Questions tagged [bin-diffing]
Comparing 2 binaries at assembly code level
22
questions
1
vote
1
answer
52
views
Analyzing the difference from 2 execution flows
I'm a beginner in the reversing field, so apologize if the question is too dumb.
When analyzing binaries I always had this idea of saving somehow an execution flow so I can compare with other saved ...
- 305
1
vote
0
answers
165
views
use BinDiff to compare two chosen functions
Is it possible to use BinDiff to get the comparison score between two specific functions from the databases? By default BinDiff will automagically match functions, and then only output the comparison ...
- 111
1
vote
2
answers
1k
views
Ghidra headless + bindiff (binexport)
I am working on patch diffing using ghidra + bindiff (specifically, binexport), and am looking for advice on using bindiff with Ghidra headless.
ida_haru does essentially everything that I need, but ...
- 61
1
vote
1
answer
912
views
Alternative to BinDiff that works on Linux x86_64 binaries (and preferably does not require IDA Pro)
Is there alternative to
https://www.zynamics.com/bindiff.html
that works for Linux x86_64 binaries, works on Linux, (and preferably does not require IDA Pro, however if needed it seems that IDA can ...
1
vote
0
answers
475
views
Compare ELF files using Ghidra+Bindiff based on dwarf debug info
So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway.
I have an embedded ARM cortex-M C++ project and I ...
- 111
1
vote
1
answer
297
views
How to work on diffing result generated by bindiff
I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython.
*work is like finding no basic blocks, no of edges
- 33
1
vote
1
answer
1k
views
Compiled binary functional comparison through different versions / assembled functions
Good Day!
I've not hit upon a solution to compare different compiled binaries for identical functions.
Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 ...
- 168
8
votes
2
answers
8k
views
Do I need to have IDA Pro to use the BinDiff tool?
I'm trying to learn how to use BinDiff tool, but I can't figure out how to open two binaries to do the comparison. While skimming through their manual, it seems like I need to have IDA Pro for that.
...
- 1,639
1
vote
2
answers
95
views
Getting a high level overview of comparative size differences of binary files?
I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is ...
- 1,769
3
votes
2
answers
9k
views
Comparison between orginal and modified DLL files with x64dbg
Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?
And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
- 31
1
vote
1
answer
3k
views
BinDiff says Diff Binary does not exist
I'm using BinDiff to perform diff operation between two 32-bit Binaries (one of them is a DLL and the other one an EXE).
When I perform the Diff Operation, I get the error message:
Adding new Diff ...
- 765
2
votes
1
answer
140
views
Disassembled Java class file differs from Source
While trying to understand a behavior of TestNG I found my self disassembling the .class files. During that, I accidentally noticed that the official binary differs from the one built manually from ...
0
votes
1
answer
693
views
How to patch file by adding a branch instruction to another address in arm
I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another.
The original file has:
__text:00017B60 loc_17B60 ; ...
- 11
0
votes
1
answer
7k
views
How can I patch this file?
In viewing the diff for two files, a method in the original file starts with:
push ebp
mov ebp, esp
and in the modified file, it starts with:
push 0
pop rax
retn
endp
In essence, the ...
- 11
1
vote
1
answer
144
views
Get bindiff of operating system or modified files post upgrade [duplicate]
I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the ...
- 773
3
votes
0
answers
796
views
IDA Plugin to diff functions within the same binary
Sometimes by reversing I find several functions within the same binary file which look suspiciously similar. Is there a plugin/script to quickly compare them and see their differences?
P.S. I'm aware ...
- 1,041
2
votes
2
answers
520
views
Binary diffing: Why moving ebx to eax, instead of pushing ebx?
I was doing binary diffing, I want to know why mov eax,ebx is used instead of push ebx.
This is the binary diffing image:
Before patch :
After patch :
- 139
7
votes
4
answers
2k
views
Is there any tool to quantitatively evaluate the difference of binary?
I know some binary diff tool like VBinDiff and others.
Currently I have a large number of binary, around 500.
So I am looking for a binary tool to quantitatively evaluate the difference of binaries.....
- 2,475
6
votes
2
answers
2k
views
IDA Pro/IDAPython automation through IDAPython
I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the ...
- 495
8
votes
1
answer
1k
views
Reversing Patches (Binary Diffing)
Does any of you know of a recent tool to bindiff using ImmunityDebugger?
I know about BinDiff by Zynamics and PatchDiff for IDA. But I really want a tool like this in ImmDBG. I also know about Radare'...
- 2,321
27
votes
3
answers
4k
views
Why are special tools required to ascertain the differences between two related binary code files?
How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
- 10.9k
62
votes
8
answers
37k
views
how can I diff two x86 binaries at assembly code level?
I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
- 4,785