Bindiff Niceity

Author: David Zimmer
Date: 01.27.25 - 7:46pm

So heres a little gem that was pointed out to me today. Bindiff results are actually saved in an sq2llite database (with the .bindiff extension.)

I was asking for an Sql Export feature and one of the devs brought this up. Awesome.

The color coding of matches fries my eyes and I hate trying to manually select the functions i want to import names for. I really wanted an automated way to select them and sql works pretty well. I will probably make my own viewer for the results with more options. In the meantime just use sqllite db browser.

Something like the following is nice:

Create table goodies as select Similarity,Confidence,Name1,Name2 from function where
Name2 like "%sub%" and Name1 not like "%sub%"
and Similarity >= 0.86 and Confidence > .8

Downside you then have to post process the results but..this is where a new ui would come in, still futzing with it, either query db to generate an idc:

Private Sub Form_Load()

	Dim cn As New Connection, rs As Recordset
	Dim db As String, x()

	db = "diff.db"
	cn.ConnectionString = ado_BuildConnectionString(db_sqllite, db)
	cn.Open

	Set rs = cn.Execute("Select * from goodies")
	While Not rs.EOF
		p = rs!name_primary
		s = rs!name_secondary
		push x, "MakeName(0x" & Replace(p, "sub_", "") & ",""" & s & "_bd"");"
		rs.MoveNext
	Wend

	rtf.Text = Join(x, vbCrLf)

End Sub

or use some ida js bullshit to merge. I do want an import mapping, a custom UI will ultimately be required.. (input file format name1 tab name2)

app.timeout = false;
tt = fso.readFile("goodies.txt").split('
')

rn = 0; def=0; nada=0;
pb.clear()
pb.max = tt.length;

for(i=0;i<tt.length;i++){
    if(tt[i].trim().length > 0){
        ttt = tt[i].split('	')
        va = '0x'+ttt[1].replace('sub_','')
        n = ida.getName(va)
        nn = ttt[0]+'_bd'
        if(n.indexOf('sub_') == 0){
            ida.setname(va,nn)
            def++;
        }else{
            if(n.replace('.','_') != nn.replace('_bd','')){
                rn++;
                t(n + " -> " + nn)
                ida.setname(va,nn)
            }else{nada++;}
        }
        pb.inc()
    }
}

pb.clear()
t(['def:', def, "rn:", rn, "nada:", nada].join(' '))