Skip to content

Commit

Permalink
docs update
Browse files Browse the repository at this point in the history
  • Loading branch information
clearbluejar committed Dec 21, 2023
1 parent fae221c commit 4de176a
Show file tree
Hide file tree
Showing 10 changed files with 62 additions and 3 deletions.
5 changes: 5 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,11 @@ See below for [CVE diffs and sample usage](#sample-usage)

The heavy lifting of the binary analysis is done by Ghidra and the diffing is possible via Ghidra's Program API. `ghidriff` provides a diffing [workflow](#engine), function matching, and resulting markdown and HTML diff output.

## Docs

- [ghidriff official Docs](https://clearbluejar.github.io/ghidriff)
- [Blog Post](https://clearbluejar.github.io/posts/ghidriff-ghidra-binary-diffing-engine/)

## Engine

<p align='center'>
Expand Down
File renamed without changes.
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"link": {
"type": "generated-index",
"description": "Sample OSX Diffs"
"description": "Sample Mac Diffs"
}
}
File renamed without changes.
File renamed without changes.
6 changes: 6 additions & 0 deletions www/diffs/Samples/_category_.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"link": {
"type": "generated-index",
"description": "A collection of ghidriff diffs..."
}
}
40 changes: 40 additions & 0 deletions www/docs/README/Supported Platforms.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
---
description: Is ghidriff useful for my platform?
---

## Installation / Running

`ghidriff` will run anywhere Python will run. Follow the [Quick Start Setup](<Quick Start Environment Setup.md>) for details.

## Diffing on various platforms (or where is this useful?)

> Will `ghidriff` diff my platform?
Always.

> Will `ghidriff` do it well??
That depends. :)


You should be able to diff any binary that Ghidra can analyze and decompile. Typically, this native code outside of frameworks.

### Windows

Binary diffing with `ghidriff` Windows works best with native Windows binaries (unmanaged) vs(managed) .NET code. It's not impossible, but diffing managed code via Ghidra has mixed results. You are better off using something like [dnSpy](https://github.com/dnSpy/dnSpy) to decompile the application and then just text diff the result.





## Mac / iOS

Ghidra is getting much better at analyzing and decompiling objective-c. Mac/iOS binaries both x64 and arm64 should work. Give it a shot.

## Android

For any native arm binary Ghidra should do well. If you want to through in an APK, you will need to pull out the binaries to diff.

## Linux / iOT

Again, if Ghidra can handle the analysis, give it a shot.
12 changes: 10 additions & 2 deletions www/docs/Social Diffing/Social Diffing.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ image: /img/social-diffing.png
---

![Alt text](../../static/img/social-diffing.png)
As the diff output of `ghidriff` is markdown, it can be shared almost anywhere.

> If GitHub can provide “social coding”, ghidriff can provide “social diffing”. Since the diff output is in markdown, you can publish the diff wherever markdown is supported. All the sections within the markdown are deep linked, which is great for sharing and pointing out specific areas of interest. - [Ghidriff Blog Post](https://clearbluejar.github.io/posts/ghidriff-ghidra-binary-diffing-engine/#social-binary-diffing)

### Sample Diffs

Expand Down Expand Up @@ -46,8 +48,14 @@ Just copy paste to new file and make sure to set the filetype to `md`.

## Publishing on a blog

See some of the samples posted in the diffs(/diffs). If the blog enginer can render markdown, it should work.
See some of the samples posted in the [diffs](/diffs/category/). If the blog enginer can render markdown, it should work.


## Tweet with deep links

> Here is an example of social diffing with CVE-2023-38140 from a recent post on Twitter. As each function is a deep-link, you can highlight (with deep-links) to the functions of interest. - [Ghidriff Blog Post](https://clearbluejar.github.io/posts/ghidriff-ghidra-binary-diffing-engine/#social-binary-diffing)
> [![](https://clearbluejar.github.io/assets/img/2023-12-20-ghidriff-ghidra-binary-diffing-engine/cve-2023-38140.png)](https://twitter.com/clearbluejar/status/1711613511367868845)



0 comments on commit 4de176a

Please sign in to comment.