BinDiff
Binary comparison tool that visualizes function-level differences between two builds of a program.
Technical Architecture & Overview
BinDiff, originally from Zynamics and now maintained by Google, compares disassembled binaries and highlights added, removed, and modified functions. It matches functions across builds even after recompilation changes layout. The tool integrates with IDA Pro, Binary Ninja, and Ghidra for the underlying disassembly. The source code was released under Apache-2.0, with prebuilt installers distributed through GitHub.
Targeted Technical Use Cases
Patch diffing on Windows and mobile binaries to locate the code changed by a security update.
Evaluation & Trade-offs
Core Strengths
- +Function matching holds up across recompilations.
- +Integration with all three major disassemblers.
- +Now open source and freely downloadable.
Trade-Offs & Limitations
- -Requires a working disassembler installation for large workflows.
- -Graph viewing is oriented to manual analysis rather than automation.
Defensive Security Application
Understanding vendor patches to assess exposure and write detections for the underlying vulnerability.
Frequently Asked Questions
What is BinDiff?→
BinDiff, originally from Zynamics and now maintained by Google, compares disassembled binaries and highlights added, removed, and modified functions. It matches functions across builds even after recompilation changes layout. The tool integrates with IDA Pro, Binary Ninja, and Ghidra for the underlying disassembly. The source code was released under Apache-2.0, with prebuilt installers distributed through GitHub.
What is BinDiff used for?→
Patch diffing on Windows and mobile binaries to locate the code changed by a security update.
What are the strengths of BinDiff?→
- +Function matching holds up across recompilations.
- +Integration with all three major disassemblers.
- +Now open source and freely downloadable.
What are the limitations of BinDiff?→
- +Requires a working disassembler installation for large workflows.
- +Graph viewing is oriented to manual analysis rather than automation.
How is BinDiff used defensively?→
Understanding vendor patches to assess exposure and write detections for the underlying vulnerability.