05月12, 2018

BinDiff

Download Bindiff

win https://dl.google.com/dl/zynamics/bindiff430.msi

linux https://dl.google.com/dl/zynamics/bindiff_4.3.0_amd64.deb

macOS https://dl.google.com/dl/zynamics/BinDiff4.3.dmg

Installation in Ubuntu

To install BinDiff to your workstation, perform the following steps:

sudo dpkg -i bindiff_4.3.0_amd64.deb

Download the Debian package from the zynamics website: Download bindiff_4.3.0_amd64.deb. Open a shell with administrative privileges. On Debian, use the su command, on Ubuntu use the command sudo -i. Then change the current working directory to the location where you downloaded the Debian package to. Type dpkg -i bindiff_4.3.0_amd64.deb to begin the installation. You are asked to read and confirm the zynamics BinDiff License Agreement. Select Ok and press Enter.

To accept the License Agreement, select Yes when presented with the License Agreement question and press Enter.

You are asked to provide the path to your installation of Hex-Rays IDA Pro. Type the full path and press Enter. The recommended path is /opt/ida-6.95/. To verify your installation and to begin using BinDiff, open a database in IDA Pro and invoke the BinDiff Plugin for IDA by pressing Ctrl+6.

提示需要先安装Java JDK等依赖,于是安装 sudo apt install openjdk-8-jre 报错

Reading package lists... Done
Building dependency tree       
Reading state information... Done
You might want to run 'apt-get -f install' to correct these:
The following packages have unmet dependencies:
 default-jre-headless : Depends: openjdk-8-jre-headless but it is not going to be installed
 google-chrome-stable : Depends: libpango1.0-0 (>= 1.14.0) but it is not going to be installed
                        Depends: libappindicator1 but it is not going to be installed
 openjdk-8-jre : Depends: openjdk-8-jre-headless (= 8u111-b14-2ubuntu0.16.04.2) but it is not going to be installed
 vlc-dbg:i386 : Depends: vlc-nox:i386 (= 2.0.8-0ubuntu0.12.04.1) but it is not going to be installed
E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution).

解决方案:

sudo apt-get install -f
sudo apt-get autoremove

然后再到

https://www.digitalocean.com/community/tutorials/how-to-install-java-with-apt-get-on-ubuntu-16-04

http://topspeedsnail.com/ubuntu16-install-java-jdk/

遇到问题:

xiaolei@xiaolei-Server:~/Downloads$ sudo dpkg -i bindiff_4.3.0_amd64.deb 
(Reading database ... 277092 files and directories currently installed.)
Preparing to unpack bindiff_4.3.0_amd64.deb ...
bindiff license has already been accepted
Unpacking bindiff (4.3.0) over (4.3.0) ...
Setting up bindiff (4.3.0) ...
update-alternatives: using /opt/zynamics/BinDiff/bin/bindiff.sh to provide /usr/bin/bindiff (bindiff) in auto mode
No stored path to the IDA Pro installation directory found, not
creating any symlinks to the BinDif IDA plugins.
Use `dpkg-reconfigure bindiff' to set your IDA Pro directory.

To be able to use BinDiff, you also need to set the path to your
IDA Pro installation directory in the following configuration
files:
    /etc/opt/zynamics/BinDiff/bindiff_core.xml
    /etc/opt/zynamics/BinDiff/bindiff_ui.xml
Processing triggers for gnome-menus (3.13.3-6ubuntu3.1) ...
Processing triggers for desktop-file-utils (0.22-1ubuntu5.1) ...
Processing triggers for bamfdaemon (0.5.3~bzr0+16.04.20160824-0ubuntu1) ...
Rebuilding /usr/share/applications/bamf-2.index...
Processing triggers for mime-support (3.59ubuntu1) ...

解决方案:

sudo dpkg-reconfigure bindiff

How to uninstall

open an administrative shell and run the command apt-get remove bindiff.

How to invoke Bindiff from command line

windows

  1. convert binary file to IDB:

    $IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT
    
  2. create BinExport from idb

    $IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc
    

    where bindiff_export.idc looks like:

    #include <idc.idc>
    static main()
    {
     Batch(0);
     Wait();
     Exit( 1 - RunPlugin("zynamics_binexport_5", 2 ));
    }
    
  3. use BinDiff directly on BinExports:
    $PATH_TO_BINDIFF\\bin\\BinDiff_Deluxe.exe -i $BIN_EXPORT_A -j $BIN_EXPORT_B -o $OUTPUT
    

本文链接:https://harry.ren/post/ida-plagin.html

-- EOF --

Comments