generated from clearbluejar/ghidra-python-vscode-devcontainer-skeleton
-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
5f78f4c
commit ff0bd71
Showing
10 changed files
with
507 additions
and
467 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
|
||
|
||
|
||
[![ghidriff vs bindiff](../../static/img/ghidriff-v-bindiff.png)](https://twitter.com/clearbluejar/status/1712093656708976868) | ||
|
||
> 😆 In all seriousness, #bindiff is amazing. I use it alongside #ghidriff for really complicated diffs. (ie bindiff matching > ghidriff matching). Currently, I see ghidriff offering an edge for automation (via command-line diffing) and output (markdown). As the tools are both now open source, it will be fun to see how they evolve for the benefit of the community. - [Tweet](https://twitter.com/clearbluejar/status/1712095731924779370) |
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -5,5 +5,5 @@ | |
"type": "generated-index", | ||
"description": "README Sections" | ||
}, | ||
"collapsed": false | ||
"collapsed": true | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,53 @@ | ||
--- | ||
description: Sharing diff results | ||
img: /static/img/social-diffing.png | ||
--- | ||
|
||
![Alt text](../../static/img/social-diffing.png) | ||
As the diff output of `ghidriff` is markdown, it can be shared almost anywhere. | ||
|
||
### Sample Diffs | ||
|
||
<div> | ||
<a href="https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282"><img width="30%" align=top alt="image" src="https://github.com/clearbluejar/ghidriff/assets/3752074/d53b681f-8cc9-479c-af4c-5ec697cf4989"></a> | ||
<a href="https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282#visual-chart-diff"><img width="30%" align=top alt="image" src="https://github.com/clearbluejar/ghidriff/assets/3752074/16d7ae4c-4df9-4bcd-b4af-0ce576d49ad1"></a> | ||
<div> | ||
|
||
|
||
## Github | ||
|
||
### Gists | ||
|
||
- Host your recent diff in a GitHub gist: [https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282](https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282) | ||
- Deep link to interesting | ||
- functions | ||
- [CnRenameKey](https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282#cmrenamekey) | ||
- command-line | ||
- [ghidriff command line](https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282#command-line) | ||
|
||
|
||
### READMEs | ||
|
||
## Posting to a Github Gist | ||
|
||
After you create you diff it will be located in `ghidriffs/diff.md`. | ||
|
||
### Option 1: Post using `gh` client | ||
|
||
`cat` to `stdin`: | ||
|
||
```bash | ||
cat ghidriff.md | gh gist create -f ghidriff.gist.filename.md - | ||
``` | ||
|
||
### Option 2: Copy/Paste Markdown to new gist | ||
|
||
Just copy paste to new file and make sure to set the filetype to `md`. | ||
|
||
## Publishing on a blog | ||
|
||
See some of the samples posted in the diffs(/diffs). If the blog enginer can render markdown, it should work. | ||
|
||
|
||
## Tweet with deep links | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
--- | ||
description: Diffing CVE-2023-21768 - The perfect diff (one line change only) | ||
--- | ||
|
||
|
||
Details of the CVE-2023-21768 (detailed in this blog [post](https://securityintelligence.com/posts/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/)). What if you wanted to repeat this patch diff with `ghidriff`? | ||
|
||
1. Download two versions of `AFD.sys` (vulnerable and patched): | ||
|
||
```bash | ||
wget https://msdl.microsoft.com/download/symbols/afd.sys/0C5C6994A8000/afd.sys -O afd.sys.x64.10.0.22621.1028 | ||
wget https://msdl.microsoft.com/download/symbols/afd.sys/50989142A9000/afd.sys -O afd.sys.x64.10.0.22621.1415 | ||
``` | ||
|
||
2. Run `ghidriff`: | ||
|
||
```bash | ||
ghidriff afd.sys.x64.10.0.22621.1028 afd.sys.x64.10.0.22621.1415 | ||
``` | ||
|
||
3. Review results | ||
|
||
The diff results are posted in this GitHub [gist](https://gist.github.com/clearbluejar/f6fecbc507a9f1a92c9231e3db7ef40d). The vulnerable function `AfdNotifyRemoveIoCompletion` was identified here with a [single line change](https://gist.github.com/clearbluejar/f6fecbc507a9f1a92c9231e3db7ef40d#afdnotifyremoveiocompletion-diff). | ||
|
||
Want to see the entire diff in a side by side? https://diffpreview.github.io/?f6fecbc507a9f1a92c9231e3db7ef40d or jump to the [single line change](https://diffpreview.github.io/?f6fecbc507a9f1a92c9231e3db7ef40d#d2h-703858:~:text=ProbeForWrite(*(PVOID%20*)(param_3%20%2B%200x18)%2C4%2C4)%3B) | ||
|
Large diffs are not rendered by default.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.