Collaborative RCE Tool Library - Diff Tools (including sub-categories)

Tool Updated: Regshot Unicode

2009-11-10T06:46:09Z

Listed in categories: Registry Diff Tools, Registry Monitoring Tools

Most recent version:
2.0.1.68 Unicode

Most recent release date:
November 9, 2009

Description:
Regshot is a small, free and open source (GPL) registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between snapshot1 and snapshot2. In addition, you can also specify folders (with sub filders) to be scanned for changes as well.

Tool Updated: Radare

2009-11-04T09:18:47Z

Listed in categories: .NET Disassemblers, Assemblers, Binary Diff Tools, Code Injection Tools, Debuggers, Disassemblers, Hex Editors, Java Disassembler Libraries, Linux Debuggers, Linux Disassemblers, Linux Tools, Memory Dumpers, Memory Patchers, Process Dumpers, Reverse Engineering Frameworks, Ring 3 Debuggers, String Finders, Symbol Retrievers, SysCall Monitoring Tools, Tracers

Most recent version:
1.4.1

Most recent release date:
November 3, 2009

Description:
<nowiki>The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, arm and java with some ones powerpc.

The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls.

The debugger and disassembler has a code analysis module for x86, mips, arm and java. This way it's possible to draw graphs using Cairo on a GTK window or store the flow execution of a program on a log file and use the information to diff't against another trace or binary.

The toolchain provides assemblers and disasemblers for x86, arm, mips (Loongson2F), sparc, CSR, m68k, powerpc, msil and java.

The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so).

The debugger is mainly developed on linux and {Net

Tool Updated: TurboDiff

2009-10-15T14:25:10Z

Listed in categories: Executable Diff Tools, IDA Extensions

Most recent version:
1.01

Most recent release date:
October 14, 2009

Description:
Turbodiff is a binary diffing tool developed as an IDA plugin. It discovers and analyzes differences between the functions of two binaries.

Tool Updated: WinHex

2009-08-30T15:59:59Z

Listed in categories: Binary Diff Tools, Hex Editors, Memory Dumpers, Memory Patchers, Memory Search Tools

Most recent version:
15.4 SR-5

Most recent release date:
August 30, 2009

Description:
WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features include (depending on the license type):

* Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ...
* Native support for FAT, NTFS, Ext2/3, ReiserFS, Reiser4, UFS, CDFS, UDF
* Built-in interpretation of RAID systems and dynamic disks
* Various data recovery techniques
* RAM editor, providing access to physical RAM and other processes' virtual memory
* Data interpreter, knowing 20 data types
* Editing data structures using templates (e.g. to repair partition table/boot sector)
* Concatenating and splitting files, unifying and dividing odd and even bytes/words
* Analyzing and comparing files
* Particularly flexible search and replace functions
* Disk cloning (under DOS with X-Ways Replica)
* Drive images & backups (optionally compressed or split into 650 MB archives)
* Programming interface (API) and scripting
* 256-bit AES encryption, checksums, CRC32, hashes (MD5, SHA-1, ...)
* Erase (wipe) confidential files securely, hard drive cleansing to protect your privacy
* Import all clipboard formats, incl. ASCII hex values
* Convert between binary, hex ASCII, Intel Hex, and Motorola S
* Character sets: ANSI ASCII, IBM ASCII, EBCDIC, (Unicode)
* Instant window switching. Printing. Random-number generator.
* Supports files >4 GB. Very fast. Easy to use. Extensive online help.

Tool Updated: RegShot

2009-07-18T23:26:11Z

Listed in categories: Registry Diff Tools, Registry Monitoring Tools

Most recent version:
1.82

Most recent release date:
November 3, 2007

Description:
Regshot is a small,free and open-source(GPL) registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between snapshot1 and snapshot2. In addition, you can also specify folders (with sub filders) to be scanned for changes as well.

Tool Updated: BinDiff

2009-06-13T10:14:36Z

Listed in categories: Executable Diff Tools, IDA Extensions

Most recent version:
2.1

Most recent release date:
2009

Description:
A very powerful executable file diffing tool, in the form of an IDA Pro plugin.

