Question

Is there a way to view the difference between two binary DLL files? I have PDBs for both.

Ideally I'd like to see:

  • What functions have been added
  • What functions have been removed
  • What functions have been modified (with a diff of the disassembly)
  • What other entries (static variables, resources, etc) have been added/removed/modified

Note: this is different from this question as I am dealing with native DLLs.

Was it helpful?

Solution

If you want to compare executable files, you have a couple of alternatives:

  • Bindiff: it's a commercial extension for the commercial disassembler IDA Pro. It's a de-facto tool for reverse engineering. According to the vendor description, it allows you to:
    • Identify identical and similar functions in different binaries
    • Port function names, anterior and posterior comment lines, standard comments and local names from one disassembly to the other
    • Detect & highlight changes between two variants of the same function

http://www.zynamics.com/bindiff.html

  • You still have a free alternative: PatchDiff. As Bindiff, it's also a plugin for IDA Pro. According to the developer, Patchdiff can perform the following tasks:
    • Display the list of identical functions
    • Display the list of matched functions
    • Display the list of unmatched functions (with the CRC)
    • Display a flow graph for identical and matched functions

http://cgi.tenablesecurity.com/tenable/patchdiff.php

OTHER TIPS

A "low tech" approach (no disassembly) would be to use DUMPBIN /ALL (or another switch, depending on what exactly you want to know) on the DLLs and do a text compare on the result.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top