1

Good Day!

I've not hit upon a solution to compare different compiled binaries for identical functions.

Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 or 4 different 'releases' of the compiled binary and run them through Ghidra. Many of the functions that were not changed should/would be identical. Those that did change will. However offsets, memory locations etc would be different. Repeating assembly code though should be close.

Understandingly offsets and memory locations may change, however functions inherent within the code should be mostly identical in assembly- and knowing what was the same and what was changed would be useful to know what was there and what isn't.

I can not find however any package that does that currently- either I'm not looking for the right term or not asking the right question. Both are possible.

So is there a 'function level' disassembly comparison tool out there? Or have I just not learned to use the tools I have in front of me yet?

Thank you!

Improve this question
3
  • 2
    This is roughly what IDA attempts to address with FLAIR. It won't spare you the disassembly, but by recognizing library and coloring library functions you get a visual cue that you may ignore a particular function. However, I think your reasoning is a bit flawed. Because different versions of the same library - unless you artificially created them yourself - would also potentially be created with a different compiler/linker/optimization level or the linker may have glued together everything in a different order. So FLAIR, while seemingly simplistic, is an adequate solution.
    – 0xC0000022L ♦
    May 20, 2020 at 7:16
  • Interesting. I'll have to see if the freebie can do that or not, but since this was an ARM binary I thought I remembered that being disallowed in those versions. I don't know though if IDA could recognize the library. I think I'd have to find out how they track malware evolution variants; if FLARE/FLAIR is what is used for those signature generations that then is what I need to follow.
    – J.Hirsch
    May 20, 2020 at 12:54
  • 1
    There are two tools packaged with ghidra, the code browser and the version tracking tool. This sounds exactly the use case for the version tracker tool
    – mumbel
    May 21, 2020 at 18:49

1 Answer 1

Reset to default
3

The Ghidra Version Tracking tool is what you're looking for. See here for an introductory video.

Improve this answer
1
  • Thank you. Interestingly it has been running for 2 days ;) I see I'll have to step back to something even simpler than the demo video to see how it works.
    – J.Hirsch
    May 24, 2020 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.