2

I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this?

It seems that I need to compare all the functions and move the information if their contents match (the addresses may be different). How to do this?

It is clear that I need to calculate the hash from each function, find the intersections, and then compare the matched functions byte-to-byte. It's about whether there are ready-made tools for this?

Improve this question
2
  • @Biswapriyo typically, compilers generate code based on strict rules, not random.
    – Albeoris
    Commented Sep 10, 2019 at 20:15
  • 1
    @Biswapriyo compilation is a deterministic process
    – julian ♦
    Commented Sep 11, 2019 at 8:56

1 Answer 1

Reset to default
1

I would recommend bindiff for this purpose.

Another option will be to use FLIRT, though I would prefer bindiff.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.