IdaCompare StringDiff

Author: David Zimmer
Date: 10.04.25 - 9:19am

So I am playing with something a little interesting.

Comparing two binaries, i wanted to see what strings were shared. We can do a strings dump and then write some code to pull out matches, but i wanted to make it easier and maybe more useful.

I added an (IDA based) strings dump to IDA JScript, and then integrated it into ida compare so just a couple clicks and its done.

I also stumbled onto a more efficient way to view strings in IDA.

load the strings into our UI
live filter textbox in the bottom allows for:
- filter -> multiselect -> delete junk
xrefs count shown for each (sortable on column header click)
click an item, xrefs shown in the right list
IDA jumps to address on click

In this manner you can quickly carve the list down over and over until your only left with the interesting entries. You can then save them to the db.

Once you have two tables in the db, you can then diff them to extract matches.

Right now the match form is just a raw text dump, but I could make it connect to each IDA instance and navigate both when you click on a string.

The entropy and class fields you see are an ascii specific entropy calculation. Shannon entropy works on 0-255 byte value range and is not usable for junk ascii strings. I wanted this for a while it looks like claude.ai was able to deliver. Will see how that plays out but i am hopeful!

Its an interesting work flow. Being able to eliminate shit from huge string dumps incrementally is going to be valuable i think.

(right now addresses are still shown in decimal that why it looks goofy. works for now ill fix it eventually)