views:

280

answers:

2

Is there a way to view the difference between two binary DLL files? I have PDBs for both.

Ideally I'd like to see:

  • What functions have been added
  • What functions have been removed
  • What functions have been modified (with a diff of the disassembly)
  • What other entries (static variables, resources, etc) have been added/removed/modified


Note: this is different from this question as I am dealing with native DLLs.

A: 

Reflector should still be able to compare native DLLs. Otherwise you could probably just look at the documentation for the different versions?

erikric
Doesn't work for native DLLs. Simply gives an error about not finding the CLI header.
pauldoo
+1  A: 

If you want to compare executable files, you have a couple of alternatives:

  • Bindiff: it's a commercial extension for the commercial disassembler IDA Pro. It's a de-facto tool for reverse engineering. According to the vendor description, it allows you to:
    • Identify identical and similar functions in different binaries
    • Port function names, anterior and posterior comment lines, standard comments and local names from one disassembly to the other
    • Detect & highlight changes between two variants of the same function

http://www.zynamics.com/bindiff.html

  • You still have a free alternative: PatchDiff. As Bindiff, it's also a plugin for IDA Pro. According to the developer, Patchdiff can perform the following tasks:
    • Display the list of identical functions
    • Display the list of matched functions
    • Display the list of unmatched functions (with the CRC)
    • Display a flow graph for identical and matched functions

http://cgi.tenablesecurity.com/tenable/patchdiff.php

Francisco
IDA Pro + PatchDiff looks perfect.
pauldoo