Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <h2>Standardise Build Paths</h2> <p>A simple solution would be to standardise on your build paths, so they are always of the form, for example:</p> <pre><code>c:\buildXXXX </code></pre> <p>Then, when you compare, say, <strong>build0434</strong> to <strong>build0398</strong>, just preprocess the binary to change all occurrences of <strong>build0434</strong> to <strong>build0398</strong>. Choose a pattern you know is unlikely to show up in your actual source/data, except in those strings the compiler/linker embed into the PE.</p> <p>Then you can just do your normal difference analysis. By using the same length pathnames, you won't shift any data around and cause false positives.</p> <h2>Dumpbin utility</h2> <p>Another tip is to use <strong>dumpbin.exe</strong> (ships with MSVC). Use <em>dumpbin /all</em> to dump all details of a binary to a text/hex dump. This can make it more obvious to see what/where is changing.</p> <p>For example:</p> <pre><code>dumpbin /all program1.exe &gt; program1.txt dumpbin /all program2.exe &gt; program2.txt windiff program1.txt program2.txt </code></pre> <p>Or use your favourite text diffing tool, instead of Windiff.</p> <h2>Bindiff utility</h2> <p>You may find Microsoft's <strong>bindiff.exe</strong> tool useful, which can be obtained here:</p> <p><a href="http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&amp;displaylang=en" rel="noreferrer">Windows XP Service Pack 2 Support Tools</a></p> <p>It has a /v option, to instruct it to ignore certain binary fields, such as timestamps, checksums, etc.:</p> <blockquote> <p>"BinDiff uses a special compare routine for Win32 executable files that masks out various build time stamp fields in both files when performing the compare. This allows two executable files to be marked as "Near Identical" when the files are truely identical, except for the time they were built."</p> </blockquote> <p>However, it sounds like <em>you may be already doing</em> a superset of what bindiff.exe does.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload