Skip to content

Commit b26f7ab

Browse files
ghostbyt3ghostbyt3
committed
Finalizing v1.0
1 parent c8a70fc commit b26f7ab

21 files changed

Lines changed: 2124 additions & 1 deletion

‎.gitignore‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# ------------------------
2+
# Python
3+
# ------------------------
4+
__pycache__/
5+
*.py[cod]
6+
*$py.class
7+
8+
# C extensions
9+
*.so
10+
11+
# Distribution / packaging
12+
.Python
13+
build/
14+
develop-eggs/
15+
dist/
16+
downloads/
17+
eggs/
18+
.eggs/
19+
lib/
20+
lib64/
21+
parts/
22+
sdist/
23+
var/
24+
wheels/
25+
share/python-wheels/
26+
*.egg-info/
27+
.installed.cfg
28+
*.egg
29+
MANIFEST
30+
31+
# Virtual environments
32+
.env
33+
.venv
34+
env/
35+
venv/
36+
ENV/
37+
env.bak/
38+
venv.bak/
39+
40+
# PyInstaller
41+
# Usually contains a manifest and spec files
42+
*.manifest
43+
*.spec
44+
45+
# Installer logs
46+
pip-log.txt
47+
pip-delete-this-directory.txt
48+
49+
# Unit test / coverage reports
50+
htmlcov/
51+
.tox/
52+
.nox/
53+
.coverage
54+
.coverage.*
55+
.cache
56+
nosetests.xml
57+
coverage.xml
58+
*.cover
59+
*.py,cover
60+
.hypothesis/
61+
.pytest_cache/
62+
63+
# Jupyter Notebook
64+
.ipynb_checkpoints
65+
*.ipynb
66+
67+
# pyenv
68+
.python-version
69+
70+
# pipenv
71+
Pipfile.lock
72+
73+
# poetry
74+
poetry.lock
75+
76+
# PDM
77+
__pypackages__/
78+
79+
# Celery
80+
celerybeat-schedule
81+
celerybeat.pid
82+
83+
# SageMath
84+
*.sage.py
85+
86+
# Environments
87+
.env
88+
.env.*
89+
venv/
90+
.venv/
91+
92+
# VS Code
93+
.vscode/
94+
95+
# PyCharm
96+
.idea/
97+
98+
# MacOS
99+
.DS_Store
100+
101+
# Windows
102+
Thumbs.db
103+
ehthumbs.db
104+
Desktop.ini
105+
106+
# Logs
107+
*.log
108+
109+
# SQLite databases
110+
*.sqlite3
111+
*.db
112+
113+
# Misc
114+
*.swp
115+
*.swo

