how can I diff two x86 binaries at assembly code level?

Question

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, but I'm looking for something that shows op-codes and arguments.

Anyone knows something that can help ?

well, You always can get listing of op-codes\arguments from disassembler and compare them as two text lists? Or even build python script for Immunity Debugger :) — Denis Laskov, Apr 21 '13 at 14:27
Why is diff/meld/kdiff/… on the disassembly not satisfactory? — Gilles 'SO- stop being evil', Apr 21 '13 at 14:27
@Mellowcandle +1 for mentioning kdiff. It's a great tool for doing a quick diff. — alexanderh, Apr 22 '13 at 02:24

score 33 · Accepted Answer · edited Apr 29 '17 at 19:36

33

Unless I'm mistaken, it sounds like you are looking for a binary diffing tool. Some good options are below. These all require IDA Pro.

DarunGrim (open-source)
BinDiff (commercial)
eEye Binary Diffing Suite (use archive.org to download the installer)

edited Apr 29 '17 at 19:36

phuclv

476
3
15

answered Apr 21 '13 at 14:47

Mick

7,562
3
26
40

Great. Exactly what I've been looking for – Mellowcandle Apr 21 '13 at 16:04
2

eEye Binary Diffing Suite is open source, and part of it is DarunGrim, according to the link you provided – Mellowcandle Apr 21 '13 at 17:16
2

might be worth mentioning that they all work on top of IDA, not stand-alone. – Igor Skochinsky Apr 22 '13 at 09:06
3

Also kind of relevant: how BinDiff works – newgre Apr 22 '13 at 17:58
1

BinDiff is now free (but still closed source) and the company has been bought by Google. – Tey' Jan 04 '21 at 20:15

score 20 · Answer 2 · answered Oct 25 '13 at 13:06

20

You can also try radiff2 (Which doesn't require IDA ;)), which is a tool from the radare toolsuite. It supports delta diffing (-d), graphdiff (-g), and lots of related goodies.

answered Oct 25 '13 at 13:06

jvoisin

2,516
16
23

score 17 · Answer 3 · answered Jun 04 '15 at 06:29

17

There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a pure Python plugin for IDA Pro for doing program diffing, is the only one that can import/export structures, enumerations, etc..., the only one that makes use of the Hex-Rays decompiler and, which is more interesting, it's maintained: the last time I committed a change was last week.

Some screenshots:

Diffing MS015-034: enter image description here

Diffing pseudo-code (MS015-050): enter image description here

Diffing MS015-050: enter image description here

answered Jun 04 '15 at 06:29

joxeankoret

4,488
2
21
35

1

Best alternative of BinDiff and works in IDA7+. – Biswapriyo Nov 04 '18 at 07:54
1

Sounds like a great tool, but why tying it up to that IDA pro? How about at least IDA Free or Ghidra? Not everyone can afford to fork over a bunch of money that they want for it. – c00000fd Aug 12 '20 at 08:48
3

Because IDA is the de-facto tool for reverse engineering, IDA Free lacks a lot of features, Ghidra doesn't support Python 3.x and also because by the time I wrote Diaphora there wasn't any public version. I have some plans to port to Ghidra, but it's a huge amount of work. Feel free to try yourself. – joxeankoret Aug 13 '20 at 09:18

score 10 · Answer 4 · edited Apr 21 '13 at 18:56

10

Also, there is Turbodiff, it's an IDA pro plugin. Haven't used it yet, though so I can't say anything about the quality of the tool.

edited Apr 21 '13 at 18:56

Mellowcandle

4,795
6
34
47

answered Apr 21 '13 at 16:25

newgre

1,183
7
18

Do you know if this works with IDA 6.x? They only list IDA 4.9 and 5.x support. – Mick Apr 21 '13 at 20:04
4

Turbodiff is abandoned and doesn't work with latest IDA. – Anton Kochkov Apr 22 '13 at 07:52
1

Please add a short description about the plugin. Link-only answers are not considered answers. – asheeshr May 07 '13 at 14:35
It's a binary diffing plugin for IDA Pro. I don't think anything of relevance is missing from this answer, no? – newgre May 07 '13 at 14:51
@newgre: is that ultimately the same as PatchDiff2? – 0xC0000022L Aug 08 '13 at 23:40

score 9 · Answer 5 · edited Nov 28 '14 at 00:04

I'd recommend PatchDiff2 too, if you're using IDA Pro.

