Package: ghidriff
Ghidriff - Ghidra Binary Diffing Engineghidriffprovides a command-line binary diffing capability with a fresh take on diffing workflow and results.It leverages the power of Ghidra's ProgramAPI andFlatProgramAPIto find theadded,deleted, andmodifiedfunctions of two arbitrary binaries. It is written in Python3 usingpyhidrato orchestrate Ghidra andjpypeas the Python to Java interface to Ghidra.Its primary use case is patch diffing. Its ability to perform a patch diff with a single command makes it ideal for automated analysis. The diffing results are stored in JSON and rendered in markdown (optionally side-by-side HTML). The markdown output promotes "social" diffing, as results are easy to publish in a gist or include in your next writeup or blog post.High Levelflowchart LR

a(old binary - rpcrt4.dll-v1) --> b[GhidraDiffEngine]
c(new binary - rpcrt4.dll-v2) --> b

b --> e(Ghidra Project Files)
b --> diffs_output_dir

subgraph diffs_output_dir
    direction LR
    i(rpcrt4.dll-v1-v2.diff.md)
    h(rpcrt4.dll-v1-v2.diff.json)
    j(rpcrt4.dll-v1-v2.diff.side-by-side.html)
endSample DiffsFeaturesCommand Line (patch diffing workflow reduced to a single step)Highlights important changes in the TOCFast - Can diff the full Windows kernel in less than a minute (after Ghidra analysis is complete)Enables Social DiffingBeautiful Markdown OutputEasily hosted in a GitHub or GitLab gist, blog, or anywhere markdown is supportedVisual Diff Graph ResultsSupports both unified and side by side diff results (unified is default)Provides unique Meta Diffs:Binary StringsCalledCallingBinary MetadataBatteries IncludedDocker supportAutomated TestingGhidra (No license required)See below forCVE diffs and sample usageDesign GoalsFind all added, deleted, and modified functionsProvide foundation for automationSimple, Fast, AccurateResilientExtendableEasy sharing of resultsSocial DiffingPowered by GhidraThe heavy lifting of the binary analysis is done by Ghidra and the diffing is possible via Ghidra's Program API.ghidriffprovides a diffingworkflow, function matching, and resulting markdown and HTML diff output.Docsghidriff official DocsBlog PostEngineAn "engine" is a self-contained, but externally-controllable, piece of code that encapsulates powerful logic designed to perform a specific type of work.ghidriffprovides a core base classGhidraDiffEnginethat can be extended to create your own binary diffingimplementations.The base class implements the first 3 steps of the Ghidraheadless workflow:Create Ghidra Project- Directory and collection of Ghidra project files and dataImport Binary to project- Import one or more binaries to the project for analysisAnalyze Binary- Ghidra will perform default binary analysis on each binaryThe base class provides the abstract methodfind_matcheswhere the actual diffing (function matching) takes place.Extending ghidriffghidriffcan be used as is, but it offers developers the ability to extend the tool by implementing their own differ. The basic idea is create new diffing tools by implementing thefind_matchesmethod from the base class.classNewDiffTool(GhidraDiffEngine):def__init__(self,verbose=False)->None:super().__init__(verbose)@abstractmethoddeffind_matches(self,old:Union[str,pathlib.Path],new:Union[str,pathlib.Path])->dict:"""My amazing differ"""# find added, deleted, and modified functions# <code goes here>return[unmatched,matched]ImplementationsThere are currently 3 diffing implementations, which also display the evolution of diffing for the project.SimpleDiff- A simple diff implementation. "Simple" as in it relies mostly on known symbol names for matching.StructualGraphDiff- A slightly more advanced differ, beginning to perform some more advanced hashing (such as Halvar's Structural Graph Comparison)VersionTrackingDiff- The latest differ, with severalcorrelators(an algorithm used to score specific associations based on code, program flow, or any observable aspect of comparison) for function matching.This one is fast.Each implementation leverages the base class, and implementsfind_changes.Usageusage:ghidriff[-h][--engine{SimpleDiff,StructualGraphDiff,VersionTrackingDiff}][-oOUTPUT_PATH][--summarySUMMARY][-pPROJECT_LOCATION][-nPROJECT_NAME][-sSYMBOLS_PATH][--threaded|--no-threaded][--force-analysis][--force-diff][--no-symbols][--log-level{CRITICAL,FATAL,ERROR,WARN,WARNING,INFO,DEBUG,NOTSET}][--file-log-level{CRITICAL,FATAL,ERROR,WARN,WARNING,INFO,DEBUG,NOTSET}][--log-pathLOG_PATH][--va][--min-func-lenMIN_FUNC_LEN][--use-calling-countsUSE_CALLING_COUNTS][--max-ram-percentMAX_RAM_PERCENT][--print-flags][--jvm-args[JVM_ARGS]][--sxs][--max-section-funcsMAX_SECTION_FUNCS][--md-titleMD_TITLE]oldnew[new...]ghidriff-ACommandLineGhidraBinaryDiffingEngine

