IdaCompare StringDiffAuthor: David Zimmer Date: 10.04.25 - 9:19am So I am playing with something a little interesting. Comparing two binaries, i wanted to see what strings were shared. We can do a strings dump and then write some code to pull out matches, but i wanted to make it easier and maybe more useful. I added an (IDA based) strings dump to IDA JScript, and then integrated it into ida compare so just a couple clicks and its done. 
I also stumbled onto a more efficient way to view strings in IDA.
Once you have two tables in the db, you can then diff them to extract matches. Right now the match form is just a raw text dump, but I could make it connect to each IDA instance and navigate both when you click on a string. The entropy and class fields you see are an ascii specific entropy calculation. Shannon entropy works on 0-255 byte value range and is not usable for junk ascii strings. I wanted this for a while it looks like claude.ai was able to deliver. Will see how that plays out but i am hopeful! Its an interesting work flow. Being able to eliminate shit from huge string dumps incrementally is going to be valuable i think. (right now addresses are still shown in decimal that why it looks goofy. works for now ill fix it eventually) Comments: (0) |
About Me More Blogs Main Site
|
|||||||||||||||||||||||||||||||