Author: David Zimmer
Date: 01.22.14 - 6:10am
I have been tinkering with IDACompare again a little bit. For a small utility created a decade ago in a single coding bender of a weekend, it still does a pretty good job.
- labels now included in disasm
- disasm now has line breaks, indents for basic blocks
- syntax highlighting of disasm
- you can configure which match engine routines to use
- WinMerge plugin for block level diffing
- IDA integration - jump to function on item click, able to pull in decompilation results
- Download: Installer, Source, Manual, Video
(click for larger image)
The WinMerge plugin is an interesting thought. I wanted a way to do block level diffing since IDACompare is a function level differ. Diffing recompiled binaries, lots of little things change like offsets of global variables, jump labels, functions etc. The Winmerge plugin will ignore all of these differences.
My first test of this is actually a really basic and aggressive filter. it reduces compares to the order and type of asm instruction while ignoring all arguments. The below screen shot is a sample of diffing the MyDoom.A/B main routines. In the screen shot below, I scrolled it to a section where there was a mismatch, so you could see it work and fail. It reduced the noise enough that you can zone right in on the new code. All the rest of the matches in the pictograph were good. You can run that sample yourself from the included example mydoom mdb.
I was able to fix this mismatch with about 5 minutes more work, check out the next post for details.
(click for larger image)
In other news, MAP has received a couple updates as well.
SysAnalyzer has received some misc updates as well. I cant remember anything significant off the top of my head, mostly cleanups and bug fixes. The github commit log has details for those interested.
- ShellExt: Hash Files received a directory diff mode with report
- ShellExt: Hash Files, right click on title bar - Compare hash Sets added
- ShellExt: Hash Files now checks for signed executables and validates them. (blue ok, red fail)
- ShellExt: Hash Search form added (single and bulk modes possible)
- pe_carve utility was added
Comments: (2)On 01.24.14 - 3:36am Dave wrote:
|dont forget to manually install the 2 plw files into your IDA plugins directory after install. I will add a wizard for this soon. Thanks blarg for a bug report on the installer it has been fixed now.
Also two handy shortcut keys not yet documented. press p after clicking a function in any list to profile it/them.
If you have IDA running and the target idb open, it will navigate to functions when you click on them. Also if you have the decompiler installed, pressing d will display the decompiler results in the disasm textbox.
Note IDACompare is 32 bit only. The external compare UI should be fine, if you can populate the database on your own. I will work on adding formal support as time permits.
On 03.14.14 - 5:48am Dave wrote:
|Not yet included in the installer, but in final testing in github builds, I now include 64 bit capable, (.p64 plugin file) of the plugin and exporter compiled for 32bit IDA. I was actually able to use the same VB6 activex UI for both the plw and p64. I do not have plans to create a native 64 bit exporter.