1

Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?

And, if I can't do it with x64dbg, what tool would be better than a debugger to find the modifications done on assembly code between the two files?

  • Do you want to compare two DLL files or do you want to see run-time patches on a DLL file? – de6f Aug 8 '18 at 11:32
  • i have original DLL file and the patched version of it and i want to know which line been patched – pharaon Aug 8 '18 at 12:29
2

You shouldn't use a debugger to search for differences. You should use a diff tool. Of course, most diff tools works on text, but there are some that deal with the binary files.

Some examples:

There are more and you probably will find one that matches exactly your need. If you would like to see your modifications in a nice visual manner with already bytes being presented as a opcodes there are some options too. I haven't used them (so can't give you my recommendations) but there are at least two that I know of:

  • how am i suppose to install patchdiff 2 with IDA and use it,there is no installation or using guide – pharaon Aug 8 '18 at 12:42
  • Compile and then put in plugins folder as you would do with any other plugin – Paweł Łukasik Aug 8 '18 at 12:48
  • i tried that already but got too many errors and undefined variables, is there a compiled one? – pharaon Aug 8 '18 at 22:16
  • I’ll try to see if I can get that compiling – Paweł Łukasik Aug 9 '18 at 11:03
  • would be really great help – pharaon Aug 9 '18 at 16:34
2

In Windows, perhaps the simplest possibility is the built-in File Compare command with its /B (binary) switch, to be used from the command-line. It lists all different bytes together with their file offset.

Usage:

fc /B filepath1 filepath2

  • i want to see the opcode different not the binarry – pharaon Aug 8 '18 at 22:18
  • The file compare gives you the file offsets of the differences in your binaries. From these you can easily get the opcode diffs in a debugger. Should be no problem at all. – josh Aug 9 '18 at 8:24
  • always give me this error, FC: cannot open C:\PROGRAM - No such file or folder – pharaon Aug 9 '18 at 9:52
  • quote your path like fc /b "c:\prxxx\yyy ddd" "d:\xx xx xx\yyy yyy" spaces are treated as delimiters for most of the console apps so it cant find your file that has a space in the path – blabb Aug 9 '18 at 10:18
  • hundred lines of binaries and last line is FC: "c:\prxxx\yyy ddd" longer than "d:\xx xx xx\yyy yyy" – pharaon Aug 9 '18 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.