IDACompare Updates


Author: David Zimmer
Date: 01.22.14 - 6:10am



I have been tinkering with IDACompare again a little bit. For a small utility created a decade ago in a single coding bender of a weekend, it still does a pretty good job.

Updates:
  • labels now included in disasm
  • disasm now has line breaks, indents for basic blocks
  • syntax highlighting of disasm
  • you can configure which match engine routines to use
  • WinMerge plugin for block level diffing
  • IDA integration - jump to function on item click, able to pull in decompilation results

  • Download:   Installer,      Source,   Manual,   Video



(click for larger image)


The WinMerge plugin is an interesting thought. I wanted a way to do block level diffing since IDACompare is a function level differ. Diffing recompiled binaries, lots of little things change like offsets of global variables, jump labels, functions etc. The Winmerge plugin will ignore all of these differences.

My first test of this is actually a really basic and aggressive filter. it reduces compares to the order and type of asm instruction while ignoring all arguments. The below screen shot is a sample of diffing the MyDoom.A/B main routines. In the screen shot below, I scrolled it to a section where there was a mismatch, so you could see it work and fail. It reduced the noise enough that you can zone right in on the new code. All the rest of the matches in the pictograph were good. You can run that sample yourself from the included example mydoom mdb.

I was able to fix this mismatch with about 5 minutes more work, check out the next post for details.


(click for larger image)


In other news, MAP has received a couple updates as well.
  • ShellExt: Hash Files received a directory diff mode with report
  • ShellExt: Hash Files, right click on title bar - Compare hash Sets added
  • ShellExt: Hash Files now checks for signed executables and validates them. (blue ok, red fail)
  • ShellExt: Hash Search form added (single and bulk modes possible)
  • pe_carve utility was added
SysAnalyzer has received some misc updates as well. I cant remember anything significant off the top of my head, mostly cleanups and bug fixes. The github commit log has details for those interested.




Comments: (2)

On 01.24.14 - 3:36am Dave wrote:
dont forget to manually install the 2 plw files into your IDA plugins directory after install. I will add a wizard for this soon. Thanks blarg for a bug report on the installer it has been fixed now.

Also two handy shortcut keys not yet documented. press p after clicking a function in any list to profile it/them.

If you have IDA running and the target idb open, it will navigate to functions when you click on them. Also if you have the decompiler installed, pressing d will display the decompiler results in the disasm textbox.

Note IDACompare is 32 bit only. The external compare UI should be fine, if you can populate the database on your own. I will work on adding formal support as time permits.


On 03.14.14 - 5:48am Dave wrote:
Not yet included in the installer, but in final testing in github builds, I now include 64 bit capable, (.p64 plugin file) of the plugin and exporter compiled for 32bit IDA. I was actually able to use the same VB6 activex UI for both the plw and p64. I do not have plans to create a native 64 bit exporter.

 
Leave Comment:
Name:
Email: (not shown)
Message: (Required)
 



Twitter
RSS

About Me
More Blogs
Main Site
Posts:
64bit IDA Plugins
Twitter Feed
anterior lines
misc news/updates
KANAL Mod
Decoders again
CDO.Message Breakpoints
SysAnalyzer Updates
SysAnalyzer and Site Updates
crazy decoder
ida js w/dbg
flash patching #2
JS Graphing
packet reassembly
Delphi IDA Plugin
scdbg IDA integration
API Hash Database
Winmerge plugin
IDACompare Updates
Guest Post @ hexblog
TCP Stream Reassembly
SysAnalyzer Updates
Apilogger Video
Shellcode2Exe trainer
scdbg updates
IDA Javascript w/IDE
Rop Analysis II
scdbg vrs ROP
flash patching
x64 Hooks
micro hook
jmp api+5 *2
SysAnalyzer Updates
InjDll runtime config
C# Asm/Dsm Library
Shellcode Hook Detection
Updates II
findDll
Java Hacking
Windows 8
Win7 x64
Graphing ideas
.Net Hacking
Old iDefense Releases
BootLoaders
hll shellcode
ActionScript Tips
-patch fu
scdbg ordinal lookup
scdbg -api mode
Peb Module Lists
scdbg vrs Process Injection
GetProcAddress Scanner
scdbg fopen mode
scdbg findsc mode
scdbg MemMonitor
demo shellcodes
scdbg download
api hashs redux
Api hash gen
Retro XSS Chat Codes
Exe as DLL
Olly Plugins
Debugging Explorer
Attach to hidden process
JS Refactoring
Asm and Shellcode in CSharp
Fancy Return Address
PDF Stream Dumper
Malcode Call API by Hash
WinDbg Cheat Sheet
GPG Automation