39

Index (shortened) Gentle Intro - binary executable code, how does it look? Why it is a hard task to compare binary executable code? Conclusion Solutions TL;DR TL;DWTR (too long, don't want to read): skip ahead to the section Why it is a hard task to compare binary executable code? if you feel comfortable with the basics around assembly and disassembly. ...


29

Unless I'm mistaken, it sounds like you are looking for a binary diffing tool. Some good options are below. These all require IDA Pro. DarunGrim (open-source) BinDiff (commercial) eEye Binary Diffing Suite (use archive.org to download the installer)


18

You can also try radiff2 (Which doesn't require IDA ;)), which is a tool from the radare toolsuite. It supports delta diffing (-d), graphdiff (-g), and lots of related goodies.


11

There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a pure Python plugin for IDA Pro for doing program diffing, is the only one that can import/export structures, enumerations, etc..., the only one that makes use ...


10

Most of the problems come into play due to the fact that small changes to the source code can result in large changes to the compiled binary. In fact, no changes to the source code can still result in different binaries. Compiler optimizations will wreck your day if you want to compare binaries. The worst-case scenario is if you have two binaries compiled ...


10

Also, there is Turbodiff, it's an IDA pro plugin. Haven't used it yet, though so I can't say anything about the quality of the tool.


9

I'd recommend PatchDiff2 too, if you're using IDA Pro. Here is a description: PatchDiff2 is a plugin for the IDA dissassembler that can analyze two IDB files and find the differences between both. PatchDiff2 is free and fully integrates with the latest version of IDA (6.1) on Windows and Linux. The plugin can perform the following tasks : Display the list ...


6

You may want to give a try to ssdeep: ssdeep is a program for computing context triggered piecewise hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.


6

I'm a big fan of the kdiff route because it's quick and clean . Note: I use diffing for writing signatures on malware. Most of the time I need a simple visual of the different instructions. If you need to dig deeper go the BinDiff or DarunGrim route as mentioned by Mick. In order to use kdiff to diff the binaries you will need the disassembly output ...


4

You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit 6cfc6b4a403f8487d9fa96aa3d42db7848c8755a, which was made on February 25, one day after the most recent commit tagged 6.11 and before the most recent merge commit in 6.11. I can only speculate, but it seems likely that their local version of ...


3

Another option you could try is Relyze (Commercial, Standalone Windows desktop application) which supports binary diffing. It matches functions between two Windows binaries and gives you a list of all equal, modified, removed and added functions, along with a percentage difference value so you can see how heavily modified any two matched functions are. The ...


3

This is probably a bit further outside the normal reverse engineer's toolchest, but still a possibility. Courgette is the codename of the update mechanism behind Chromium and thus Chrome. Quote: Courgette transforms the program into the primitive assembly language and does the diffing at the assembly level: server: asm_old = disassemble(original) ...


3

Given that you're looking to compare ~500 binaries to each other, what you really want is VxClass. Unfortunately, Zynamics/Google is no longer selling VxClass. If anyone knows of a way to buy it or download it though, feel free to share the information here.


3

Here is my solution. I use radiff2 to find out all the difference between binaries. radiff2 binary1 binary2 Then xxd to convert binary into hex xxd -p final After that, wc to figure out the number of hex in one binary wc -c outputhex wc -l newlineneedtodelete Now I have the difference between two binaries and the total number of hex in each binary. ...


3

The function prototype for ?EnsureCollectionCache@CFormElement@@QAEJXZ is the same before and after the patch. It demangles to: public: long int __thiscall CFormElement::EnsureCollectionCache(void) And the calling convention for the parent function, ?DoReset@CFromElement@@QAEJH@Z, is the same before and after as well: public: long int __thiscall ...


3

With the now free BinDiff 4.2 you can do batch analysis with a bit of work. In the BinDiff installation directory (zynamics/BinDiff 4.2), you will find bin/differ.exe and bin/differ64.exe. Those are binaries for batch diffing of IDBs and .BinExport files. The basic usage would be: differ --primary=<directory-with-IDBs> --output-dir=<output-...


2

If you're asking about using BinDiff in batch mode: sorry, you can't. It's intentionally restricted.


2

The answer lays within the comments, read Binary Diffing by Nicolas A. Economou (CoreImpact) 2009 to see why. Good Binary Diffing is in fact a way harder subject that does a lot more than compare bytes or bits. Making a Binary Diff with objdump and meld is really not the way to go. Read the CoreImpact document and it will show some of the issues with ...


2

Something is wrong here, since the original push ebp; mov ebp, esp is 32 bit code, and the modified pop rax is 64 bit code. You might want to sort that out before proceeding. That said, in IDA: locate the method in the graph view, or disassembly view. The bottom line in this view will show you the load address of the current instruction as well as the ...


2

In Windows, perhaps the simplest possibility is the built-in File Compare command with its /B (binary) switch, to be used from the command-line. It lists all different bytes together with their file offset. Usage: fc /B filepath1 filepath2


2

You shouldn't use a debugger to search for differences. You should use a diff tool. Of course, most diff tools works on text, but there are some that deal with the binary files. Some examples: radiff2 HxD There are more and you probably will find one that matches exactly your need. If you would like to see your modifications in a nice visual manner with ...


2

Bindiff can be a plugin in IDA or a standalone, but you still need the IDA database to compare binaries.


2

Bloaty McBloatFace is a compiled binary size profiler that can provide a breakdown of section sizes as you have there as well as a number of other ways to break things out.


1

I'm not going to accept this answer, because likely someone else will tell me a better way to do it. But, browsing the site I saw an old picture of Radare that seemed to kind of do what I want with an S= option. This is showing the breakdown by section. That seemed like a good place to start. Turns out that's now really close to the undocumented iS= option. ...


1

I think there is a problem with BinExport. When I used BinNavi, there was similar problem. BinExport was not compatible with my IDA version. The IDB file structure differs for each version of IDA. Access the following URL and Check which version of IDA is supported by BinExport. https://github.com/google/binexport


1

I would like to see the actually files that were patched ... Old-school: Winalysis New-school: Attack Surface Analyzer ... and see what in the code might have been changed and see what the problem was. As @Neitsa said, see how can I diff two x86 binaries at assembly code level?


1

It may be because the calling convention changed from __cdecl (using the stack to receive the arguments) to __fastcall or even to a calling convention invented by the compiler (using EAX as the register holding the same information that was pushed on to the stack in the previous version).


Only top voted, non community-wiki answers of a minimum length are eligible