positionalarguments:oldPathtooldversionofbinary'/somewhere/bin.old'newPathtonewversionofbinary'/somewhere/bin.new'.(Formultiplenewbinariesaddoldesttonewest)options:-h,--helpshowthishelpmessageandexit--engine{SimpleDiff,StructualGraphDiff,VersionTrackingDiff}Thediffimplementationtouse.(default:VersionTrackingDiff)-oOUTPUT_PATH,--output-pathOUTPUT_PATHOutputpathforresultingdiffs(default:ghidriffs)--summarySUMMARYAddasummarydiffifmorethantwobinsareprovided(default:False)Extendend UsageThere are quite a few options here, and some complexity. Generally you can succeed with the defaults, but you can override the defaults as needed. One example might be to increase the JVM RAM used to run Ghidra to enable faster analysis of large binaries (--max-ram-percent 80). See help for details of other options.Show Extended UsageGhidraProjectOptions:-pPROJECT_LOCATION,--project-locationPROJECT_LOCATIONGhidraProjectPath(default:ghidra_projects)-nPROJECT_NAME,--project-namePROJECT_NAMEGhidraProjectName(default:ghidriff)-sSYMBOLS_PATH,--symbols-pathSYMBOLS_PATHGhidralocalsymbolstoredirectory(default:symbols)EngineOptions:--threaded,--no-threadedUsethreadingduringimport,analysis,anddiffing.Recommended(default:True)--force-analysisForceanewbinaryanalysiseachrun(slow)(default:False)--force-diffForcebinarydiff(ignorearch/symbolsmismatch)(default:False)--no-symbolsTurnoffsymbolsforanalysis(default:False)--log-level{CRITICAL,FATAL,ERROR,WARN,WARNING,INFO,DEBUG,NOTSET}Setconsoleloglevel(default:INFO)--file-log-level{CRITICAL,FATAL,ERROR,WARN,WARNING,INFO,DEBUG,NOTSET}Setlogfilelevel(default:INFO)--log-pathLOG_PATHSetghidrifflogpath.(default:ghidriff.log)--va,--verbose-analysisVerboseloggingforanalysisstep.(default:False)--min-func-lenMIN_FUNC_LENMinimumfunctionlengthtoconsiderfordiff(default:10)--use-calling-countsUSE_CALLING_COUNTSAddcalling/calledreferencecounts(default:True)JVMOptions:--max-ram-percentMAX_RAM_PERCENTSetJVMMaxRam%ofhostRAM(default:60.0)--print-flagsPrintJVMflagsatstart(default:False)--jvm-args[JVM_ARGS]JVMargstoaddatstart(default:None)MarkdownOptions:--sxsIncludesidebysidecodediff(default:False)--max-section-funcsMAX_SECTION_FUNCSMaxnumberoffunctionstodisplaypersection.(default:200)--md-titleMD_TITLEOverwritedefaulttitleformarkdowndiff(default:None)Quick Start Environment SetupDownloadandinstall Ghidra.Set Ghidra Environment VariableGHIDRA_INSTALL_DIRto Ghidra install location.Pip installghidriffWindowsPSC:\Users\user>[System.Environment]::SetEnvironmentVariable('GHIDRA_INSTALL_DIR','C:\ghidra_10.2.3_PUBLIC_20230208\ghidra_10.2.3_PUBLIC')PSC:\Users\user>pipinstallghidriffLinux / MacexportGHIDRA_INSTALL_DIR="/path/to/ghidra/"pipinstallghidriffGhidriff in a BoxDon't want to install Ghidra and Java on your host? Try "Ghidriff in a box". It supports multiple-platforms (x64 and arm64).Dockerdocker pull ghcr.io/clearbluejar/ghidriff:latestThis is a docker container with the latestPyPi version of Ghidriffinstalled. You can check the latest containerhere.For Docker command-line diffingYou will need to map the binaries you want to compare into the container. See below for an example.mkdir-pghidriffs
wgethttps://msdl.microsoft.com/download/symbols/clfs.sys/9848245C6f000/clfs.sys-Oghidriffs/clfs.sys.x64.10.0.22621.2506
wgethttps://msdl.microsoft.com/download/symbols/clfs.sys/D929C6E56f000/clfs.sys-Oghidriffs/clfs.sys.x64.10.0.22621.2715
dockerrun-it--rm-v$(pwd)/ghidriffs:/ghidriffsghcr.io/clearbluejar/ghidriff:latestghidriffs/clfs.sys.x64.10.0.22621.2506ghidriffs/clfs.sys.x64.10.0.22621.2715The result will produce the following.treeghidriffs
ghidriffs
├──clfs.sys.x64.10.0.22621.2506
├──clfs.sys.x64.10.0.22621.2506-clfs.sys.x64.10.0.22621.2715.ghidriff.md
├──clfs.sys.x64.10.0.22621.2715
├──ghidra_projects
│└──ghidriff-clfs.sys.x64.10.0.22621.2506-clfs.sys.x64.10.0.22621.2715
│├──ghidriff-clfs.sys.x64.10.0.22621.2506-clfs.sys.x64.10.0.22621.2715.gpr
│├──ghidriff-clfs.sys.x64.10.0.22621.2506-clfs.sys.x64.10.0.22621.2715.lock
│└──ghidriff-clfs.sys.x64.10.0.22621.2506-clfs.sys.x64.10.0.22621.2715.rep
├──ghidriff.log
