7

Does any of you know of a recent tool to bindiff using ImmunityDebugger? I know about BinDiff by Zynamics and PatchDiff for IDA. But I really want a tool like this in ImmDBG. I also know about Radare's bindiffer and the feature in mona.py (but this is more with memory regions).

Now I use a HexEditor and diff using this. Then I'll lookup the offset + base address using Immunity. This is not really feasible any more as I've recently started reversing bigger patches.

(Just to be a complete reference, for Firmware Updates I use Binwalk. And you should too :))

  • I think Immunity Debugger lacks many features available in IDA API being used by both PatchDiff and Zynamics BinDiff. Anyway, you may want to modify PatchDiff to see if it can be accomplished (it's open source). – joxeankoret Jul 23 '13 at 14:40
  • What exactly are you trying to achieve? Highlight difference in hex view? – PSS Jul 23 '13 at 15:48
  • Well I doubt Immunity lacks the features. As how hard can it be to diff? =) And I want make my diffing patches more productive, for vulnerability research sake. Now I diff using the hex editor, Find the offset in ImmDbg and find what opcodes have changed. If I can combine the tools into one I'll give it a go. About the PatchDiff being open source. I might try to write some Imm Plugin myself to get PatchDiffing to the level I want. (but I rather reverse than write code) – Stolas Jul 23 '13 at 18:10
  • 2
    It lacks features, it's for sure: Do you have the prototype of all functions in the binary? How does it find functions in the binary? Does it consider that a function can be partitioned in various small chunks? How are the basic blocks managed? Does a non conditional jump break the code? How good is it finding switch structures? Really, it lacks many information. As for "how hard can it be to diff", may be Rolf Rolles is interested in asking that question. – joxeankoret Jul 24 '13 at 6:38
  • 2
    Stolas, you seem to be unclear on what binary diffing is or how it works. When we say "binary diffing" in the context of BinDiff, DarunGrim, PatchDiff, etc., we are specifically NOT talking about a diff involving the raw bytes of the executable, or using 'diff' on the raw disassembly. These tools create a graphical disassembled representation of the two binaries, and then compare that. As such, the quality of the diff tool depends upon the disassembler. This is why the commentors keep mentioning IDA, and why I keep furrowing my brow at your suggestion of using a hex editor, Meld, or diff. – Rolf Rolles Jul 24 '13 at 20:17
2

The answer lays within the comments, read Binary Diffing by Nicolas A. Economou (CoreImpact) 2009 to see why.

Good Binary Diffing is in fact a way harder subject that does a lot more than compare bytes or bits.

Making a Binary Diff with objdump and meld is really not the way to go. Read the CoreImpact document and it will show some of the issues with binary diffing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.