Tool Updated: IDACompare

2009-03-06T09:20:11Z

Listed in categories: Executable Diff Tools, IDA Extensions

Most recent version:
5.4

Most recent release date:
March 5, 2009

Description:
IDACompare is a plugin designed to compare and match up equivalent functions across two IDA databases. IDACompare was primarily designed for analyzing changes across malcode variants, it should also find good use when conducting patch analysis.

Once function matches have been made, names can be ported across disassemblies, or sequentially renamed in both.

Project also implements a signature scanner, letting you build your own listing of known functions.

Tool Added: DarunGrim

2009-02-09T12:36:06Z

Listed in categories: Executable Diff Tools

Most recent version:
2.0

Most recent release date:
February 7, 2009

Description:
DarunGrim is a binary diffing tool. DarunGrim is a free diffing tool which provides binary diffing functionality.

Binary diffing is a powerful technique to reverse-engineer patches released by software vendors like Microsoft. Especially by analyzing security patches you can dig into the details of the vulnerabilities it's fixing. You can use that information to learn what causes software break. Also that information can help you write some protection codes for those specific vulnerabilities. It's also used to write 1-day exploits by malware writers or security researchers.

This binary diffing technique is especially useful for Microsoft binaries. Not like other vendors they are releasing patch regularly and the patched vulnerabilities are relatively concentrated in small areas in the code. That makes the patched part more visible and apparent to the patch analyzers. There is a "eEye Binary Diffing Suites" released back in 2006 and it's widely used by security researchers to identify vulnerabilities. Even though it's free and opensource, it's powerful enough to be used for that vulnerabilities hunting purpose. Now I'm releasing DarunGrim2 which is a C++ port of original python codes. DarunGrim2 is way faster than original DarunGrim.

Tool Updated: PatchDiff

2009-01-26T14:28:58Z

Listed in categories: Executable Diff Tools

Most recent version:
2.0.5

Most recent release date:
August 19, 2008

Description:
PatchDiff2 is a plugin for the Windows version of the IDA dissassembler that can analyze two IDB files and find the differences between both. PatchDiff2 is free and fully integrates with the latest version of IDA (5.2).
The plugin can perform the following tasks :

* Display the list of identical functions
* Display the list of matched functions
* Display the list of unmatched functions (with the CRC)
* Display a flow graph for identical and matched functions

The main purpose of this plugin is to be fast and give accurate results when working on a security patch or a hotfix. Therefore this tool is not made to find similar functions between two different programs.
Patchdiff2 supports all processors that IDA can handle and is available in two versions: 32 bit and a 64 bit.

Update:

08/19/2008: PatchDiff 2.0.5 released:

* Adds string references to the signature
* Fixes IPC close when option is disabled

07/22/2008:PatchDiff 2.0.4 released:

* Requires at least IDA 5.2
* Adds save backup results to IDB
* Adds Unmatch/Set match/Switch match submenus
* Adds "pipe" support to keep second IDA instance open
o menu Options/PatchDiff2 to disable/enable it per IDB
o registry HKLM\SOFTWARE\Tenable\PatchDiff2 IPC (DWORD) for the default setting
* Uses demangled function names
* Ignores duplicated names

Tool Added: Compare VMware Snapshots

2008-04-28T10:59:15Z

Listed in categories: File System Diff Tools

Most recent version:
1.0

Most recent release date:
September 19, 2007

Description:
Nowadays there’s a big use of virtualization; tools like VMware, VirtualPC and others are daily used. There are some differencies between the original and the virtualized environment, but to study a malware under a protected blackbox it’s very comfortable. You can study their behaviour without any problems.

Just today, while I was running a malware, I got this foolish idea: can I identify hidden files using VMware’s snapshots?

Under VMware you can save the current state of a virtual machine taking a snapshot of the running guest system. The snapshot is stored somewhere in the guest’s OS folder, it simply needs some files. I’m interestered in one file only, the one containing the guest’s memory. The memory is saved inside a file with .vmem extension.

The idea is to take two snapshots (a virgin and an infected system), and then compare the two files. The main problem is that a single snapshot needs a large amounts of bytes, around 260 Mb on my system. Comparing the snapshots using an hex editor is madness. I decided to write a simple application able to compare two files string to string. Why only strings?
Well, how can I identify an hidden file simply looking at a “memory dump”? The answer is simple: the only thing able to reveal a trace is a string containing the name of the hidden file, nothing more. So, I extract all the strings from the virgin snapshot and then I compare them with all the strings from the infected snapshot. Yes, it’s a foolish idea but it helps me to pass a boring afternoon.