├──json
│└──clfs.sys.x64.10.0.22621.2506-clfs.sys.x64.10.0.22621.2715.ghidriff.json
└──symbols├──000admin├──clfs.pdb│├──6EAE8987F981603FEFA0E55DE0CE2C521││└──clfs.pdb│└──E3D1FEA241ECEC3DC6DB2B278A22A6A31│└──clfs.pdb└──pingme.txtDevcontainer - For Ghidriff developmentUse the.devcontainerin this repo. If you don't know how, follow the detailed instructions here:ghidra-python-vscode-devcontainer-skeleton quick setup.Use CasesDiffing a full Windows KernelDownload two versions of the kernel (older and latest binary):wgethttps://msdl.microsoft.com/download/symbols/ntoskrnl.exe/F7E31BA91047000/ntoskrnl.exe-Ontoskrnl.exe.10.0.22621.1344
wgethttps://msdl.microsoft.com/download/symbols/ntoskrnl.exe/17B6B7221047000/ntoskrnl.exe-Ontoskrnl.exe.10.0.22621.1413Console Output:vscode ➜ /workspaces/ghidriff (main) $ wget https://msdl.microsoft.com/download/symbols/ntoskrnl.exe/F7E31BA91047000/ntoskrnl.exe -O ntoskrnl.exe.10.0.22621.1344--2023-05-17 03:18:40--  https://msdl.microsoft.com/download/symbols/ntoskrnl.exe/F7E31BA91047000/ntoskrnl.exeResolving msdl.microsoft.com (msdl.microsoft.com)... 204.79.197.219Connecting to msdl.microsoft.com (msdl.microsoft.com)|204.79.197.219|:443... connected.HTTP request sent, awaiting response... 302 FoundCould not parse String-Transport-Security headerLocation: https://vsblobprodscussu5shard72.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/8BFC691F50434EC2DC87BBDFC06A6A5FBACE992E60062F9C8CE829F58E3BCFB300.blob?sv=2019-07-07&sr=b&si=1&sig=Kgrvf90Kc15ac%2FtHsgPPj9ztxxTfkQ0yHGQh8dLDwQs%3D&spr=https&se=2023-05-18T03%3A32%3A47Z&rscl=x-e2eid-420cea82-598a4a00-a990abf8-919be2ff-session-5e9eb5eb-195146cb-b123c222-30eef52e [following]--2023-05-17 03:18:40--  https://vsblobprodscussu5shard72.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/8BFC691F50434EC2DC87BBDFC06A6A5FBACE992E60062F9C8CE829F58E3BCFB300.blob?sv=2019-07-07&sr=b&si=1&sig=Kgrvf90Kc15ac%2FtHsgPPj9ztxxTfkQ0yHGQh8dLDwQs%3D&spr=https&se=2023-05-18T03%3A32%3A47Z&rscl=x-e2eid-420cea82-598a4a00-a990abf8-919be2ff-session-5e9eb5eb-195146cb-b123c222-30eef52eResolving vsblobprodscussu5shard72.blob.core.windows.net (vsblobprodscussu5shard72.blob.core.windows.net)... 20.209.34.36Connecting to vsblobprodscussu5shard72.blob.core.windows.net (vsblobprodscussu5shard72.blob.core.windows.net)|20.209.34.36|:443... connected.HTTP request sent, awaiting response... 200 OKLength: 11990400 (11M) [application/octet-stream]Saving to: ‘ntoskrnl.exe.10.0.22621.1344’ntoskrnl.exe.10.0.22621.1344                       100%[===============================================================================================================>]  11.43M  2.47MB/s    in 5.5s2023-05-17 03:18:46 (2.08 MB/s) - ‘ntoskrnl.exe.10.0.22621.1344’ saved [11990400/11990400]vscode ➜ /workspaces/ghidriff (main) $ wget https://msdl.microsoft.com/download/symbols/ntoskrnl.exe/17B6B7221047000/ntoskrnl.exe -O ntoskrnl.exe.10.0.22621.1413--2023-05-17 03:18:58--  https://msdl.microsoft.com/download/symbols/ntoskrnl.exe/17B6B7221047000/ntoskrnl.exeResolving msdl.microsoft.com (msdl.microsoft.com)... 204.79.197.219Connecting to msdl.microsoft.com (msdl.microsoft.com)|204.79.197.219|:443... connected.HTTP request sent, awaiting response... 302 FoundCould not parse String-Transport-Security headerLocation: https://vsblobprodscussu5shard75.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/D946523F2726056CD289008C977D02C0C0FBBCBB89D9FA40ADBB42CDE8D5022A00.blob?sv=2019-07-07&sr=b&si=1&sig=KfYz9cB7cUPO9JVo0U8eIj0etpASEWOyvCv5NkwVkfw%3D&spr=https&se=2023-05-18T03%3A50%3A53Z&rscl=x-e2eid-4960dee3-47d94aa4-a2207913-b73825a4-session-2879fa10-75774ef4-93e39015-3be72abb [following]--2023-05-17 03:18:59--  https://vsblobprodscussu5shard75.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/D946523F2726056CD289008C977D02C0C0FBBCBB89D9FA40ADBB42CDE8D5022A00.blob?sv=2019-07-07&sr=b&si=1&sig=KfYz9cB7cUPO9JVo0U8eIj0etpASEWOyvCv5NkwVkfw%3D&spr=https&se=2023-05-18T03%3A50%3A53Z&rscl=x-e2eid-4960dee3-47d94aa4-a2207913-b73825a4-session-2879fa10-75774ef4-93e39015-3be72abbResolving vsblobprodscussu5shard75.blob.core.windows.net (vsblobprodscussu5shard75.blob.core.windows.net)... 20.209.34.36Connecting to vsblobprodscussu5shard75.blob.core.windows.net (vsblobprodscussu5shard75.blob.core.windows.net)|20.209.34.36|:443... connected.HTTP request sent, awaiting response... 