BinDiff
BinDiff, originally from Zynamics and now maintained by Google, compares disassembled binaries and highlights added, removed, and modified functions. It is open source under the Apache-2.0 license. It runs on Linux, macOS, and Windows.
Updated
- Pricing
- Open Source
- License
- Apache-2.0
- Platforms
- Linux, macOS, Windows
- Category
- Reverse Engineering
What Is BinDiff?
BinDiff, originally from Zynamics and now maintained by Google, compares disassembled binaries and highlights added, removed, and modified functions. It matches functions by the structure of their flow graphs and by call-graph relations rather than by concrete instructions. It reads disassembly exported by the BinExport plugin; IDA Pro is the fully supported disassembler, while Binary Ninja and Ghidra support is listed as work in progress. The source code was released under Apache-2.0, with prebuilt installers distributed through GitHub.
Use Cases
Patch diffing vendor-supplied updates to locate the code changed by a security fix.
Strengths and Limitations
Strengths
- +Function matching relies on graph structure rather than exact instruction sequences.
- +Ports function names and comments between disassemblies of different builds.
- +Now open source and freely downloadable.
Limitations
- -Requires a supported disassembler and the BinExport plugin; integration with Binary Ninja and Ghidra is still incomplete.
- -Building the Java GUI from source requires a license for the commercial yFiles graph library.
Defensive Use
Understanding vendor patches to assess exposure and write detections for the underlying vulnerability.
BinDiff Alternatives
3 tools| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Diaphora Open source program diffing tool that compares binary function sets to find patched vulnerabilities. | AGPL-3.0-or-later | Linux, macOS, Windows | Free / Commercial |
| Ghidra Software reverse engineering suite developed by the NSA, offering disassembly, decompilation, and scriptable binary analysis. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| IDA Pro Disassembler, decompiler, and debugger from Hex-Rays with disassembly support for more than 60 processor families. | Proprietary | Linux, macOS, Windows | Free / Commercial |
Frequently Asked Questions
What is BinDiff?→
BinDiff, originally from Zynamics and now maintained by Google, compares disassembled binaries and highlights added, removed, and modified functions. It matches functions by the structure of their flow graphs and by call-graph relations rather than by concrete instructions. It reads disassembly exported by the BinExport plugin; IDA Pro is the fully supported disassembler, while Binary Ninja and Ghidra support is listed as work in progress. The source code was released under Apache-2.0, with prebuilt installers distributed through GitHub.
What is BinDiff used for?→
Patch diffing vendor-supplied updates to locate the code changed by a security fix.
What are the strengths of BinDiff?→
- +Function matching relies on graph structure rather than exact instruction sequences.
- +Ports function names and comments between disassemblies of different builds.
- +Now open source and freely downloadable.
What are the limitations of BinDiff?→
- +Requires a supported disassembler and the BinExport plugin; integration with Binary Ninja and Ghidra is still incomplete.
- +Building the Java GUI from source requires a license for the commercial yFiles graph library.
How is BinDiff used defensively?→
Understanding vendor patches to assess exposure and write detections for the underlying vulnerability.