Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit b26f7ab

Browse files
Finalizing v1.0
1 parent c8a70fc commit b26f7ab

File tree

21 files changed

+2124
-1
lines changed

21 files changed

+2124
-1
lines changed

‎.gitignore‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# ------------------------
2+
# Python
3+
# ------------------------
4+
__pycache__/
5+
*.py[cod]
6+
*$py.class
7+
8+
# C extensions
9+
*.so
10+
11+
# Distribution / packaging
12+
.Python
13+
build/
14+
develop-eggs/
15+
dist/
16+
downloads/
17+
eggs/
18+
.eggs/
19+
lib/
20+
lib64/
21+
parts/
22+
sdist/
23+
var/
24+
wheels/
25+
share/python-wheels/
26+
*.egg-info/
27+
.installed.cfg
28+
*.egg
29+
MANIFEST
30+
31+
# Virtual environments
32+
.env
33+
.venv
34+
env/
35+
venv/
36+
ENV/
37+
env.bak/
38+
venv.bak/
39+
40+
# PyInstaller
41+
# Usually contains a manifest and spec files
42+
*.manifest
43+
*.spec
44+
45+
# Installer logs
46+
pip-log.txt
47+
pip-delete-this-directory.txt
48+
49+
# Unit test / coverage reports
50+
htmlcov/
51+
.tox/
52+
.nox/
53+
.coverage
54+
.coverage.*
55+
.cache
56+
nosetests.xml
57+
coverage.xml
58+
*.cover
59+
*.py,cover
60+
.hypothesis/
61+
.pytest_cache/
62+
63+
# Jupyter Notebook
64+
.ipynb_checkpoints
65+
*.ipynb
66+
67+
# pyenv
68+
.python-version
69+
70+
# pipenv
71+
Pipfile.lock
72+
73+
# poetry
74+
poetry.lock
75+
76+
# PDM
77+
__pypackages__/
78+
79+
# Celery
80+
celerybeat-schedule
81+
celerybeat.pid
82+
83+
# SageMath
84+
*.sage.py
85+
86+
# Environments
87+
.env
88+
.env.*
89+
venv/
90+
.venv/
91+
92+
# VS Code
93+
.vscode/
94+
95+
# PyCharm
96+
.idea/
97+
98+
# MacOS
99+
.DS_Store
100+
101+
# Windows
102+
Thumbs.db
103+
ehthumbs.db
104+
Desktop.ini
105+
106+
# Logs
107+
*.log
108+
109+
# SQLite databases
110+
*.sqlite3
111+
*.db
112+
113+
# Misc
114+
*.swp
115+
*.swo