200 OKLength: 11990336 (11M) [application/octet-stream]Saving to: ‘ntoskrnl.exe.10.0.22621.1413’ntoskrnl.exe.10.0.22621.1413                       100%[===============================================================================================================>]  11.43M  1.02MB/s    in 12s2023-05-17 03:19:11 (1004 KB/s) - ‘ntoskrnl.exe.10.0.22621.1413’ saved [11990336/11990336]Run ghidriff:ghidriffntoskrnl.exe.10.0.22621.1344ntoskrnl.exe.10.0.22621.1413Console Output(.env)vscode ➜ /workspaces/ghidriff (main) $ ghidriff ntoskrnl.exe.10.0.22621.1344 ntoskrnl.exe.10.0.22621.1413INFO | ghidriff | Init Ghidra Diff Engine...INFO | ghidriff | Engine Console Log: INFOINFO | ghidriff | Engine File Log:  .ghidriffs/ghidriff.log INFOINFO | ghidriff | Starting Ghidra...INFO  Using log config file: jar:file:/ghidra/Ghidra/Framework/Generic/lib/Generic.jar!/generic.log4j.xml (LoggingInitialization)INFO  Using log file: /workspaces/ghidriff/.ghidriffs/ghidriff.log (LoggingInitialization)INFO  Loading user preferences: /home/vscode/.ghidra/.ghidra_10.2.3_PUBLIC/preferences (Preferences)INFO  Class search complete (716 ms) (ClassSearcher)INFO  Initializing SSL Context (SSLContextInitializer)INFO  Initializing Random Number Generator... (SecureRandomFactory)INFO  Random Number Generator initialization complete: NativePRNGNonBlocking (SecureRandomFactory)INFO  Trust manager disabled, cacerts have not been set (ApplicationTrustManagerFactory)INFO | ghidriff | GHIDRA_INSTALL_DIR: /ghidraINFO | ghidriff | GHIDRA 10.2.3  Build Date: 2023-Feb-08 1242 EST Release: PUBLICINFO | ghidriff | Engine Args:INFO | ghidriff |       old:                ['ntoskrnl.exe.10.0.22621.1344']INFO | ghidriff |       new:                [['ntoskrnl.exe.10.0.22621.1413']]INFO | ghidriff |       engine:             VersionTrackingDiffINFO | ghidriff |       output_path:        .ghidriffsINFO | ghidriff |       summary:            FalseINFO | ghidriff |       project_location:   .ghidra_projectsINFO | ghidriff |       project_name:       ghidriffINFO | ghidriff |       symbols_path:       .symbolsINFO | ghidriff |       threaded:           TrueINFO | ghidriff |       force_analysis:     FalseINFO | ghidriff |       force_diff:         FalseINFO | ghidriff |       no_symbols:         FalseINFO | ghidriff |       log_level:          INFOINFO | ghidriff |       file_log_level:     INFOINFO | ghidriff |       log_path:           ghidriff.logINFO | ghidriff |       va:                 FalseINFO | ghidriff |       max_ram_percent:    60.0INFO | ghidriff |       print_flags:        FalseINFO | ghidriff |       jvm_args:           NoneINFO | ghidriff |       side_by_side:       FalseINFO | ghidriff |       max_section_funcs:  200INFO | ghidriff |       md_title:           NoneINFO | ghidriff | Setting Up Ghidra Project...INFO  Creating project: /workspaces/ghidriff/.ghidra_projects/ghidriff-ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413/ghidriff-ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413 (DefaultProject)INFO | ghidriff | Created project: ghidriff-ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413INFO | ghidriff | Project Location: /workspaces/ghidriff/.ghidra_projects/ghidriff-ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413INFO | ghidriff | Importing ntoskrnl.exe.10.0.22621.1344INFO  Starting cache cleanup: /tmp/vscode-Ghidra/fscache2 (FileCacheMaintenanceDaemon)INFO  Finished cache cleanup, estimated storage used: 0 (FileCacheMaintenanceDaemon)INFO  Using Loader: Portable Executable (PE) (AutoImporter)INFO | ghidriff | Importing ntoskrnl.exe.10.0.22621.1413INFO  Using Loader: Portable Executable (PE) (AutoImporter)INFO | ghidriff | Setting up Symbol Server for symbols...INFO | ghidriff | path: .symbols level: 1INFO | ghidriff | Symbol Server Configured path: SymbolServerService:symbolStore: LocalSymbolStore: [ rootDir: /workspaces/ghidriff/.symbols, storageLevel: -1],symbolServers:HttpSymbolServer: [ url: https://msdl.microsoft.com/download/symbols/, storageLevel: -1]HttpSymbolServer: [ url: https://chromium-browser-symsrv.commondatastorage.googleapis.com/, storageLevel: -1]HttpSymbolServer: [ url: https://symbols.mozilla.org/, storageLevel: -1]HttpSymbolServer: [ url: https://software.intel.com/sites/downloads/symbols/, storageLevel: -1]HttpSymbolServer: [ url: https://driver-symbols.nvidia.com/, storageLevel: -1]HttpSymbolServer: [ url: https://download.amd.com/dir/bin/, storageLevel: -1]INFO  Connecting to https://msdl.microsoft.com/download/symbols/ (ConsoleTaskMonitor)INFO  Success (ConsoleTaskMonitor)INFO  Storing ntkrnlmp.pdb in local symbol store (12.66MB) (ConsoleTaskMonitor)INFO | ghidriff | Pdb stored at: /workspaces/ghidriff/.symbols/ntkrnlmp.pdb/FB0913AF0585F234BD64A64A87C62DB11/ntkrnlmp.pdbINFO  Connecting to https://msdl.microsoft.com/download/symbols/ (ConsoleTaskMonitor)INFO  Success (ConsoleTaskMonitor)INFO  Storing ntkrnlmp.pdb in local symbol store (12.66MB) (ConsoleTaskMonitor)INFO | ghidriff | Pdb stored at: /workspaces/ghidriff/.symbols/ntkrnlmp.pdb/797E613DB16DB6C0E57795A0CB03F4711/ntkrnlmp.pdbINFO | ghidriff | Program: /ntoskrnl.exe.10.0.22621.1344 imported: True has_pdb: True pdb_loaded: False analyzed FalseINFO | ghidriff | Program: /ntoskrnl.exe.10.0.22621.1413 imported: True has_pdb: True pdb_loaded: False analyzed FalseINFO | ghidriff | Starting analysis for 2 binariesINFO | ghidriff | Analyzing: ntoskrnl.exe.10.0.22621.1413 - .ProgramDBINFO | ghidriff | Analyzing: ntoskrnl.exe.10.0.22621.1344 - .ProgramDBWARNING| ghidriff | Turning off 'Shared Return Calls' for ntoskrnl.exe.10.0.22621.1344 - .ProgramDBINFO | ghidriff | Starting Ghidra analysis of ntoskrnl.exe.10.0.22621.1344 - .ProgramDB...INFO  PDB analyzer parsing file: /workspaces/ghidriff/.symbols/ntkrnlmp.pdb/FB0913AF0585F234BD64A64A87C62DB11/ntkrnlmp.pdb (PdbUniversalAnalyzer)WARNING| ghidriff | Turning off 'Shared Return Calls' for ntoskrnl.exe.10.0.22621.1413 - .ProgramDBINFO | ghidriff | Starting Ghidra analysis of ntoskrnl.exe.10.0.22621.1413 - .ProgramDB...INFO  PDB analyzer parsing file: /workspaces/ghidriff/.symbols/ntkrnlmp.pdb/797E613DB16DB6C0E57795A0CB03F4711/ntkrnlmp.pdb (PdbUniversalAnalyzer)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/<unnamed-tag_00001117> (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/<unnamed-tag_0000111B> (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/<unnamed-tag_0000111F> (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_WMI_LOGGER_CONTEXT (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_PPM_PLATFORM_STATE (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_IOP_IRP_EXTENSION (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_EX_HEAP_POOL_NODE (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_BLOB (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_MMPAGING_FILE (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_MMCLONE_DESCRIPTOR (CppCompositeType)WARN  PDB STRUCTURE reconstruction failed to align /ntkrnlmp.pdb/_KUSER_SHARED_DATA (CppCompositeType)INFO  Resolve time: 1939 mS (DefaultPdbApplicator)INFO  resolveCount: 3644 (DefaultPdbApplicator)INFO  Resolve time: 1854 mS (DefaultPdbApplicator)INFO  resolveCount: 3644 (DefaultPdbApplicator)WARN  Decompiling 1402efc70, pcode error at 14000000c: Unable to resolve constructor at 14000000c (DecompileCallback)WARN  Decompiling 1402efc70, pcode error at 14000000c: Unable to resolve constructor at 14000000c (DecompileCallback)WARN  Decompiling 1402efc70, pcode error at 14000000c: Unable to resolve constructor at 14000000c (DecompileCallback)INFO  Packed database cache: /tmp/vscode-Ghidra/packed-db-cache (PackedDatabaseCache)INFO  -----------------------------------------------------ASCII Strings                              0.137 secsApply Data Archives                        3.295 secsCall Convention ID                         2.037 secsCall-Fixup Installer                       0.998 secsCreate Address Tables                      0.021 secsCreate Address Tables - One Time           5.159 secsCreate Function                            8.858 secsData Reference                            17.246 secsDecompiler Switch Analysis               266.328 secsDemangler Microsoft                        3.514 secsDisassemble                                0.232 secsDisassemble Entry Points                  58.448 secsDisassemble Entry Points - One Time        1.802 secsEmbedded Media                             0.123 secsExternal Entry References                  0.125 secsFunction ID                              114.335 secsFunction Start Search                      0.859 secsNon-Returning Functions - Discovered      25.594 secsNon-Returning Functions - Known            0.144 secsPDB Universal                            168.601 secsReference                                  6.969 secsScalar Operand