I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the bindiff functions to compare this database with another database and output any differences to a file. Any recommendations?
2 Answers
With the now free BinDiff 4.2 you can do batch analysis with a bit of work.
In the BinDiff installation directory (zynamics/BinDiff 4.2
), you will find bin/differ.exe
and bin/differ64.exe
. Those are binaries for batch diffing of IDBs and .BinExport
files.
The basic usage would be:
differ --primary=<directory-with-IDBs> --output-dir=<output-directory>
Sadly, this does not work (at least on my machine) as differ.exe
fails to find IDA's executable and tries to execute the directory instead.
To solve this, we will export IDBs using the following command:
"<path-to-idaq.exe>" -A -OExporterModule:<result-directory> -S"<path-to-export-script>" "<path-to-idb>"
The export-script
is an .idc
with the following code:
#include <idc.idc>
static main()
{
Batch(0);
Wait();
Exit(1 - RunPlugin("zynamics_binexport_8", 2));
}
Once you have all your .BinExport
files in one directory, run the original differ.exe
command on that directory (give it the directory with the .BinExport
files instead of the .idb
files), and you'll get .BinDiff
files for all possible diffs. Those can either be opened up in IDA, or manually parsed (they are SQLite databases).
If you're asking about using BinDiff in batch mode: sorry, you can't. It's intentionally restricted.
-
-
-
Do you know any other software I might investigate that could be called remotely to compare two binary/BIOS files? Jan 2, 2014 at 13:56
-
There are a lot of diffing tools (kdiff, etc...), but those are not like BinDiff. Jan 2, 2014 at 14:15
-
Is there anyway that I can export the bindiff results into a readable text (.txt) file? I can only seem to view the results through IDA GUI and .BinExports are not what I am looking for when sending reports. Jan 2, 2014 at 14:32