View on GitHub

Diaphora

A Free and Open Source Program Diffing Tool

Download this project as a .zip file Download this project as a tar.gz file

Welcome!

Diaphora (διαφορά, Greek for ‘difference’) is a Free and Open Source program diffing tool, that integrates as a plugin for IDA Pro, similar to Zynamics Bindiff or the other FOSS counterparts DarunGrim, TurboDiff, etc… It was released during SyScan 2015.

Diaphora, in its current version, integrates with IDA Pro and exclusively works with this tool (which happens to be the de-facto reverse engineering tool). However support for Radare2 will be added in the future. For more details, please check the tutorial in the doc directory in the GitHub project page.

As with any open source project, any form of help for this project is highly appreciated. You can submit your own patches, make feature requests, report bugs or donate to support the development of Diaphora.

Getting help and asking for features

You can join the mailing list to ask for help, new features, report issues, etc… For reporting bugs, however, I recommend using the issues tracker.

Please note that, officially, only the last 2 versions of IDA will be supported. As of today, however, both 6.8, 6.9 and 6.95 are supported. Versions 6.6 and 6.7 aren’t supported any more and they are known not to work due to recent changes in IDAPython since version 6.9.

Documentation

You can take a look to the tutorial.

Screenshots

This is a screenshot of Diaphora diffing the Microsoft bulletin MS15-034:

Diaphora diffing MS15-034

These are some screenshots of Diaphora diffing the Microsoft bulletin MS15-050, extracted from the blog post Analyzing MS15-050 With Diaphora from Alex Ionescu.

Diaphora diffing MS15-050, best matches Diaphora diffing MS15-050, partial matches Diaphora diffing MS15-050, diffing pseudo-code

Why another program diffing tool?

The reasons to create one more (free and open source) program diffing tool are various, but the following are the main ones:

The tool I used the most and the one I liked the most, back in the day, was Zynamics BinDiff. However, after Google bought the company, updates to it are either too slow or non existent (you can check this issue and, my favourite, this one, where Google people tells to actually patch the binary and that, may be, they can have a real fix for the next week). Also, nobody can be sure Google is not going to finally kill the product making it exclusively a private tool (i.e., only for Google) or simply killing it because they don’t want to support it for a reason (like it killed GoogleCode or other things before).

Some months after Diaphora was released, Zynamics Bindiff was also released “for free” (as in “free beer”, freeware software) for Linux and Windows (no support for Mac OSX) but, again, without any kind of support and, also, without any warranty that it will not be killed in the future. Naturally, you’re free to use the tool that works better for you, but consider that Zynamics Bindiff doesn’t come with any kind of support and it’s unlikely they will fix the bugs you encounter or implement that feature you would love to have. Diaphora, on the other hand, is:

If you like Diaphora, you can make a donation to support the development of this project.

List of Diaphora supporters

Below are all the Diaphora supporters who generously made a donation (in no specific order):

Contact

You can contact the author, Joxean Koret, by sending an e-mail to admin AT joxeankoret DOT com.