Do I need to have IDA Pro to use the BinDiff tool?

Question

I'm trying to learn how to use BinDiff tool, but I can't figure out how to open two binaries to do the comparison. While skimming through their manual, it seems like I need to have IDA Pro for that.

Can I use BinDiff without IDA Pro (say, with just IDA free)?

Answer 1

Yes, this is now possible with Ghidra.

The latest version, BinDiff 6, has experimental support for the Ghidra disassembler. It ships with an extension that allows to export Ghidra disassembly into the .BinExport format needed for diffing.

Required software

• BinDiff 6 from the zynamics website
• A recent Java runtime (OpenJDK 11 or later)
• Ghidra 9.1.2 (https://ghidra-sre.org/releaseNotes_9.1.2.html)

Installing the Ghidra Extension

After installing BinDiff, locate the "BinExport" extension in your installation folder.

The defaults are

• Windows: C:\Program Files\BinDiff\extra\ghidra
• Linux: /opt/bindiff/extra/ghidra
• macOS: /Applications/BinDiff/Extra/Ghidra

If you have located the ghidra_BinExport.zip file, the extension can be installed like any other Ghidra extension:

1. Start Ghidra, then select File|Install Extensions....
2. Click the + button to Add extension.

3. In the Select Extension dialog, navigate to the directory containing ghidra_BinExport.zip.

4. Select the .zip file and click OK

5. Click OK to confirm and again to dismiss the restart message. Then restart Ghidra.

Usage

This version of the Java based exporter for Ghidra has the following features compared to the native C++ version for IDA Pro:

|                                         | Ghidra | IDA |
| --------------------------------------- | ------ | --- |
| Protocol Buffer based full export       |    ✓¹  |  ✓  |
| Statistics text file                    |    -   |  ✓  |
| Text format for debugging               |    -   |  ✓  |
| BinNavi export into PostgreSQL database |    -   |  ✓  |

¹ No operand trees

Verifying the installation version

1. In Ghidra, select File|Install Extensions....
2. Verify that BinExport is listed and has the correct Install Path

Invocation

1. In Ghidra, open a project or create a new one.
2. If not already done, open the binary to export in the Code Browser tool and run Ghidra's initial analysis. You may want to enable the "aggressive instruction finder" option to get better coverage in the export.
3. In the project view, right-click the binary to export and select Export...
4. From the drop-down list, select Binary BinExport (v2) for BinDiff
5. Select a path for the output file. This can be the original filename, as .BinExport will be appended.
6. Click OK.

BinDiff Exported Files

Exported files can now be diffed and the results displayed in its UI:

1. Export two binaries following the instructions above. The following steps assume primary.BinExport and secondary.BinExport.

2. From the command-line, run the BinDiff engine with

   bindiff primary.BinExport secondary.BinExport
   

   This will create a file primary_vs_secondary.BinDiff in the current directory. The bindiff command should be in your system path.

3. Launch the BinDiff UI, either via bindiff --ui or using the launcher for your operating system.

4. Create a new workspace or open an existing one.

5. Select Diffs|Add Existing Diff....

6. Under Choose Diff, select the primary_vs_secondary.BinDiff created in step 2.

7. Click OK, followed by Add. The diff is now shown in the tree view on the left and can be opened by double-clicking it.

8. Use BinDiff normally to display the call graph or flow graphs of matched functions.

Open Source

Finally, the BinExport extension (and also the IDA Pro plugin) is open source and available on GitHub. The v11 tag corresponds to BinDiff 6.

Answer 2

Bindiff can be a plugin in IDA or a standalone, but you still need the IDA database to compare binaries.