Diaphora: an open-source program diffing IDA plugin | Hacker News Reader

Diaphora: an open-source program diffing IDA plugin

github.com

If you need to compare (and merge) an arbitrary number of files side-by-side, I recommend diffuse https://github.com/MightyCreak/diffuse

Thanks, just today I decided that the current status of Meld (https://meldmerge.org/) was untenable for me.

It used to be a fast program, with a reasonable interface.

For a long time now its interface has been "simplifed" following GNOME 3's User Interface Guidelines, and everything ended up being hidden inside a hamburger menu.

But what definitely made it untenable was not the UX, but its tendency to crash and being really slow under the slightest load.

I was considering contributing to the project, but honestly a better engineered alternative would be welcome.

Thanks for the info (and thanks Kai Willadsen for Meld).

diffuse (and meld) are great tools for diffing text files. However, this link seems to be a binary analysis tool for diffing disassembled binaries. It is a plugin for IDA Pro, one of the foremost reverse engineering tools.

So I don't think it is in the same category as diffuse.

It's an IDA Plugin to diff binaries. Very useful for creating 1-day exploits i.e. when a vendor patches a vulnerablity, you use Diaphora to diff the vulnerable binary vs the patched one to understand what was going on, and create an exploit based off of that.

Many of Microsoft POC exploits that come out after an update are made this way.

On a related note, can anybody recommend a effective, portable, lightweight, open/free app for diffing and patching artibrary binary files (not just executables) ?

My long-time fave is JojoDiff https://jojodiff.sourceforge.net

...but I'm always curious to know what else is out there.

What would it take to add an adapter to or port Diaphora to Ghidra?

A bunch of open source Ghidra plugins, some ported from IDA: https://github.com/fr0gger/awesome-ida-x64-olly-plugin/blob/... ctrl-f 'diff', 'bindiff'

ghidra-patchdiff-correlator#how-does-it-work: https://github.com/threatrack/ghidra-patchdiff-correlator#ho...

https://ghidra.re/ghidra_docs/api/ghidra/python/PythonPlugin...

ghidra-jython-kernel + jupyter_console: https://github.com/AllsafeCyberSecurity/ghidra-jython-kernel

ghidrathon https://www.mandiant.com/resources/blog/ghidrathon-snaking-g... :

> Ghidrathon replaces the existing Python 2 extension implemented via Jython. This includes the interactive interpreter window, integration with the Ghidra Script Manager, and script execution in Ghidra headless mode. You can build and install Ghidrathon using the steps outlined in our README to start using the features described below [...]

> Alternatives: Ghidrathon is one of multiple solutions, including Ghidraal, Ghidra Bridge, and pyhidra, that enables Python 3 scripting in Ghidra. Each solution is implemented differently with accompanying benefits and limitations. We encourage you to explore all solutions and choose which best fits your needs.

I love this tool, but the AGPL license means I cannot use it at work due to company policies.

I'm sympathetic and understand the author's reasoning for relicensing it under the AGPL, but I wonder how much that holds back adoption, which is a shame considering how useful the software is.

They write that commercial licenses are available.

Is it a shame the Apple's pricing holds back adoption considering how good their product quality is [*]?

[*] Not a fanboy and not ever a user since 1995ish. Just an analogy.

Since I don't see it mentioned so far, BinDiff is an alternative: https://www.zynamics.com/bindiff.html https://www.zynamics.com/software.html

Rizin[1][2] provides basic diffing capabilities out of the box with the `rz-diff` tool. We plan to expose it in our GUI, Cutter, too, in the near future.

[1] https://rizin.re

[2] https://github.com/rizinorg/rizin

I cannot parse the title. Probably the plugin is open-source. But where does "program" belong to?

Either way, if you don't use IDA or don't even know what it really is (like myself), this is not for you.

Comments telling how (un)happy they are with meld or BeyondCompare are off-topic. This plugin is a different category.

An (open-source ((program diffing) (IDA plugin)))

I saw the name Diaphora and thought it would be the perfect name for a reddit replacement... like Diaspora and Fora (multiple forums) combined. This is pretty cool too though.

Would be very useful as a standalone tool.

I didn't try to run it to see what it would do, but FWIW it does have "I am running outside of IDA" guards, and the comments further down in the file also mention "when running outside of IDA ..." https://github.com/joxeankoret/diaphora/blob/3.0/diaphora.py...

Anyone still using Winmerge? Been using it for 10-15 years and it’s just been absolutley fantastic for my use

Using Beyond Compare.

It's a "program-diffing" tool, not a "Free-and-Open-Source-program".

The title would be less confusing if written as "Diaphora, the most advanced, Free and Open Source, program-diffing tool".

And less misleading if it disclosed that it’s only a plug-in for Interactive Disassembler.

Submitted title was "Diaphora, the most advanced Free and Open Source program diffing tool". We've attempted to make it less misleading.

not really...it is an IDA(interactive disassembler) Pro plugin

Thanks. I had no idea what “IDA” was.

Disappointing.

Wikipedia entry for IDA Pro: https://en.wikipedia.org/wiki/Interactive_Disassembler

I'm curious to know how much a license costs, I couldn't find easily on their website.

Depends what you want to do with it really.

https://www.hex-rays.com/cgi-bin/quote.cgi/products

Thanks - we've made the title say IDA plugin now.

Reply on news.ycombinator.com