BinDiff
Binary comparison tool that visualizes function-level differences between two builds of a program.
Technical Architecture & Overview
BinDiff, originally from Zynamics and now maintained by Google, compares disassembled binaries and highlights added, removed, and modified functions. It matches functions by the structure of their flow graphs and by call-graph relations rather than by concrete instructions. It reads disassembly exported by the BinExport plugin; IDA Pro is the fully supported disassembler, while Binary Ninja and Ghidra support is listed as work in progress. The source code was released under Apache-2.0, with prebuilt installers distributed through GitHub.
Targeted Technical Use Cases
Patch diffing vendor-supplied updates to locate the code changed by a security fix.
Evaluation & Trade-offs
Core Strengths
- +Function matching relies on graph structure rather than exact instruction sequences.
- +Ports function names and comments between disassemblies of different builds.
- +Now open source and freely downloadable.
Trade-Offs & Limitations
- -Requires a supported disassembler and the BinExport plugin; integration with Binary Ninja and Ghidra is still incomplete.
- -Building the Java GUI from source requires a license for the commercial yFiles graph library.
Defensive Security Application
Understanding vendor patches to assess exposure and write detections for the underlying vulnerability.
Frequently Asked Questions
What is BinDiff?→
BinDiff, originally from Zynamics and now maintained by Google, compares disassembled binaries and highlights added, removed, and modified functions. It matches functions by the structure of their flow graphs and by call-graph relations rather than by concrete instructions. It reads disassembly exported by the BinExport plugin; IDA Pro is the fully supported disassembler, while Binary Ninja and Ghidra support is listed as work in progress. The source code was released under Apache-2.0, with prebuilt installers distributed through GitHub.
What is BinDiff used for?→
Patch diffing vendor-supplied updates to locate the code changed by a security fix.
What are the strengths of BinDiff?→
- +Function matching relies on graph structure rather than exact instruction sequences.
- +Ports function names and comments between disassemblies of different builds.
- +Now open source and freely downloadable.
What are the limitations of BinDiff?→
- +Requires a supported disassembler and the BinExport plugin; integration with Binary Ninja and Ghidra is still incomplete.
- +Building the Java GUI from source requires a license for the commercial yFiles graph library.
How is BinDiff used defensively?→
Understanding vendor patches to assess exposure and write detections for the underlying vulnerability.