2

I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this?

It seems that I need to compare all the functions and move the information if their contents match (the addresses may be different). How to do this?

It is clear that I need to calculate the hash from each function, find the intersections, and then compare the matched functions byte-to-byte. It's about whether there are ready-made tools for this?

  • @Biswapriyo typically, compilers generate code based on strict rules, not random. – Albeoris Sep 10 '19 at 20:15
  • 1
    @Biswapriyo compilation is a deterministic process – julian Sep 11 '19 at 8:56
1

I would recommend bindiff for this purpose.

Another option will be to use FLIRT, though I would prefer bindiff.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.