Here is a description:

PatchDiff2 is a plugin for the IDA dissassembler that can analyze two IDB files and find the differences between both. PatchDiff2 is free and fully integrates with the latest version of IDA (6.1) on Windows and Linux. The plugin can perform the following tasks :

Display the list of identical functions
Display the list of matched functions
Display the list of unmatched functions (with the CRC)
Display a flow graph for identical and matched functions

The main purpose of this plugin is to be fast and give accurate results when working on a security patch or a hotfix. Therefore this tool is not made to find similar functions between two different programs. Patchdiff2 supports all processors that IDA can handle and is available in two versions: 32 bit and a 64 bit.

To use all you need to do is:

Unzip the two patch2diff zip and in it will be two folders holding two files for Linux and Windows just copy the patchdiff2.p64 and patchdiff2.plw to your plugins directory located in C:\Program Files\IDA Pro Directory\plugins\

Open your executables you want to be diffed and save them as .idb(default).
Open the .idb of the file (I noticed it fails when just diffing an exe) and in the IDA View-A tab go to Edit down to plugins and you should see PatchDiff2 just click on it and choose the secondary .idb you want to compare.

Warning this takes a while and IDA will become unresponsive. In the end you'll have a few tabs, Matched functions, Unmatched Functions, Identical Functions.

alexanderh · Answer 6 · 2013-10-25T15:38:34.990

I'm a big fan of the kdiff route because it's quick and clean . Note: I use diffing for writing signatures on malware. Most of the time I need a simple visual of the different instructions. If you need to dig deeper go the BinDiff or DarunGrim route as mentioned by Mick.

In order to use kdiff to diff the binaries you will need the disassembly output generate by IDA. The following script can be used to create the assembly output for all executables in the working directory.

import os 
import subprocess
import glob
paths = glob.glob("*.exe")
ida_path = os.path.join(os.environ['PROGRAMFILES'], "IDA", "idaw.exe")

for file_path in paths:
    subprocess.call([ida_path, "-B", file_path])

Execute the script.

C:\Documents and Settings\Administrator\Desktop\diff\python make-asm.py

Thank you for using IDA. Have a nice day!

C:\Documents and Settings\Administrator\Desktop\diff>dir
 Directory of C:\Documents and Settings\Administrator\Desktop\diff

10/25/2013  11:16 AM    <DIR>          .
10/25/2013  11:16 AM    <DIR>          ..
10/25/2013  11:16 AM            40,604 a.asm
10/24/2013  08:35 AM             9,938 a.exe
10/25/2013  11:16 AM           368,957 a.idb
10/25/2013  11:16 AM            40,657 b.asm
10/24/2013  08:35 AM             9,969 b.exe
10/25/2013  11:16 AM           368,957 b.idb
10/25/2013  11:15 AM               218 make-asm.py

Select the two .asm files, right click, Kdiff, Compare. Nice and simple output.

score 3 · Answer 7 · answered Jun 18 '15 at 10:01

Another option you could try is Relyze (Commercial, Standalone Windows desktop application) which supports binary diffing. It matches functions between two Windows binaries and gives you a list of all equal, modified, removed and added functions, along with a percentage difference value so you can see how heavily modified any two matched functions are.

The GUI displays the matched functions via interactive graphs so you can navigate them and see the changes. The two graphs can be synced as you navigate so clicking on an instruction in one graph will select the matched instruction, if any, in the other graph.

Binary Diffing with Relyze

That's only available with a professional license (which somehow I cannot even find purchasable on their website). — mirh, Jan 13 '23 at 17:17

score 2 · Answer 8 · answered Oct 10 '21 at 08:13

2

As an open source alternative there's elf_diff which compares elf-files and generates html or pdf reports. It's available as a Python package.

answered Oct 10 '21 at 08:13

noseglasses

21
1

It looks nice, but I didn't get it to work presumably because of this issue. – mimo31 Sep 18 '23 at 02:03

how can I diff two x86 binaries at assembly code level?

8 Answers8

Linked

Related