Diaphora (διαφορά, Greek for ‘difference’) is a program diffing plugin for IDA Pro and Radare2, similar to Zynamics Bindiff or the FOSS counterparts DarunGrim, TurboDiff, etc… It was released during SyScan 2015.
It works with IDA 6.9 to 7.2. If you are looking for Radare2 support you can check this fork. Support for Binary Ninja is also planned (as soon as they finish adding support for GUI based plugins).
For more details, please check the tutorial in the “doc” directory.
As with any open source project, any form of help for this project is highly appreciated. You can submit your own patches, make feature requests, report bugs or donate to support the development of Diaphora.
Diaphora has support for several unique features not available in other program diffing tools, namely:
- Exporting and importing structures and enumerations.
- Exporting and importing pseudo-code comments.
- Generic matching heuristics based on the pseudo-code and its AST (Abstract Syntax Tree).
- Visually diffing pseudo-codes.
- Support for directly matching and diffing from source codes (using the, for now, independent tool Pigaios until it’s integrated into Diaphora).
It also supports all of the most common features that one might expect from a program diffing tool:
- Support for diffing patches.
- Support for exporting and import symbols (function names, prototypes, global names, etc…).
- Support for diffing assembler.
- Support for diffing control flow graphs.
- Rudimentary support for matching call graphs.
- Support for graph based heuristics.
- Support for constants based heuristics.
…and a long-long number of other features.
Getting help and asking for features
You can join the mailing list to ask for help, new features, report issues, etc… For reporting bugs, however, I recommend using the issues tracker. You can also check the Wiki that answers some of the most common questions.
Please note that only the last 3 versions of IDA are officially supported. As of today, it means that only IDA 7.0, 7.1 and 7.2 are supported. Versions 6.8, 6.9 and 6.95 do work (with all the last patches that were supplied to customers), but no official support is offered for them. However, if you run into any problem with these versions, ping me and I will do my best.
You can take a look to the tutorial.
This is a screenshot of Diaphora diffing the Microsoft bulletin MS15-034:
There is a screenshot of Diaphora diffing a LuaBot malware targeting cable modems against libLua for ARM:
Here is a screenshot of Diaphora diffing iBoot from iOS 10.3.3 against iOS 11.0:
If you like Diaphora, you can make a donation to support the development of this project.
List of Diaphora supporters
Below are all the Diaphora supporters who generously made a donation (in no specific order):
- Quynh Nguyen, author of Capstone.
- Francisco Alonso, revskills.
- Denis Laskov, it4sec.
- Pawel Wylecial, h0wlu.
- Stephen Sims, Steph3nSims.
- Grant Willcox, tekwizz123.
- Gi0, sitoiG.
- Shay Ber.
- Benedikt Schmotzle, byte_swap.
- Many people that wish to remain anonymous.
You can contact the author, Joxean Koret, by sending an e-mail to admin AT joxeankoret DOT com.