home.social
Sign in Create account

#ghidriff — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #ghidriff, aggregated by home.social.

  1. buherator @[email protected] ·
    ghidriff - mpengine.dll - VersionTrackingDiff - 1.1.24030.4 vs 1.1.24060.5

    https://gist.github.com/v-p-b/f9aa39263e125c8e3b04c4d22fd4d78d#strings

    This one executed much faster than SimpleDiff (with the O(n^2) FuncName:Param algorithm)!

    Unfortunately the diff is so big it's difficult to judge quality, so the next step is to come up with some metrics that can be checked automatically.

    #bindiff #ghidriff
    #bindiff #ghidriff
  2. buherator @[email protected] ·
    You diff binaries and immediately find the single change that adds the overflow check.

    I diff mpengine.dll and break all reversing tools out there.

    We are not the same.

    https://gist.github.com/v-p-b/513a8f70a32c62f3ab7bf0d6a90e0941

    #bindiff #ghidriff
    #bindiff #ghidriff
  3. clearbluejar @[email protected] ·

    Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: "Patch Different on *OS": youtube.com/watch?v=Ellb76t7nr

    #obts #ghidra #ghidriff #ipsw
  4. clearbluejar @[email protected] ·

    Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: "Patch Different on *OS": youtube.com/watch?v=Ellb76t7nr

    #obts #ghidra #ghidriff #ipsw
  5. clearbluejar @[email protected] ·

    Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: "Patch Different on *OS": youtube.com/watch?v=Ellb76t7nr

    #obts #ghidra #ghidriff #ipsw
  6. clearbluejar @[email protected] ·

    Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: "Patch Different on *OS": youtube.com/watch?v=Ellb76t7nr

    #ipsw #ghidriff #ghidra #obts
  7. clearbluejar @[email protected] ·

    Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: "Patch Different on *OS": youtube.com/watch?v=Ellb76t7nr

    #obts #ghidra #ghidriff #ipsw
  8. clearbluejar @[email protected] ·

    Root Cause Your Own CVEs #patchdiffinthedark #ghidriff #blackalps

    youtu.be/A2IrcwG6e84?si=oKl6Df

    #patchdiffinthedark #ghidriff #blackalps
  9. clearbluejar @[email protected] ·

    Hot of the #ghidriff #patchdiffing press for April 2024 we have CVE-2024-26219 in HTTP.sys 🔥

    MSRC just started publishing CWE info! For this CVE we have a "CWE-476: NULL Pointer Dereference" 👀

    See if you can find it 🧐

    Hint: "UxLastMdlChunkNullFix"

    gist.github.com/clearbluejar/a

    #ghidriff #patchdiffing
  10. clearbluejar @[email protected] ·

    hello 2024!

    Hot off the #ghidriff #patchdiffing press we have the January 9, 2024—KB5034122 Windows 10 22H2 x64 kernel update ...
    gist.github.com/clearbluejar/0 🔥

    Side by side view is here: diffpreview.github.io/?0e52d80 👀

    This month the kernel fixes include CVE-2024-20698 ... as there are not too many changes, perhaps we find the root cause?

    Take at look this function... gist.github.com/clearbluejar/0 🧐

    Hint: It rhymes with "vintager afterglow".

    #ghidriff #patchdiffing
  11. clearbluejar @[email protected] ·

    Latest #ghidriff v0.6.0 now uses #Ghidra 11.0 and brand new #BSim correlation: 🔥👀

    github.com/clearbluejar/ghidri

    #ghidriff #ghidra #bsim
  12. clearbluejar @[email protected] ·

    stayed up way too late, but now #ghidriff has a PR with #ghidra #BSIM powers. so... worth it? 😅

    github.com/clearbluejar/ghidri

    Some #BSIM first impressions:
    - The BSIM correlator is great for matching. The overall improvement for #ghidriff is a net plus, but some custom #ghidriff correlators were already providing similar structural matching (not as good, but similar) 💪
    - Speculation: 🧐 BSIM is the reason why Ghidra Version Tracking was lacking structural matching heuristics. I didn't understand that before the arrival of BSIM, and it was the reason why I added my own structural function matching to #ghidriff. BSIM fills the gap and does it better.
    - Adding BSIM to #ghidriff slows it down a bit. This is because BSIM decompiles all functions to match based on data flow and call graphs, and #ghidriff similarly already does this to make matching decisions. Will need to optimize. 🤓
    - Adding the BSIM correlator for matching is just the beginning, stay tuned to see what else BSIM can do. 🔥🐲

    #ghidriff #ghidra #bsim
  13. clearbluejar @[email protected] ·

    Hot off the #ghidriff #patchdiffing press, we have the December Windows 11 22H2 x64 kernel security update KB5033375: gist.github.com/clearbluejar/4 🧐

    Side-by-side view here: diffpreview.github.io/?4f0c979 👀

    #ghidriff #patchdiffing
  14. clearbluejar @[email protected] ·

    Hot off the #ghidriff #patchdiffing press we have November's Windows 11 22H2 x64 kernel update KB5032190:
    gist.github.com/clearbluejar/0 🧐

    Side by side view is here: diffpreview.github.io/?02fc449 👀

    #ghidriff #patchdiffing
  15. clearbluejar @[email protected] ·

    Hot off the #ghidriff #patchdiffing press we have October's Windows 11 22H2 kernel Update KB5031354...

    gist.github.com/clearbluejar/5 👀

    #ghidriff #patchdiffing