References                 91.615 secsShared Return Calls                        4.718 secsStack                                    291.121 secsSubroutine References                     14.672 secsSubroutine References - One Time           0.027 secsWindows x86 PE Exception Handling          0.470 secsWindows x86 PE RTTI Analyzer               0.091 secsWindows x86 Thread Environment Block (TEB) Analyzer     0.115 secsWindowsResourceReference                   0.413 secsx86 Constant Reference Analyzer          261.728 secs-----------------------------------------------------Total Time   1349 secs-----------------------------------------------------(AutoAnalysisManager)INFO  -----------------------------------------------------ASCII Strings                              3.249 secsApply Data Archives                        3.290 secsCall Convention ID                         1.984 secsCall-Fixup Installer                       0.947 secsCreate Address Tables                      0.007 secsCreate Address Tables - One Time           5.178 secsCreate Function                            8.855 secsData Reference                            17.320 secsDecompiler Switch Analysis               264.962 secsDemangler Microsoft                        3.649 secsDisassemble                                0.468 secsDisassemble Entry Points                  58.480 secsDisassemble Entry Points - One Time        1.805 secsEmbedded Media                             0.102 secsExternal Entry References                  0.120 secsFunction ID                              114.285 secsFunction Start Search                      0.987 secsNon-Returning Functions - Discovered      25.826 secsNon-Returning Functions - Known            0.034 secsPDB Universal                            169.189 secsReference                                  6.714 secsScalar Operand References                 91.422 secsShared Return Calls                        4.760 secsStack                                    291.137 secsSubroutine References                     14.711 secsSubroutine References - One Time           0.018 secsWindows x86 PE Exception Handling          0.463 secsWindows x86 PE RTTI Analyzer               0.089 secsWindows x86 Thread Environment Block (TEB) Analyzer     0.119 secsWindowsResourceReference                   0.403 secsx86 Constant Reference Analyzer          262.810 secs-----------------------------------------------------Total Time   1353 secs-----------------------------------------------------(AutoAnalysisManager)INFO | ghidriff | Analysis for ghidriff-ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413:/ntoskrnl.exe.10.0.22621.1413 completeINFO | ghidriff | Analysis for ghidriff-ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413:/ntoskrnl.exe.10.0.22621.1344 completeINFO | ghidriff | Diffing bins: ntoskrnl.exe.10.0.22621.1344 - ntoskrnl.exe.10.0.22621.1413INFO | ghidriff | Setup 16 decompliersINFO | ghidriff | Loaded old program: ntoskrnl.exe.10.0.22621.1344INFO | ghidriff | Loaded new program: ntoskrnl.exe.10.0.22621.1413INFO | ghidriff | p1 sym count: reported: 244603 analyzed: 16772INFO | ghidriff | p2 sym count: reported: 244606 analyzed: 16809INFO | ghidriff | Found unmatched: 65 matched: 16758 symbolsINFO  Hashing symbols in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing symbols in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Eliminate non-unique matches (ConsoleTaskMonitor)INFO  Finding symbol matches (ConsoleTaskMonitor)INFO | ghidriff | Exec time: 2.1672 secsINFO | ghidriff | Match count 54939INFO | ghidriff | Counter({('SymbolsHash',): 27893})INFO | ghidriff | Running correlator: ExactBytesFunctionHasherINFO | ghidriff | name: ExactBytesFunctionHasher hasher: ghidra.app.plugin.match.ExactBytesFunctionHasher@7167d81b one_to_one: True one_to_many: FalseINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | ExactBytesFunctionHasher Exec time: 0.8299 secsINFO | ghidriff | Match count: 100INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('ExactBytesFunctionHasher',): 100})INFO | ghidriff | Running correlator: ExactInstructionsFunctionHasherINFO | ghidriff | name: ExactInstructionsFunctionHasher hasher: ghidra.app.plugin.match.ExactInstructionsFunctionHasher@3c9cfcde one_to_one: True one_to_many: FalseINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | ExactInstructionsFunctionHasher Exec time: 0.4906 secsINFO | ghidriff | Match count: 123INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('ExactInstructionsFunctionHasher',): 123, ('ExactBytesFunctionHasher',): 100})INFO | ghidriff | Running correlator: StructuralGraphExactHashINFO | ghidriff | name: StructuralGraphExactHash hasher: <jpype._jproxy.proxy.StructuralGraphExactHasher object at 0xffff26c53bf0> one_to_one: True one_to_many: FalseINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | StructuralGraphExactHash Exec time: 1.3213 secsINFO | ghidriff | Match count: 0INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('ExactInstructionsFunctionHasher',): 123, ('ExactBytesFunctionHasher',): 100})INFO | ghidriff | Running correlator: ExactMnemonicsFunctionHasherINFO | ghidriff | name: ExactMnemonicsFunctionHasher hasher: ghidra.app.plugin.match.ExactMnemonicsFunctionHasher@7533923b one_to_one: True one_to_many: FalseINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | ExactMnemonicsFunctionHasher Exec time: 2.5697 secsINFO | ghidriff | Match count: 0INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('ExactInstructionsFunctionHasher',): 123, ('ExactBytesFunctionHasher',): 100})INFO | ghidriff | Running correlator: BulkInstructionHashINFO | ghidriff | name: BulkInstructionHash hasher: <jpype._jproxy.proxy.BulkInstructionsHasher object at 0xffff26c53b50> one_to_one: True one_to_many: FalseINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | BulkInstructionHash Exec time: 1.1462 secsINFO | ghidriff | Match count: 2INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('ExactInstructionsFunctionHasher',): 123, ('ExactBytesFunctionHasher',): 100, ('BulkInstructionHash',): 2})INFO | ghidriff | Running correlator: StructuralGraphHashINFO | ghidriff | name: StructuralGraphHash hasher: <jpype._jproxy.proxy.StructuralGraphHasher object at 0xffff26c53ab0> one_to_one: True one_to_many: TrueINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | StructuralGraphHash Exec time: 0.1894 secsINFO | ghidriff | Match count: 693INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('StructuralGraphHash',): 693, ('ExactInstructionsFunctionHasher',): 123, ('ExactBytesFunctionHasher',): 100, ('BulkInstructionHash',): 2})INFO | ghidriff | Running correlator: BulkBasicBlockMnemonicHashINFO | ghidriff | name: BulkBasicBlockMnemonicHash hasher: <jpype._jproxy.proxy.BulkBasicBlockMnemonicHasher object at 0xffff26c53a10> one_to_one: True one_to_many: TrueINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | BulkBasicBlockMnemonicHash Exec time: 0.1846 secsINFO | ghidriff | Match count: 0INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('StructuralGraphHash',): 693, ('ExactInstructionsFunctionHasher',): 123, ('ExactBytesFunctionHasher',): 100, ('BulkInstructionHash',): 2})INFO | ghidriff | Running correlator: SigCallingCalledHasherINFO | ghidriff | name: SigCallingCalledHasher hasher: <jpype._jproxy.proxy.SigCallingCalledHasher object at 0xffff26c53970> one_to_one: True one_to_many: FalseINFO  Hashing functions in ntoskrnl.exe.10.0.22621.1344 (ConsoleTaskMonitor)INFO  Hashing functions in ntoskrnl.exe.10.0.22621.1413 (ConsoleTaskMonitor)INFO  Finding function matches (ConsoleTaskMonitor)INFO | ghidriff | SigCallingCalledHasher Exec time: 0.1398 secsINFO | ghidriff | Match count: 0INFO | ghidriff | Counter({('SymbolsHash',): 27893, ('StructuralGraphHash',): 693, ('ExactInstructionsFunctionHasher',): 123, ('ExactBytesFunctionHasher',): 100, ('BulkInstructionHash',): 2})INFO | ghidriff | p1 missing = 1INFO | ghidriff | p2 missing = 1INFO | ghidriff | Deduping symbols and functions...INFO | ghidriff | Sorting symbols and strings...INFO | ghidriff | Sorting functions...INFO | ghidriff | Starting esym lookups for 71 symbols using 8 threadsINFO | ghidriff | Completed 4 at 5%INFO | ghidriff | Completed 8 at 11%INFO | ghidriff | Completed 12 at 16%INFO | ghidriff | Completed 16 at 22%INFO | ghidriff | Completed 20 at 28%INFO | ghidriff | Completed 24 at 33%INFO | ghidriff | Completed 28 at 39%INFO | ghidriff | Completed 32 at 45%INFO | ghidriff | Completed 36 at 50%INFO | ghidriff | Completed 40 at 56%INFO | ghidriff | Completed 44 at 61%INFO | ghidriff | Completed 48 at 67%INFO | ghidriff | Completed 52 at 73%INFO | ghidriff | Completed 56 at 78%INFO | ghidriff | Completed 60 at 84%INFO | ghidriff | Completed 64 at 90%INFO | ghidriff | Completed 68 at 95%INFO | ghidriff | Finished diffing