16

In general, BinDiff in its current version as of this writing (4.x) works by matching attributes on the function level. Basically, matching is divided into two phases: first initial matches are generated which are then refined in the drill down phase. Initial Matches First of all BinDiff associates a signature based on the following attributes to each ...


7

You can try the following steps: convert binary file to IDB: $IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT create BinExport from idb $IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc where bindiff_export.idc looks like: #include <idc.idc> static main() { Batch(0); Wait(); Exit( 1 - RunPlugin("zynamics_binexport_5", 2 )); } Should you ...


7

I can tell just a couple of words about control-flow graph building, though my answer is definitely not the full one. BinDiff uses a static type of detecting execution flows, I suppose because executing code isn't always possible (e.g. for ring 0 drivers) or reasonable (malware). Actually, the given file is disassembled, then it should be split into basic ...


4

Yes, this is now possible with Ghidra. The latest version, BinDiff 6, has experimental support for the Ghidra disassembler. It ships with an extension that allows to export Ghidra disassembly into the .BinExport format needed for diffing. Required software BinDiff 6 from the zynamics website A recent Java runtime (OpenJDK 11 or later) Ghidra 9.1.2 (https:/...


3

I've started using bindiff recently and struggle to understand matching algorithm. (...) So how the signatures differs from attributes? I think you are confusing at least 3 things: There is not a single matching algorithm but a set of matching algorithms. Or heuristics, if you prefer. There is not a single function's signature, there are multiple different ...


3

With the now free BinDiff 4.2 you can do batch analysis with a bit of work. In the BinDiff installation directory (zynamics/BinDiff 4.2), you will find bin/differ.exe and bin/differ64.exe. Those are binaries for batch diffing of IDBs and .BinExport files. The basic usage would be: differ --primary=<directory-with-IDBs> --output-dir=<output-...


2

I am not sure if a separate email got lost somewhere, but the .BinDiff file that BinDiff saves is in fact a sqlite3 database -- so the easiest way to get the results would be to use sqlite to dump the results.


2

PatchDiff2 is open-source, so you can edit it yourself to write the output to a file.


2

Zynamics replied, they said that they removed the to text functionality as it was mostly used for debugging. However the .BinDiff results are essentially an SQLite file and can be handled as one. Firefox has a plug-in to read these SQLite files found here. For linux I have found that Sqliteman works well.


2

If you're asking about using BinDiff in batch mode: sorry, you can't. It's intentionally restricted.


2

The BinDiff algorithm is a matching algorithm that can be used to classify malware.It performs structural matching using a call graph or flow control chart. By default, three attributes are used for the matching function (number of edges between blocks in the functions, number of returns in the function and the number of basic blocks that make up the ...


2

Bindiff can be a plugin in IDA or a standalone, but you still need the IDA database to compare binaries.


1

I think there is a problem with BinExport. When I used BinNavi, there was similar problem. BinExport was not compatible with my IDA version. The IDB file structure differs for each version of IDA. Access the following URL and Check which version of IDA is supported by BinExport. https://github.com/google/binexport


Only top voted, non community-wiki answers of a minimum length are eligible