The most important part of the program is the internal “search engine”. To speed up the program you have to search for specific strings. To view the results in a quick way I simply search for strings with extension “.sys”, “.dll” or just “.exe”. That’s because these are the file extensions of the files that are always hidden. You can improve the search engine adding some more rules (i.e. string must have “system32″ or “windows” inside) but the result won’t change: you can always see some interesting strings.

I tried the program running two malwares: Lager and Nailuj.
Lager malware hides a file named taskdir.exe and Nailuj hides videoati0.sys/dll/exe.
In both cases, I can see some strings referring to the hidden files.

The string is somewhere in the memory, I’m not interested in its position but in the string itself: it exists!

There are some good tools out there able to show hidden files but sometimes they fail. When they fail you can try with this approach.

Tool Updated: Beyond Compare

2008-04-28T10:59:04Z

Listed in categories: Binary Diff Tools, File System Diff Tools, Image Diff Tools, Text Diff Tools

Most recent version:
2.5.1

Most recent release date:
August 30, 2007

Description:
A very good text/code diffing tool. Also a good binary diffing tool if using the plugin for this from the author's website.

Tool Updated: All-Seeing Eye

2008-04-28T10:58:55Z

Listed in categories: File System Diff Tools, Install Monitoring Tools, Registry Monitoring Tools, System Diff Tools

Most recent version:
0.7.1

Most recent release date:
2007

Description:
Tool for automated diff-style checking of many sensitive system areas that malware and other programs often try to modify silently. Like Tripwire on speed.

Tool Added: Diff Doc

2008-01-24T11:28:59Z

Listed in categories: Document Diff Tools

Most recent version:
3.71

Most recent release date:
January 23, 2008

Description:
Regardless of the editor you are using (MS Word, Excel, Wordpad, Notepad, etc.), simply load the original and modified files, press the Refresh button Compare Files (or F5), and the document comparison will display promptly. Additionally, you can compare folders to see exactly what files have changed before doing a detailed file comparison.
See an on-line video.

'Diff Doc' can display the file differences in two possible views, 'All In One', or 'Side By Side'. Both views have their advantages, and switching between them is as easy as a mouse click (or F6). Lastly, many reports are available, including HTML, detailing the differences.

Diff Doc Features:

* Compare documents of MS Word, Excel, PDF, Rich Text (RTF), Text, HTML, XML, PowerPoint, or Wordperfect and retain formatting
* Choose any portion of any document (file) and compare it against any portion of the same or different document (file).
* Compare files of any type against any file type (i.e. An MS Word compared against a. Wordperfect document)
* Change the colors and formatting used to highlight the document changes
* Integrated into the Windows Explorer Shell (Windows Explorer, Desktop, Find in Files, etc.) for quick comparisons
* Navigate easily through the file differences with the Next (F7), Previous (Shift+F7) etc. navigation buttons. Or use the drop down list box to jump to a specific difference
* Paragraph differences are highly detailed
* Compares text from any application by cutting and pasting into 'Diff Doc'.
* Both 'Side By Side' and the red-lined 'All In One' difference views are supported
* Save any of the views as DOC, Text, RTF or HTML format
* Detailed HTML Reports now possible allowing of printing and e-mailing results quickly. Both Side By Side and All In One compare reports are supported
* Text and Comma Delimited reports also available
* Compare folders first, then quickly see what files are different and compare with a mouse click
* Can be adapted for all languages
* Compatible with WORLDOX, and any other document management software that supports 3rd party file comparison applications through the command line. Click here for details
* Run it from the Command Line or build your own solutions by using the ActiveX COM interface (available upon request)

See demonstration video here:
http://www.convert-files.com/SII/Diff-Doc/English/SWF/DiffDoc-Quick-Start-Comparing-Files.htm

Tool Updated: Pynary

2008-01-15T07:13:58Z

Listed in categories: Deobfuscation Tools, Diff Tools, Exe Analyzers, Executable Diff Tools, Programming Libraries, Reverse Engineering Frameworks

Most recent version:
0.0.1

Most recent release date:

Description:
pynary will become a powerful platform independent framework for binary code analysis.