‎README.md‎

Lines changed: 173 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,173 @@
1-
# New Main Branch
1+
<p align='center'>
2+
<img src="" width=60% >
3+
</p>
4+
5+
<!--
6+
<img align="center" src="https://img.shields.io/github/stars/pwnfuzz/DiffRays?style=for-the-badge">
7+
<img align="center" src="https://img.shields.io/github/forks/pwnfuzz/DiffRays?style=for-the-badge">
8+
-->
9+
10+
# DiffRays - IDA Pro Binary Diffing Engine
11+
12+
DiffRays is a research-oriented tool for **binary patch diffing**, designed to aid in **vulnerability research, exploit development, and reverse engineering**. It leverages **IDA Pro** and the **IDA Domain API** to extract pseudocode of functions and perform structured diffing between patched and unpatched binaries.
13+
14+
---
15+
16+
## ✨ Features
17+
18+
- 🔎 **Patch Diffing**: Compare functions across different binary versions to identify code changes.
19+
- 🧩 **IDA Pro Integration**: Uses IDA Pro and the IDA Domain API for accurate pseudocode extraction.
20+
- 📂 **SQLite Output**: Stores diff results in a SQLite database for easy reuse and analysis.
21+
- 🌐 **Web Interface**: Built-in server mode to browse, search, and visualize diff results interactively.
22+
- 📊 **Research-Ready**: Designed to support vulnerability research and exploit development workflows.
23+
24+
---
25+
26+
## 🛠️ Requirements
27+
28+
- [IDA Pro Version](https://hex-rays.com/ida-pro/)
29+
- The IDA Domain library requires IDA Pro 9.1.0 or later.
30+
- [IDA Domain API](https://github.com/HexRaysSA/ida-domain)
31+
- Python 3.8+
32+
- Additional Python dependencies
33+
34+
---
35+
36+
## ⚙️ Setup
37+
38+
1. **Clone the repository**
39+
```bash
40+
git clone https://github.com/pwnfuzz/diffrays
41+
cd diffrays
42+
```
43+
44+
2. **Install dependencies**
45+
```bash
46+
pip install .
47+
```
48+
49+
3. **Setup IDADIR environment variable to point to your IDA installation directory:**
50+
51+
```bash
52+
Windows:
53+
set IDADIR="[IDA Installation Directory]"
54+
55+
Linux:
56+
export IDADIR="[IDA Installation Directory]"
57+
```
58+
59+
---
60+
61+
## 🚀 Usage
62+
63+
Command-Line Help
64+
65+
```bash
66+
> diffrays --help
67+
68+
______ _ __ ________
69+
| _ (_)/ _|/ _| ___ \
70+
| | | |_| |_| |_| |_/ /__ _ _ _ ___
71+
| | | | | _| _| // _` | | | / __|
72+
| |/ /| | | | | | |\ \ (_| | |_| \__ \
73+
|___/ |_|_| |_| \_| \_\__,_|\__, |___/
74+
__/ |
75+
|___/ v1.0 Kappa
76+
77+
usage: diffrays [-h] {diff,server} ...
78+
79+
Binary Diff Analysis Tool - Decompile, Compare, and Visualize Binary Changes
80+
81+
positional arguments:
82+
{diff,server} Command to execute
83+
diff Analyze two binaries and generate differential database
84+
server Launch web server to view diff results
85+
86+
options:
87+
-h, --help show this help message and exit
88+
89+
Examples:
90+
diffrays diff old_binary.exe new_binary.exe
91+
diffrays diff old.so new.so -o custom_name.sqlite --log
92+
diffrays server --db-path result_old_new_20231201.sqlite --debug
93+
94+
For more information, visit: https://github.com/pwnfuzz/diffrays
95+
96+
```
97+
98+
1. **Run Patch Diffing in IDA**
99+
100+
Load your binaries in IDA and run DiffRays to generate diff results:
101+
```bash
102+
python diffrays.py diff <path_to_old_binary> <path_to_new_binary>
103+
```
104+
105+
2. **Start the DiffRays Server**
106+
107+
Once you have a .sqlite file, launch the web interface to explore the diffs:
108+
```bash
109+
python diffrays.py server --db-path diff_results.sqlite
110+
```
111+
Open your browser at http://localhost:5555 to view results.
112+
113+
---
114+
115+
## 🔬 Example Workflow - Diffing CVE-2025-29824
116+
117+
1. **Collect target binaries**
118+
- CVE-2025-1246 affects the **Common Log File System driver (`Clfs.sys`)**.
119+
- Download the two versions of the driver from Microsoft’s update packages (via WinBIndex or your preferred source):
120+
- Vulnerable build: **Clfs.sys 10.0.22621.5037** → [download here](https://msdl.microsoft.com/download/symbols/clfs.sys/4A2750956f000/clfs.sys)
121+
- Patched build: **Clfs.sys 10.0.22621.5189** → [download here](https://msdl.microsoft.com/download/symbols/clfs.sys/68C175656f000/clfs.sys)
122+
- Save them into a working directory:
123+
```bash
124+
curl -L -o clfs_10.0.22621.5037.sys https://msdl.microsoft.com/download/symbols/clfs.sys/4A2750956f000/clfs.sys
125+
curl -L -o clfs_10.0.22621.5189.sys https://msdl.microsoft.com/download/symbols/clfs.sys/68C175656f000/clfs.sys
126+
```
127+
128+
2. **Run DiffRays**
129+
```bash
130+
python diffrays.py diff clfs_10.0.22621.5037.sys clfs_10.0.22621.5189.sys
131+
```
132+
133+
3. **Start the web server**
134+
```bash
135+
python diffrays.py server --db-path clfs_diff.sqlite
136+
```
137+
138+
4. **Browse interactively**
139+
Open http://127.0.0.1:5555
140+
141+
<IMG>ADD HERE</IMG>
142+
143+
---
144+
145+
## 📖 Use Cases
146+
147+
- Researching Microsoft Patch Tuesday vulnerabilities
148+
- Identifying security fixes introduced in new software versions
149+
- Supporting exploit development by analyzing patched vs. unpatched code paths
150+
- Reverse engineering software updates
151+
152+
---
153+
154+
## 💡 Inspired By
155+
156+
DiffRays takes inspiration from prior research and tools in the binary diffing space, including:
157+
158+
- [BinDiff](https://github.com/google/bindiff) - Quickly find differences and similarities in disassembled code.
159+
- [Diaphora](https://github.com/joxeankoret/diaphoraDiaphora) - Diaphora, the most advanced Free and Open Source program diffing tool.
160+
- [Ghidriff](https://github.com/clearbluejar/ghidriff) - Python Command-Line Ghidra Binary Diffing Engine
161+
162+
---
163+
164+
## ⚠️ Disclaimer
165+
166+
This project is intended for educational and research purposes only.
167+
The author does not condone or encourage malicious use of this tool.
168+
169+
---
170+
171+
## 📜 License
172+
173+
This project is licensed under the MIT License - see the [LICENSE](https://github.com/pwnfuzz/DiffRays/blob/main/LICENSE) file for details.

‎diffrays/__init__.py‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
"""
2+
DiffRays - Binary Diff Analysis Tool
3+
Decompile, Compare, and Visualize Binary Changes
4+
"""
5+
6+
__version__ = "0.1.0"
7+
__author__ = "PwnFuzz"
8+
__license__ = "MIT"
9+
10+
from .cli import main
11+
from .server import run_server
12+
13+
# Don't import analyzer at module level
14+
run_diff = None
15+
16+
def _get_run_diff():
17+
"""Helper to get run_diff with proper error handling"""
18+
global run_diff
19+
if run_diff is None:
20+
try:
21+
from .analyzer import run_diff as rd
22+
run_diff = rd
23+
except ImportError as e:
24+
# Only show message when actually trying to use it
25+
def run_diff_stub(*args, **kwargs):
26+
print("\nIDA analysis not available")
27+
print("Required: IDA Pro with HexRays Decompiler + ida_domain package")
28+
print(f"Error: {e}")
29+
raise ImportError("IDA analysis components not available") from e
30+
run_diff = run_diff_stub
31+
return run_diff
32+
33+
# Override the run_diff name to use our lazy loader
34+
def run_diff_wrapper(*args, **kwargs):
35+
return _get_run_diff()(*args, **kwargs)
36+
37+
# Replace the None with our wrapper
38+
run_diff = run_diff_wrapper
39+
40+
__all__ = ['main', 'run_diff', 'run_server']

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /