0x0000a66c] s 0x000000d8
[0x000000d8] pd 10

In this case there is a difference at the address, but it looks like there is something wrong:

0x000000d8    d5           invalid            |     0x000000d8    e129         loope 0x103
0x000000d9    2e05000a0000 add eax, 0xa00     |     0x000000da    05000a0000   add eax, 0xa00

However, in many cases I have found that even though radiff2 reports a difference at a memory location, when I try to compare like described above, no differences are found and the lines are identical.

Can anyone explain if I'm doing anything wrong or maybe a better way to do this?

Unfortunately, I do not have access to a Windows system, so I can only use tools available for Linux.

  • 3
    can you provide the binaries? – HamZa Mar 21 '17 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.