The initial goal is to the implementation of function signature matching using graph isomorphism and an extensible 'write-your-own-heuristic' model to allow tweaks for particular targets. It will also identify standard library global constants and structure where possible.

Once the initial goal is achieved, a number of cool features are planned:

* stack frame analysis
* un-inliner
* exception handling parsing/analysis
* 'functionally equivalent' matching
* c++ template function matching
* meta-data transfer between IDBs
* c++ class reconstruction (with/without RTTI)
* ...

This project is still in its infancy, and looking for volunteers.

Tool Updated: Araxis Merge

2008-01-01T19:34:20Z

Listed in categories: Binary Diff Tools, Image Diff Tools, Text Diff Tools

Most recent version:

Most recent release date:
December 6, 2007

Description:
Merge is the visual file comparison (diff), merging and folder synchronization application from Araxis. Use it to compare and merge source code, web pages and other text files with native application performance. Compare images and binary files. Synchronize folders. Perform code reviews and audits. Work with source hierarchies containing thousands of files.

Features include:

- 3 way diff comparison (compare 3 files or data sets at the same time)
- ASCII, MBCS, UNICODE
- Binary and image (jpg, gif etc) comparison (very cool, can easily detect single changed pixels, e.g. in cases of steganography etc!)

Very powerful tool, useful for quickly diff'ing a directory structure of files to check for changes.

Tool Updated: WinDiff

2007-12-28T23:44:54Z

Listed in categories: Text Diff Tools

Most recent version:

Most recent release date:

Description:
The good old classic source diff tool that comes with (at least earlier versions, including 6.0, of) Microsoft Visual Studio.

Tool Updated: WinMerge

2007-12-28T23:37:50Z

Listed in categories: Text Diff Tools

Most recent version:
2.6.12 (stable)

Most recent release date:
December 20, 2007

Description:
From the source:

"WinMerge is a Win32 tool for visual difference display and merging, for both files and directories. Unicode support. Flexible syntax coloring editor. Windows Shell integration. Regexp filtering. Side-by-side line diff and highlights diffs inside lines."

Also, it supports plugin system that natively includes 7-Zip as prefilter, useful for huge chunks of junk.

Tool Added: ExamDiff Pro

2007-12-26T19:35:44Z

Listed in categories: Binary Diff Tools, Text Diff Tools

Most recent version:
3.5.1.5

Most recent release date:
May 26, 2007

Description:
From the product's website:
ExamDiff Pro is a powerful yet intuitive and easy to use visual file and directory comparison tool for Windows 98/Me/NT/2000/XP/2003/Vista. It features unique functionality that distinguishes ExamDiff Pro from other comparison programs. If you've been frustrated with other comparison utilities, you will find that ExamDiff Pro offers a much more efficient and user-friendly way to compare files and folders.

Tool Added: DiffMerge

2007-11-23T23:35:29Z

Listed in categories: Text Diff Tools

Most recent version:
3.1

Most recent release date:
October 10, 2007

Description:
DiffMerge is an application to visually compare and merge files for Windows, Mac OS X and Unix.

Product Features:

* Diff. Graphically shows the changes between two files. Includes intra-line highlighting and full support for editing.
* Merge. Graphically shows the changes between 3 files. Allows automatic merging (when safe to do so) and full control over editing the resulting file.
* Folder Diff. Performs a side-by-side comparison of 2 folders, showing which files are only present in one file or the other, as well as file pairs which are identical or different.
* Windows Explorer Integration. Right-click on any two files in Windows Explorer to diff them immediately.
* Configurable. Rulesets and options provide for customized appearance and behavior.
* International. Compatible with 42 different character encodings.
* Cross-platform. Identical feature set on Windows, Mac OS X, and Unix.

Tool Added: Winalysis

2007-11-08T15:24:09Z

Listed in categories: Install Monitoring Tools, System Diff Tools

Most recent version:
3.1

Most recent release date:
January 13, 2006

Description:
Winalysis is a software application that can help you manage change on computers running Windows. The program can:

Make compressed Snapshots of local and remote computer configurations. Test for changes from snapshots at any time.

Monitor for changes to files, the registry, users, groups, security policies, services, shares, scheduled jobs, the system environment and more.

Monitor remote computers from a central location. There is no need to install Winalysis on the remote machines.

Restore files and/or the registry from compressed snapshots with the ability to undo a restore at any time.