Bindiff Niceity


Author: David Zimmer
Date: 01.27.25 - 7:46pm



So heres a little gem that was pointed out to me today. Bindiff results are actually saved in an sq2llite database (with the .bindiff extension.)

I was asking for an Sql Export feature and one of the devs brought this up. Awesome.

The color coding of matches fries my eyes and I hate trying to manually select the functions i want to import names for. I really wanted an automated way to select them and sql works pretty well. I will probably make my own viewer for the results with more options. In the meantime just use sqllite db browser.

Something like the following is nice:

Create table goodies as select Similarity,Confidence,Name1,Name2 from function where
Name2 like "%sub%" and Name1 not like "%sub%"
and Similarity >= 0.86 and Confidence > .8


Downside you then have to post process the results but..this is where a new ui would come in, still futzing with it, either query db to generate an idc:

Private Sub Form_Load()

	Dim cn As New Connection, rs As Recordset
	Dim db As String, x()

	db = "diff.db"
	cn.ConnectionString = ado_BuildConnectionString(db_sqllite, db)
	cn.Open

	Set rs = cn.Execute("Select * from goodies")
	While Not rs.EOF
		p = rs!name_primary
		s = rs!name_secondary
		push x, "MakeName(0x" & Replace(p, "sub_", "") & ",""" & s & "_bd"");"
		rs.MoveNext
	Wend

	rtf.Text = Join(x, vbCrLf)

End Sub


or use some ida js bullshit to merge. I do want an import mapping, a custom UI will ultimately be required.. (input file format name1 tab name2)

app.timeout = false;
tt = fso.readFile("goodies.txt").split('
')

rn = 0; def=0; nada=0;
pb.clear()
pb.max = tt.length;

for(i=0;i<tt.length;i++){
    if(tt[i].trim().length > 0){
        ttt = tt[i].split('	')
        va = '0x'+ttt[1].replace('sub_','')
        n = ida.getName(va)
        nn = ttt[0]+'_bd'
        if(n.indexOf('sub_') == 0){
            ida.setname(va,nn)
            def++;
        }else{
            if(n.replace('.','_') != nn.replace('_bd','')){
                rn++;
                t(n + " -> " + nn)
                ida.setname(va,nn)
            }else{nada++;}
        }
        pb.inc()
    }
}

pb.clear()
t(['def:', def, "rn:", rn, "nada:", nada].join(' '))





Comments: (0)

 
Leave Comment:
Name:
Email: (not shown)
Message: (Required)
Math Question: 95 + 81 = ? followed by the letter: P 



About Me
More Blogs
Main Site
Posts: (All)
2025 (1)
     Bindiff Niceity
2024 (1)
     MAP Update
2023 (4)
     Yara Workbench Automation
     VS linker versions
     IDA decompiler comments
     DispCallFunc
2022 (5)
     VB6 Implements
     VB6 Stubs BS
     VB6 TypeInfo
     VB6 VTable Layout
     Yara isPCode rule
2021 (2)
     rtcTypeName
     VB6 Gosub
2020 ( 5 )
2019 ( 6 )
2017 ( 5 )
2016 ( 4 )
2015 ( 5 )
2014 ( 5 )
2013 ( 9 )
2012 ( 13 )
2011 ( 19 )
2010 ( 11 )
2009 ( 1 )