BinDiff now available for free

http://security.googleblog.com/2016/03/bindiff-now-available-for-free.html

by ner0x652 • 10 years ago

226 33 10 years ago

security.googleblog.com

dsl2• 10 years ago

To be clear, it is still a plugin for a ~$5000 application.

Nonetheless, thanks Google for lowering the bar for entry into professional security work!

linkregister• 10 years ago

From the article, it didn't appear that the decompiler was required, just the disassembler.

IDA Pro disassembler (professional edition) is $1129.

So it's somewhat less expensive.

I wish Hopper (hopperapp.com) were more publicized; it's only $89!

Tomte• 10 years ago

What's the Windows status there? I have looked at their web page many times and it's just confusing.

The main description page says Mac only, a blog post from long ago says Windows is available (with some restrictions).

dsl2• 10 years ago

It gets expensive when you want all the bells and whistles, but yes the base model is a little north of a grand.

Thanks for the link to Hopper, I know what i'll be doing this afternoon...

dfc• 10 years ago

If you cant splurge on IDA try radare2 before Hopper:

http://www.radare.org/r/cmp.html

Then in a couple weeks donate $89 saved to the radare2 efforts.

wslh2• 10 years ago

If you are a security professional it is not that much.

AdmVonSchneider6• 10 years ago

You only need the IDA Pro Starter Edition (589 USD, 32-bit files only) or the regular IDA Pro version for a single architecture (1129 USD). Even so, IDA comes with decades of RE experience baked into its heuristics and analysis features. It's quirky, yes, but as a professional tool it's also worth the money.

drakenot• 10 years ago

I saw someone post this googleblog entry over a month ago on the Freenode ##re channel. Then it was quickly taken down again. I guess they must have pulled the trigger a little early.

ikeboy• 10 years ago

Why is the linked site served over http? http://www.zynamics.com/software.html

Changing to https reveals a security cert valid for *.google.com, but not for www.zynamics.com.

newjersey• 10 years ago

Interesting. I brought up a similar issue about what browser dot org and while they took months to get it working with HTTPS, I consider it a win.

Still interesting though. I'd just use a separate certificate for this. > www.zynamics.com uses an invalid security certificate. The certificate is only valid for the following names: .google.com, .android.com, .appengine.google.com, .cloud.google.com, .google-analytics.com, .google.ca, .google.cl, .google.co.in, .google.co.jp, .google.co.uk, .google.com.ar, .google.com.au, .google.com.br, .google.com.co, .google.com.mx, .google.com.tr, .google.com.vn, .google.de, .google.es, .google.fr, .google.hu, .google.it, .google.nl, .google.pl, .google.pt, .googleadapis.com, .googleapis.cn, .googlecommerce.com, .googlevideo.com, .gstatic.cn, .gstatic.com, .gvt1.com, .gvt2.com, .metric.gstatic.com, .urchin.com, .url.google.com, .youtube-nocookie.com, .youtube.com, .youtubeeducation.com, .ytimg.com, android.clients.google.com, android.com, g.co, goo.gl, google-analytics.com, google.com, googlecommerce.com, urchin.com, youtu.be, youtube.com, youtubeeducation.com Error code: SSL_ERROR_BAD_CERT_DOMAIN

AdmVonSchneider6• 10 years ago

Yeah that's a sore point :-/ The downloads are served via HTTPS, though. Also, publishing the SHA1 hashes over HTTP kind of defeats the purpose, so here they are again (HackerNews is HTTPS :)):

bindiff420-debian8-amd64.deb 38fbea8070495fc8730d7c86eae03bc68fde291f bindiff420-debian8-i386.deb 49cdd6ae7ebe5b1813a5fcafaae9fde19005c824 bindiff420-win-pluginsonly.zip e2b786d405aac23aced989e02080dd69c18ab75e bindiff420-win-x86.msi 89f2eadc6582d4acca1e78db3617b5fba3eced0f bindiff-license-key.zip 95715a8bd7469106fc60b03f94f3cc87604e354c

int_handler• 10 years ago

Man, I'm getting tons of early-2000s vibes from the design of the zynamics website.

sshykes2• 10 years ago

Wholeheartedly agree, and IMHO the lack of Mac compatibility completes the vibe!

AdmVonSchneider6• 10 years ago

Yup, we didn't bother with updating it in a looong while :-/

aurelianito2• 10 years ago

Shameless plug:

Several years ago I did a tool that shows differences between disassembled functions basic-block graphs, that you can use for free and it is GPLv2 licensed. I believe my tool shows the differences in a better way than bindiff, and it piggybacks on a disassembler made by a former coworker and friend.

Maybe someone wants to use it.

http://www.coresecurity.com/corelabs-research/open-source-to...

PS: I don't work at Core Security anymore.

wslh2• 10 years ago

I don't work at Core Security anymore

Where do you work now?

aurelianito2• 10 years ago

Now I work at a small company named Disarmista.

derefr• 10 years ago

Isn't this the same basic idea as Google Updater's Courgette algorithm (https://www.chromium.org/developers/design-documents/softwar...)? Both seem to disassemble and then untangle the static call graph into something that can be effectively diffed.

rincebrain• 10 years ago

It may well be, but given the relative age of both Courgette's publication and Zynamics prior to Google's purchase, I'd be surprised if the two implementations are not entirely disjoint.

lolidaisuki• 10 years ago

If you look at the EULA you'll see that free here means free as in no cost. It is still proprietary software and isn't considered "open source" by the OSI definition[2] even tho the page claims it's "open source".

[1] http://www.zynamics.com/eula.html [2] https://opensource.org/osd

sshykes2• 10 years ago

No OS-X support? :(

armitron• 10 years ago

This would have been news worthy 10 years ago.

Today, it's more like shrug who cares.

Dependency on IDA, closed source, limited platform support, Java/Swing ...

Far better free solutions out there.

13of40• 10 years ago

Serious question -- can you point to a better (or at least more free) recursive, graphical debugger for Windows than IDA?

Strom• 10 years ago

Not sure what you mean by recursive, but OllyDbg [1] is an awesome free debugger on Windows.

[1] http://www.ollydbg.de/

AdmVonSchneider6• 10 years ago

LOL, haters gonna hate. So let's see...

- BinDiff would work stand-alone if someone wrote an exporter for another disassembler (BinDiff uses https://github.com/google/binexport for that).

- Closed source - yeah it contains some secret sauce and also depends on a commercial graph library (yFiles). Not easily replaced. Their product is also pretty good.

- Limited platform support - well, there is an older OS X version as well and we have this on our radar for future releases.

- Far better free solutions - please do show. Maybe we can do a diff-off some time :)

YOLO :P

fungos• 10 years ago

Remember that 4.2.0 works only with IDA 6.8, if you have an older IDA license, there goes the link to the 4.1.0 that is compatible with IDA 6.5+: https://dl.google.com/dl/zynamics/bindiff410-win-x86.msi

UPDATE:

Linux is here: https://dl.google.com/dl/zynamics/bindiff410-debian7-amd64.d...

AdmVonSchneider6• 10 years ago

Well it mostly works on 6.9 as well. Linux should work without any restrictions, but on Windows there were some IDA Qt changes that lead to some annoyances: - Can't reopen BinDiff windows after they were closed - Shortcuts don't work

Other than that the Windows version is functional.

lamby• 10 years ago

Would love this introduced into http://diffoscope.org/...

steipete• 10 years ago

Is there a version for OS X?

AdmVonSchneider6• 10 years ago

There used to be (4.0). I'm working on it, though :)

sandra_saltlake• 10 years ago

It's an awesome free debugger!

BinDiff now available for free

Related Stories