16

In general, BinDiff in its current version as of this writing (4.x) works by matching attributes on the function level. Basically, matching is divided into two phases: first initial matches are generated which are then refined in the drill down phase. Initial Matches First of all BinDiff associates a signature based on the following attributes to each ...


7

You can try the following steps: convert binary file to IDB: $IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT create BinExport from idb $IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc where bindiff_export.idc looks like: #include <idc.idc> static main() { Batch(0); Wait(); Exit( 1 - RunPlugin("zynamics_binexport_5", 2 )); } Should you ...


7

I can tell just a couple of words about control-flow graph building, though my answer is definitely not the full one. BinDiff uses a static type of detecting execution flows, I suppose because executing code isn't always possible (e.g. for ring 0 drivers) or reasonable (malware). Actually, the given file is disassembled, then it should be split into basic ...


3

I've started using bindiff recently and struggle to understand matching algorithm. (...) So how the signatures differs from attributes? I think you are confusing at least 3 things: There is not a single matching algorithm but a set of matching algorithms. Or heuristics, if you prefer. There is not a single function's signature, there are multiple ...


3

With the now free BinDiff 4.2 you can do batch analysis with a bit of work. In the BinDiff installation directory (zynamics/BinDiff 4.2), you will find bin/differ.exe and bin/differ64.exe. Those are binaries for batch diffing of IDBs and .BinExport files. The basic usage would be: differ --primary=<directory-with-IDBs> --output-dir=<output-...


2

If you're asking about using BinDiff in batch mode: sorry, you can't. It's intentionally restricted.


2

PatchDiff2 is open-source, so you can edit it yourself to write the output to a file.


2

Zynamics replied, they said that they removed the to text functionality as it was mostly used for debugging. However the .BinDiff results are essentially an SQLite file and can be handled as one. Firefox has a plug-in to read these SQLite files found here. For linux I have found that Sqliteman works well.


2

The BinDiff algorithm is a matching algorithm that can be used to classify malware.It performs structural matching using a call graph or flow control chart. By default, three attributes are used for the matching function (number of edges between blocks in the functions, number of returns in the function and the number of basic blocks that make up the ...


1

Bindiff can be a plugin in IDA or a standalone, but you still need the IDA database to compare binaries.


1

I think there is a problem with BinExport. When I used BinNavi, there was similar problem. BinExport was not compatible with my IDA version. The IDB file structure differs for each version of IDA. Access the following URL and Check which version of IDA is supported by BinExport. https://github.com/google/binexport


1

I am not sure if a separate email got lost somewhere, but the .BinDiff file that BinDiff saves is in fact a sqlite3 database -- so the easiest way to get the results would be to use sqlite to dump the results.


Only top voted, non community-wiki answers of a minimum length are eligible