Diaphora
Open source program diffing tool that compares binary function sets to find patched vulnerabilities.
Technical Architecture & Overview
Diaphora diffs two versions of a compiled program by comparing function-level features such as structure, call patterns, and pseudo-code. It runs as an IDA plugin and can also diff previously exported databases from the command line. Analysts use it for patch diffing, where the changed functions in a vendor update point at the vulnerability being fixed. The project has been maintained since 2015 and is actively developed.
Targeted Technical Use Cases
Identifying which functions changed between two firmware or software versions during patch analysis.
Evaluation & Trade-offs
Core Strengths
- +Pseudo-code and microcode diffing, with detection of potentially fixed vulnerabilities in patch diffing sessions.
- +Supports IDA 7.4 and later, with command-line diffing of exported databases.
- +Dozens of matching heuristics based on graph theory, assembler, bytes, and function features.
Trade-Offs & Limitations
- -Written entirely in Python, so exporting large databases is slow, especially when the decompiler is used.
- -Exporting databases requires IDA; the command line only diffs databases already exported from IDA.
Defensive Security Application
Patch analysis to locate potentially fixed vulnerabilities in vendor updates.
Frequently Asked Questions
What is Diaphora?→
Diaphora diffs two versions of a compiled program by comparing function-level features such as structure, call patterns, and pseudo-code. It runs as an IDA plugin and can also diff previously exported databases from the command line. Analysts use it for patch diffing, where the changed functions in a vendor update point at the vulnerability being fixed. The project has been maintained since 2015 and is actively developed.
What is Diaphora used for?→
Identifying which functions changed between two firmware or software versions during patch analysis.
What are the strengths of Diaphora?→
- +Pseudo-code and microcode diffing, with detection of potentially fixed vulnerabilities in patch diffing sessions.
- +Supports IDA 7.4 and later, with command-line diffing of exported databases.
- +Dozens of matching heuristics based on graph theory, assembler, bytes, and function features.
What are the limitations of Diaphora?→
- +Written entirely in Python, so exporting large databases is slow, especially when the decompiler is used.
- +Exporting databases requires IDA; the command line only diffs databases already exported from IDA.
How is Diaphora used defensively?→
Patch analysis to locate potentially fixed vulnerabilities in vendor updates.