‎README.md‎

Lines changed: 173 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,173 @@
1-
# New Main Branch
1+
<p align='center'>
2+
<img src="" width=60% >
3+
</p>
4+
5+
<!--
6+
<img align="center" src="https://img.shields.io/github/stars/pwnfuzz/DiffRays?style=for-the-badge">
7+
<img align="center" src="https://img.shields.io/github/forks/pwnfuzz/DiffRays?style=for-the-badge">
8+
-->
9+
10+
# DiffRays - IDA Pro Binary Diffing Engine
11+
12+
DiffRays is a research-oriented tool for **binary patch diffing**, designed to aid in **vulnerability research, exploit development, and reverse engineering**. It leverages **IDA Pro** and the **IDA Domain API** to extract pseudocode of functions and perform structured diffing between patched and unpatched binaries.
13+
14+
---
15+
16+
## ✨ Features
17+
18+
- 🔎 **Patch Diffing**: Compare functions across different binary versions to identify code changes.
19+
- 🧩 **IDA Pro Integration**: Uses IDA Pro and the IDA Domain API for accurate pseudocode extraction.
20+
- 📂 **SQLite Output**: Stores diff results in a SQLite database for easy reuse and analysis.
21+
- 🌐 **Web Interface**: Built-in server mode to browse, search, and visualize diff results interactively.
22+
- 📊 **Research-Ready**: Designed to support vulnerability research and exploit development workflows.
23+
24+
---
25+
26+
## 🛠️ Requirements
27+
28+
- [IDA Pro Version](https://hex-rays.com/ida-pro/)
29+
- The IDA Domain library requires IDA Pro 9.1.0 or later.
30+
- [IDA Domain API](https://github.com/HexRaysSA/ida-domain)
31+
- Python 3.8+
32+
- Additional Python dependencies
33+
34+
---
35+
36+
## ⚙️ Setup
37+
38+
1. **Clone the repository**
39+
```bash
40+
git clone https://github.com/pwnfuzz/diffrays
41+
cd diffrays
42+
```
43+
44+
2. **Install dependencies**
45+
```bash
46+
pip install .
47+
```
48+
49+
3. **Setup IDADIR environment variable to point to your IDA installation directory:**
50+
51+
```bash
52+
Windows:
53+
set IDADIR="[IDA Installation Directory]"
54+
55+
Linux:
56+
export IDADIR="[IDA Installation Directory]"
57+
```
58+
59+
---
60+
61+
## 🚀 Usage
62+
63+
Command-Line Help
64+
65+
```bash
66+
> diffrays --help
67+
68+
______ _ __ ________
69+
| _ (_)/ _|/ _| ___ \
70+
| | | |_| |_| |_| |_/ /__ _ _ _ ___
71+
| | | | | _| _| // _` | | | / __|
72+
| |/ /| | | | | | |\ \ (_| | |_| \__ \
73+
|___/ |_|_| |_| \_| \_\__,_|\__, |___/
74+
__/ |
75+
|___/ v1.0 Kappa
76+
77+
usage: diffrays [-h] {diff,server} ...
78+
79+
Binary Diff Analysis Tool - Decompile, Compare, and Visualize Binary Changes
80+
81+
positional arguments:
82+
{diff,server} Command to execute
83+
diff Analyze two binaries and generate differential database
84+
server Launch web server to view diff results
85+
86+
options:
87+
-h, --help show this help message and exit
88+
89+
Examples:
90+
diffrays diff old_binary.exe new_binary.exe
91+
diffrays diff old.so new.so -o custom_name.sqlite --log
92+
diffrays server --db-path result_old_new_20231201.sqlite --debug
93+
94+
For more information, visit: https://github.com/pwnfuzz/diffrays
95+
96+
```
97+
98+
1. **Run Patch Diffing in IDA**
99+
100+
Load your binaries in IDA and run DiffRays to generate diff results:
101+
```bash
102+
python diffrays.py diff <path_to_old_binary> <path_to_new_binary>
103+
```
104+
105+
2. **Start the DiffRays Server**
106+
107+
Once you have a .sqlite file, launch the web interface to explore the diffs:
108+
```bash
109+
python diffrays.py server --db-path diff_results.sqlite
110+
```
111+
Open your browser at http://localhost:5555 to view results.
112+
113+
---
114+
115+
## 🔬 Example Workflow - Diffing CVE-2025-29824
116+
117+
1. **Collect target binaries**
118+
- CVE-2025-1246 affects the **Common Log File System driver (`Clfs.sys`)**.
119+
- Download the two versions of the driver from Microsoft’s update packages (via WinBIndex or your preferred source):
120+
- Vulnerable build: **Clfs.sys 10.0.22621.5037** → [download here](https://msdl.microsoft.com/download/symbols/clfs.sys/4A2750956f000/clfs.sys)
121+
- Patched build: **Clfs.sys 10.0.22621.5189** → [download here](https://msdl.microsoft.com/download/symbols/clfs.sys/68C175656f000/clfs.sys)
122+
- Save them into a working directory:
123+
```bash
124+
curl -L -o clfs_10.0.22621.5037.sys https://msdl.microsoft.com/download/symbols/clfs.sys/4A2750956f000/clfs.sys
125+
curl -L -o clfs_10.0.22621.5189.sys https://msdl.microsoft.com/download/symbols/clfs.sys/68C175656f000/clfs.sys
126+
```
127+
128+
2. **Run DiffRays**
129+
```bash
130+
python diffrays.py diff clfs_10.0.22621.5037.sys clfs_10.0.22621.5189.sys
131+
```
132+
133+
3. **Start the web server**
134+
```bash
135+
python diffrays.py server --db-path clfs_diff.sqlite
136+
```
137+
138+
4. **Browse interactively**
139+
Open http://127.0.0.1:5555
140+
141+
<IMG>ADD HERE</IMG>
142+
143+
---
144+
145+
## 📖 Use Cases
146+
147+
- Researching Microsoft Patch Tuesday vulnerabilities
148+
- Identifying security fixes introduced in new software versions
149+
- Supporting exploit development by analyzing patched vs. unpatched code paths
150+
- Reverse engineering software updates
151+
152+
---
153+
154+
## 💡 Inspired By
155+
156+
DiffRays takes inspiration from prior research and tools in the binary diffing space, including:
157+
158+
- [BinDiff](https://github.com/google/bindiff) - Quickly find differences and similarities in disassembled code.
159+
- [Diaphora](https://github.com/joxeankoret/diaphoraDiaphora) - Diaphora, the most advanced Free and Open Source program diffing tool.
160+
- [Ghidriff](https://github.com/clearbluejar/ghidriff) - Python Command-Line Ghidra Binary Diffing Engine
161+
162+
---
163+
164+
## ⚠️ Disclaimer
165+
166+
This project is intended for educational and research purposes only.
167+
The author does not condone or encourage malicious use of this tool.
168+
169+
---
170+
171+
## 📜 License
172+
173+
This project is licensed under the MIT License - see the [LICENSE](https://github.com/pwnfuzz/DiffRays/blob/main/LICENSE) file for details.

‎diffrays/__init__.py‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
"""
2+
DiffRays - Binary Diff Analysis Tool
3+
Decompile, Compare, and Visualize Binary Changes
4+
"""
5+
6+
__version__ = "0.1.0"
7+
__author__ = "PwnFuzz"
8+
__license__ = "MIT"
9+
10+
from .cli import main
11+
from .server import run_server
12+
13+
# Don't import analyzer at module level
14+
run_diff = None
15+
16+
def _get_run_diff():
17+
"""Helper to get run_diff with proper error handling"""
18+
global run_diff
19+
if run_diff is None:
20+
try:
21+
from .analyzer import run_diff as rd
22+
run_diff = rd
23+
except ImportError as e:
24+
# Only show message when actually trying to use it
25+
def run_diff_stub(*args, **kwargs):
26+
print("\nIDA analysis not available")
27+
print("Required: IDA Pro with HexRays Decompiler + ida_domain package")
28+
print(f"Error: {e}")
29+
raise ImportError("IDA analysis components not available") from e
30+
run_diff = run_diff_stub
31+
return run_diff
32+
33+
# Override the run_diff name to use our lazy loader
34+
def run_diff_wrapper(*args, **kwargs):
35+
return _get_run_diff()(*args, **kwargs)
36+
37+
# Replace the None with our wrapper
38+
run_diff = run_diff_wrapper
39+
40+
__all__ = ['main', 'run_diff', 'run_server']

0 commit comments

Comments
 (0)