old program: ntoskrnl.exe.10.0.22621.1344INFO | ghidriff | Finished diffing program: ntoskrnl.exe.10.0.22621.1413INFO | ghidriff | {"added_funcs_len": 1,"deleted_funcs_len": 1,"modified_funcs_len": 11,"added_symbols_len": 12,"deleted_symbols_len": 8,"diff_time": 86.45361375808716,"deleted_strings_len": 6,"added_strings_len": 39,"match_types": {"SymbolsHash": 27893,"ExactBytesFunctionHasher": 100,"ExactInstructionsFunctionHasher": 123,"BulkInstructionHash": 2,"StructuralGraphHash": 693},"items_to_process": 33,"diff_types": {"code": 5,"length": 5,"refcount": 7,"calling": 6,"address": 6,"called": 3},"unmatched_funcs_len": 2,"total_funcs_len": 60664,"matched_funcs_len": 60662,"matched_funcs_with_code_changes_len": 5,"matched_funcs_with_non_code_changes_len": 6,"matched_funcs_no_changes_len": 60651,"match_func_similarity_percent": "99.9819%","func_match_overall_percent": "99.9967%"}INFO | ghidriff | Writing md diff...INFO | ghidriff | Generating markdown from {'added_funcs_len': 1, 'deleted_funcs_len': 1, 'modified_funcs_len': 11, 'added_symbols_len': 12, 'deleted_symbols_len': 8, 'diff_time': 86.45361375808716, 'deleted_strings_len': 6, 'added_strings_len': 39, 'match_types': Counter({'SymbolsHash': 27893, 'StructuralGraphHash': 693, 'ExactInstructionsFunctionHasher': 123, 'ExactBytesFunctionHasher': 100, 'BulkInstructionHash': 2}), 'items_to_process': 33, 'diff_types': Counter({'refcount': 7, 'calling': 6, 'address': 6, 'code': 5, 'length': 5, 'called': 3}), 'unmatched_funcs_len': 2, 'total_funcs_len': 60664, 'matched_funcs_len': 60662, 'matched_funcs_with_code_changes_len': 5, 'matched_funcs_with_non_code_changes_len': 6, 'matched_funcs_no_changes_len': 60651, 'match_func_similarity_percent': '99.9819%', 'func_match_overall_percent': '99.9967%'}INFO | ghidriff | Known Command line: python ghidriff --project-location .ghidra_projects --project-name ghidriff --symbols-path .symbols --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --max-ram-percent 60.0 --max-section-funcs 200 ntoskrnl.exe.10.0.22621.1344 ntoskrnl.exe.10.0.22621.1413INFO | ghidriff | Extra Command line: --engine VersionTrackingDiff --output-path .ghidriffsINFO | ghidriff | Writing pdiff json...INFO | ghidriff | Wrote .ghidriffs/ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413_diff.mdINFO | ghidriff | Wrote .ghidriffs/json/ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413_diff.jsonAnalyze the DiffResults in this beatiful markdown:ntoskrnl.exe.10.0.22621.1344-ntoskrnl.exe.10.0.22621.1413.diff.mdSee if you can figure out what function was patched forCVE-2023-2342.Details ofCVE-2023-2342can be found here:https://bugs.chromium.org/p/project-zero/issues/detail?id=2392Prefer a side by side diff? Try outghidriff's custom html viewer.https://diffpreview.github.io/?b95ae854a92ee917cd0b5c7055b60282Results stored inghidriffsfolder$treeghidriffs
ghidriffs
├──ghidra_projects
│└──ghidriff-ntoskrnl.exe.10.0.22621.2215-ntoskrnl.exe.10.0.22621.2283
│├──ghidriff-ntoskrnl.exe.10.0.22621.2215-ntoskrnl.exe.10.0.22621.2283.gpr
│└──ghidriff-ntoskrnl.exe.10.0.22621.2215-ntoskrnl.exe.10.0.22621.2283.rep
│├──idata
│├──project.prp
│├──user
│└──versioned
├──ghidriff.log
├──json
│└──ntoskrnl.exe.10.0.22621.2215-ntoskrnl.exe.10.0.22621.2283.ghidriff.json
├──ntoskrnl.exe.10.0.22621.2215-ntoskrnl.exe.10.0.22621.2283.ghidriff.md
└──symbols├──ntkrnlmp.pdb├──69071F680ADFE36F178C6EC06E79E09C1│└──ntkrnlmp.pdb└──738ED8FF966E8502EFE17095B9F1F5481└──ntkrnlmp.pdbDiffing CVE-2023-21768Details of the CVE-2023-21768 (detailed in this blogpost). What if you wanted to repeat this patch diff withghidriff?Download two versions ofAFD.sys(vulnerable and patched):wgethttps://msdl.microsoft.com/download/symbols/afd.sys/0C5C6994A8000/afd.sys-Oafd.sys.x64.10.0.22621.1028
wgethttps://msdl.microsoft.com/download/symbols/afd.sys/50989142A9000/afd.sys-Oafd.sys.x64.10.0.22621.1415Runghidriff:ghidriffafd.sys.x64.10.0.22621.1028afd.sys.x64.10.0.22621.1415Review resultsThe diff results are posted in this GitHubgist. The vulnerable functionAfdNotifyRemoveIoCompletionwas identified here with asingle line change.Want to see the entire diff in a side by side?https://diffpreview.github.io/?f6fecbc507a9f1a92c9231e3db7ef40dor jump to thesingle line changeNotesMarkdown Spec + MermaidJsStriving to be compliant withGFMandcmark. Still working on it though. See issues.MermaidJs requires your markdownrenderer support.