1

What are the current options for binary patching which works across different versions of the binary?

E.g. we created a binary patch for a specific version of a binary and want to apply that patch to another version of a binary which is slightly different to the original binary but identical in the 'area' (the function which needs to be patched)?

Of course this won't work in every case, but a good-enough solution for x64 would be fine. Are there any tools, frameworks etc. available?

1
  • Exactly. Ideally considering architectural/binary specifics in the surrounding "pattern" which is likely to change across versions (for example, ignoring any absolute addressing).
    – MRalwasser
    Commented Nov 17, 2021 at 22:48

1 Answer 1

1

Version tracking in ghidra is exactly what you are looking for. Say you have two binaries with different versions. First, you need to analyze those binaries and save the analysis results (you can manually patch binary before or during this stage). Then click on version tracking symbol and create new version tracking session. Here, you can track and apply changes over from source to destination binary.

enter image description here

Please check their documentation in the help section, as shown in the image.

enter image description here

Please also checkout the complete video tutorial here.

2
  • the problem is that ghidra's version tracking does not have a "similar functions" correlator, just an "identical functions" correlator. If the patch needs to be done in such a function (e.g. in a very large function where it is more likely that the function has been changed across versions) , "version tracking" does not help.
    – MRalwasser
    Commented Nov 19, 2021 at 18:55
  • In that case you should definately take a look @ deepbindiff or radare's radiff2 project to get "similar functions" and "different functions" then apply patch using ghidra or any other tool
    – R4444
    Commented Nov 19, 2021 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.