6

I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the bindiff functions to compare this database with another database and output any differences to a file. Any recommendations?

3

With the now free BinDiff 4.2 you can do batch analysis with a bit of work.

In the BinDiff installation directory (zynamics/BinDiff 4.2), you will find bin/differ.exe and bin/differ64.exe. Those are binaries for batch diffing of IDBs and .BinExport files.

The basic usage would be:

differ --primary=<directory-with-IDBs> --output-dir=<output-directory>

Sadly, this does not work (at least on my machine) as differ.exe fails to find IDA's executable and tries to execute the directory instead.

To solve this, we will export IDBs using the following command:

"<path-to-idaq.exe>" -A -OExporterModule:<result-directory> -S"<path-to-export-script>" "<path-to-idb>"

The export-script is an .idc with the following code:

#include <idc.idc>

static main()
{
    Batch(0);
    Wait();
    Exit(1 - RunPlugin("zynamics_binexport_8", 2));
}

Once you have all your .BinExport files in one directory, run the original differ.exe command on that directory (give it the directory with the .BinExport files instead of the .idb files), and you'll get .BinDiff files for all possible diffs. Those can either be opened up in IDA, or manually parsed (they are SQLite databases).

2

If you're asking about using BinDiff in batch mode: sorry, you can't. It's intentionally restricted.

  • For what reason is it restricted? – Dominik Antal Dec 31 '13 at 9:15
  • VxClass, I guess. But I don't know the reason, sorry. – joxeankoret Dec 31 '13 at 9:38
  • Do you know any other software I might investigate that could be called remotely to compare two binary/BIOS files? – user3119546 Jan 2 '14 at 13:56
  • There are a lot of diffing tools (kdiff, etc...), but those are not like BinDiff. – Dominik Antal Jan 2 '14 at 14:15
  • Is there anyway that I can export the bindiff results into a readable text (.txt) file? I can only seem to view the results through IDA GUI and .BinExports are not what I am looking for when sending reports. – user3119546 Jan 2 '14 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.