Diaphora (διαφορά, Greek for ‘difference’) is a Free and Open Source program diffing tool, that integrates as a plugin for IDA Pro, similar to Zynamics Bindiff or the other FOSS counterparts DarunGrim, TurboDiff, etc… It was released during SyScan 2015.
Diaphora, in its current version, integrates with IDA Pro and exclusively works with this tool (which happens to be the de-facto reverse engineering tool). However support for Radare2 will be added in the future. For more details, please check the tutorial in the doc directory in the GitHub project page.
As with any open source project, any form of help for this project is highly appreciated. You can submit your own patches, make feature requests, report bugs or donate to support the development of Diaphora.
Getting help and asking for features
Please note that, officially, only the last 2 versions of IDA will be supported. As of today, however, both 6.8, 6.9 and 6.95 are supported. Versions 6.6 and 6.7 aren’t supported any more and they are known not to work due to recent changes in IDAPython since version 6.9.
You can take a look to the tutorial.
This is a screenshot of Diaphora diffing the Microsoft bulletin MS15-034:
Why another program diffing tool?
The reasons to create one more (free and open source) program diffing tool are various, but the following are the main ones:
- We need an Open Source tool that is updated, actively maintained and easy to modify or adapt.
- The tool must do much more than what the current ones do. It must offer much more functionality than previously existing ones.
- The tool should be as deeply integrated in IDA as possible (because 99% of serious researchers use IDA as the main tool).
- The tool must not be subject to big corporation’s desires (i.e., Google).
The tool I used the most and the one I liked the most, back in the day, was Zynamics BinDiff. However, after Google bought the company, updates to it are either too slow or non existent (you can check this issue and, my favourite, this one, where Google people tells to actually patch the binary and that, may be, they can have a real fix for the next week). Also, nobody can be sure Google is not going to finally kill the product making it exclusively a private tool (i.e., only for Google) or simply killing it because they don’t want to support it for a reason (like it killed GoogleCode or other things before).
Some months after Diaphora was released, Zynamics Bindiff was also released “for free” (as in “free beer”, freeware software) for Linux and Windows (no support for Mac OSX) but, again, without any kind of support and, also, without any warranty that it will not be killed in the future. Naturally, you’re free to use the tool that works better for you, but consider that Zynamics Bindiff doesn’t come with any kind of support and it’s unlikely they will fix the bugs you encounter or implement that feature you would love to have. Diaphora, on the other hand, is:
- Actively maintained. Bugs are usually fixed in “short time” (depending on the complexity).
- Feature requests are accepted and implemented, if interesting.
- Pull requests are accepted, as long as they are interesting.
- Open source. Is the tool failing in some specific way for you or do you want to adapt it to your needs? Just clone the GIT repository and do your own changes!
If you like Diaphora, you can make a donation to support the development of this project.
List of Diaphora supporters
Below are all the Diaphora supporters who generously made a donation (in no specific order):
- Quynh Nguyen, author of Capstone.
- Francisco Alonso, revskills.
- Denis Laskov, it4sec.
- Pawel Wylecial, h0wlu.
- Stephen Sims, Steph3nSims.
- Grant Willcox, tekwizz123.
- Gi0, sitoiG.
- Shay Ber.
- Benedikt Schmotzle, byte_swap.
You can contact the author, Joxean Koret, by sending an e-mail to admin AT joxeankoret DOT com.