6

I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the bindiff functions to compare this database with another database and output any differences to a file. Any recommendations?

2 Answers 2

3

With the now free BinDiff 4.2 you can do batch analysis with a bit of work.

In the BinDiff installation directory (zynamics/BinDiff 4.2), you will find bin/differ.exe and bin/differ64.exe. Those are binaries for batch diffing of IDBs and .BinExport files.

The basic usage would be:

differ --primary=<directory-with-IDBs> --output-dir=<output-directory>

Sadly, this does not work (at least on my machine) as differ.exe fails to find IDA's executable and tries to execute the directory instead.

To solve this, we will export IDBs using the following command:

"<path-to-idaq.exe>" -A -OExporterModule:<result-directory> -S"<path-to-export-script>" "<path-to-idb>"

The export-script is an .idc with the following code:

#include <idc.idc>

static main()
{
    Batch(0);
    Wait();
    Exit(1 - RunPlugin("zynamics_binexport_8", 2));
}

Once you have all your .BinExport files in one directory, run the original differ.exe command on that directory (give it the directory with the .BinExport files instead of the .idb files), and you'll get .BinDiff files for all possible diffs. Those can either be opened up in IDA, or manually parsed (they are SQLite databases).

2

If you're asking about using BinDiff in batch mode: sorry, you can't. It's intentionally restricted.

5
  • For what reason is it restricted? Dec 31, 2013 at 9:15
  • VxClass, I guess. But I don't know the reason, sorry. Dec 31, 2013 at 9:38
  • Do you know any other software I might investigate that could be called remotely to compare two binary/BIOS files? Jan 2, 2014 at 13:56
  • There are a lot of diffing tools (kdiff, etc...), but those are not like BinDiff. Jan 2, 2014 at 14:15
  • Is there anyway that I can export the bindiff results into a readable text (.txt) file? I can only seem to view the results through IDA GUI and .BinExports are not what I am looking for when sending reports. Jan 2, 2014 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.