View on GitHub

Diaphora

A Free and Open Source Program Diffing Tool

Download this project as a .zip file Download this project as a tar.gz file

Welcome!

Diaphora (διαφορά, Greek for ‘difference’) is a program diffing plugin for IDA Pro and Radare2, similar to Zynamics Bindiff or the FOSS counterparts DarunGrim, TurboDiff, etc… It was released during SyScan 2015.

It works with IDA 6.9 to 7.2. If you are looking for Radare2 support you can check this fork. Support for Binary Ninja is also planned (as soon as they finish adding support for GUI based plugins).

For more details, please check the tutorial in the “doc” directory.

As with any open source project, any form of help for this project is highly appreciated. You can submit your own patches, make feature requests, report bugs or donate to support the development of Diaphora.

Features

Diaphora has support for several unique features not available in other program diffing tools, namely:

It also supports all of the most common features that one might expect from a program diffing tool:

…and a long-long number of other features.

Getting help and asking for features

You can join the mailing list to ask for help, new features, report issues, etc… For reporting bugs, however, I recommend using the issues tracker. You can also check the Wiki that answers some of the most common questions.

Please note that only the last 3 versions of IDA are officially supported. As of today, it means that only IDA 7.0, 7.1 and 7.2 are supported. Versions 6.8, 6.9 and 6.95 do work (with all the last patches that were supplied to customers), but no official support is offered for them. However, if you run into any problem with these versions, ping me and I will do my best.

Documentation

You can take a look to the tutorial.

Screenshots

This is a screenshot of Diaphora diffing the Microsoft bulletin MS15-034:

Diaphora diffing MS15-034

These are some screenshots of Diaphora diffing the Microsoft bulletin MS15-050, extracted from the blog post Analyzing MS15-050 With Diaphora from Alex Ionescu.

Diaphora diffing MS15-050, best matches Diaphora diffing MS15-050, partial matches Diaphora diffing MS15-050, diffing pseudo-code

There is a screenshot of Diaphora diffing a LuaBot malware targeting cable modems against libLua for ARM:

Diaphora diffing a LuaBot, matches and pseudo-code

Here is a screenshot of Diaphora diffing iBoot from iOS 10.3.3 against iOS 11.0:

Diaphora diffing iBoot from iOS 10.3.3 against iOS 11.0

If you like Diaphora, you can make a donation to support the development of this project.

List of Diaphora supporters

Below are all the Diaphora supporters who generously made a donation (in no specific order):

Contact

You can contact the author, Joxean Koret, by sending an e-mail to admin AT joxeankoret DOT com.