IDACompare Updates

Author: David Zimmer
Date: 01.22.14 - 6:10am

I have been tinkering with IDACompare again a little bit. For a small utility created a decade ago in a single coding bender of a weekend, it still does a pretty good job.

Updates:

labels now included in disasm
disasm now has line breaks, indents for basic blocks
syntax highlighting of disasm
you can configure which match engine routines to use
WinMerge plugin for block level diffing
IDA integration - jump to function on item click, able to pull in decompilation results
Download: Installer, Source, Manual, Video

(click for larger image)

The WinMerge plugin is an interesting thought. I wanted a way to do block level diffing since IDACompare is a function level differ. Diffing recompiled binaries, lots of little things change like offsets of global variables, jump labels, functions etc. The Winmerge plugin will ignore all of these differences.

My first test of this is actually a really basic and aggressive filter. it reduces compares to the order and type of asm instruction while ignoring all arguments. The below screen shot is a sample of diffing the MyDoom.A/B main routines. In the screen shot below, I scrolled it to a section where there was a mismatch, so you could see it work and fail. It reduced the noise enough that you can zone right in on the new code. All the rest of the matches in the pictograph were good. You can run that sample yourself from the included example mydoom mdb.

I was able to fix this mismatch with about 5 minutes more work, check out the next post for details.

(click for larger image)

In other news, MAP has received a couple updates as well.

ShellExt: Hash Files received a directory diff mode with report
ShellExt: Hash Files, right click on title bar - Compare hash Sets added
ShellExt: Hash Files now checks for signed executables and validates them. (blue ok, red fail)
ShellExt: Hash Search form added (single and bulk modes possible)
pe_carve utility was added

SysAnalyzer has received some misc updates as well. I cant remember anything significant off the top of my head, mostly cleanups and bug fixes. The github commit log has details for those interested.

Comments: (2)

On 01.24.14 - 3:36am Dave wrote:
dont forget to manually install the 2 plw files into your IDA plugins directory after install. I will add a wizard for this soon. Thanks blarg for a bug report on the installer it has been fixed now.

Also two handy shortcut keys not yet documented. press p after clicking a function in any list to profile it/them.

If you have IDA running and the target idb open, it will navigate to functions when you click on them. Also if you have the decompiler installed, pressing d will display the decompiler results in the disasm textbox.

Note IDACompare is 32 bit only. The external compare UI should be fine, if you can populate the database on your own. I will work on adding formal support as time permits.

On 03.14.14 - 5:48am Dave wrote:
Not yet included in the installer, but in final testing in github builds, I now include 64 bit capable, (.p64 plugin file) of the plugin and exporter compiled for 32bit IDA. I was actually able to use the same VB6 activex UI for both the plw and p64. I do not have plans to create a native 64 bit exporter.

Leave Comment:

Name:

Email: (not shown)

Message: (Required)

Math Question: 42 + 8 = ? followed by the letter: W