trietptm / binarydiffer

Automatically exported from code.google.com/p/binarydiffer

Hi there 👋

• 🔭 I’m currently working on incident response & digital forensics (DFIR), cyber security consulting/blue teaming services, system/internal penetration testing/red teaming.
• 🌱 I’m currently learning Mathematics for Computer Science and Security Engineering.
• 👯 I’m looking to collaborate on study/researching state-of-the-art tools, techniques, tactics in binary analysis and reverse engineering.
  • Python is my favorite programming language: https://github.com/trietptm?tab=repositories&q=&type=&language=python
  • I am honoured to be mentioned in the book "The Beginner's Guide to IDAPython" (https://leanpub.com/IDAPython-Book) and some FireEye Flare-On Challenge Honor Roll pages.
• 🤔 I’m looking for help with business development in Vietnam.
• 💬 Ask me about any Cyber Security questions if you need Cyber Security Consulting (securing accounts/systems, system security assessments, cyber-security maturity assessment, suspicious/malicious file examination,...) or have a malware/hacking outbreak and need an incident compromise assessment (how and when a hacker got into your system, what post-exploitation activities they did in your system,...), malware remediation help, securing your systems and digital assets.
• 📫 How to reach me: [phone] (WhatsApp, Viber, Signal), LinkedIn (https://www.linkedin.com/in/trietptm/), Twitter DM (https://twitter.com/MinhTrietPT) or reaching me via our company Facebook page for our reverse engineering online courses: https://www.facebook.com/novasec.vn .

GitHub Stats

binarydiffer's Issues

Compiling BinaryDiffer in IDA SDK5.1

Under IDA SDK 5.1 and Visual Studio 2005

===================
In /DiffEngine
1. vsntprintf is deprecated
=> vsntprintf() should be replaced with vsntprintf_s() in 
lib/sharedmemory.cpp
=> remove /wx options in Makefile


===================
In /Plugin
1. dont_use_strncpy, dont_use_strncat
=> remove definitions for strncpy, etc in pro.h of IDASDK
=> due to including tchar.h, which has a definition for strncpy

2. HT_GRAPH 
=> in history.txt from IDA SDK 51
+ SDK: removed HT_GRAPH and added 2 parameters to create_graph_viewer() 
This breaks the existing graph view plugins (sorry) but this part of IDA 
API has not been settled yet.

===================
I successfully compiled BinaryDiffer without any errors,
but it doesn't work well. 
It always crashed when executing the plugin.

Original issue reported on code.google.com by [email protected] on 10 Mar 2008 at 6:34

Problem when deal with idata segment.

What steps will reproduce the problem?
1. Diff the two ocx files in attached rar.

What is the expected output? What do you see instead?
The plugin hanged there.

Please use labels and text to provide additional information.

Original issue reported on code.google.com by [email protected] on 23 Mar 2008 at 2:53

Attachments:

• a.rar

Truncating function names after 40 characters.

What steps will reproduce the problem?
1. Diff 2 binaries, first idb needs to have function names longer than 40 
characters.

What is the expected output? What do you see instead?
a6ffb0  sub_A6FFB0                                  6       0     a71d30  
BnetService::Platform_ReportPlayerCallb     6       0

proper name is: BnetService::Platform_ReportPlayerCallback

Please provide any additional information below.
Fix:
Increase the size of the 'char op_buffer[40]={0,};' in IDAAnalysis.cpp to 511 
wich is the maximum length of names in IDA?

Original issue reported on code.google.com by [email protected] on 14 Sep 2011 at 6:57

I Can't make a .db file from winsrv.dll system DLL.

What steps will reproduce the problem?
1. Open a system dll file, winsrv.dll, with IDA5.0.
2. then, Try to make a .db file with AnalIDA for DarunGrim.
3. finally, meet the following unexpected message.

=========== MESSAGE in message window on IDA =======================
Start Analysis
Output file=[C:\분석실\ms_patch\ms07021\winsrv.db]
0x764c73ab DllEntryPoint - DllEntryPoint (isCode:1)
cref_from>     -> : 764c73ad
cmd.itype=7a
cmd.Operands[i].type=1
cmd.Operands[i].dtyp=2
cmd.Operands[i].type=1
cmd.Operands[i].dtyp=2
============================================================

What is the expected output? What do you see instead?
I want to get a .db file for winsrv.dll, but i dont.


What version of the product are you using? On what operating system?

WindowsXP SP2 (KOR)
IDA5.0
Python2.5.2
SQLite3


Please provide any additional information below.

i attach some file used to get a .db file. 

Original issue reported on code.google.com by [email protected] on 28 Mar 2008 at 2:58

Attachments:

• analysis_winsrv.zip