Diaphora
Diaphora diffs two versions of a compiled program by comparing function-level features such as structure, call patterns, and pseudo-code. It has a free edition under the AGPL-3.0-or-later license, and its maintainer also sells a paid edition or commercial license. It runs on Linux, macOS, and Windows.
Updated
- Pricing
- Free / Commercial
- License
- AGPL-3.0-or-later
- Platforms
- Linux, macOS, Windows
- Category
- Reverse Engineering
What Is Diaphora?
Diaphora diffs two versions of a compiled program by comparing function-level features such as structure, call patterns, and pseudo-code. It runs as an IDA plugin and can also diff previously exported databases from the command line. Analysts use it for patch diffing, where the changed functions in a vendor update point at the vulnerability being fixed. The project has been maintained since 2015 and is actively developed.
Use Cases
Identifying which functions changed between two firmware or software versions during patch analysis.
Strengths and Limitations
Strengths
- +Pseudo-code and microcode diffing, with detection of potentially fixed vulnerabilities in patch diffing sessions.
- +Supports IDA 7.4 and later, with command-line diffing of exported databases.
- +Dozens of matching heuristics based on graph theory, assembler, bytes, and function features.
Limitations
- -Written entirely in Python, so exporting large databases is slow, especially when the decompiler is used.
- -Exporting databases requires IDA; the command line only diffs databases already exported from IDA.
Defensive Use
Patch analysis to locate potentially fixed vulnerabilities in vendor updates.
Diaphora Alternatives
3 tools| Tool | License | Platforms | Pricing |
|---|---|---|---|
| BinDiff Binary comparison tool that visualizes function-level differences between two builds of a program. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| Ghidra Software reverse engineering suite developed by the NSA, offering disassembly, decompilation, and scriptable binary analysis. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| IDA Pro Disassembler, decompiler, and debugger from Hex-Rays with disassembly support for more than 60 processor families. | Proprietary | Linux, macOS, Windows | Free / Commercial |
Frequently Asked Questions
What is Diaphora?→
Diaphora diffs two versions of a compiled program by comparing function-level features such as structure, call patterns, and pseudo-code. It runs as an IDA plugin and can also diff previously exported databases from the command line. Analysts use it for patch diffing, where the changed functions in a vendor update point at the vulnerability being fixed. The project has been maintained since 2015 and is actively developed.
What is Diaphora used for?→
Identifying which functions changed between two firmware or software versions during patch analysis.
What are the strengths of Diaphora?→
- +Pseudo-code and microcode diffing, with detection of potentially fixed vulnerabilities in patch diffing sessions.
- +Supports IDA 7.4 and later, with command-line diffing of exported databases.
- +Dozens of matching heuristics based on graph theory, assembler, bytes, and function features.
What are the limitations of Diaphora?→
- +Written entirely in Python, so exporting large databases is slow, especially when the decompiler is used.
- +Exporting databases requires IDA; the command line only diffs databases already exported from IDA.
How is Diaphora used defensively?→
Patch analysis to locate potentially fixed vulnerabilities in vendor updates.