Live data from Hacker News

BinDiff now available for free

security.googleblog.com

31–35 of 35 posts

Re: BinDiff now available for free

#31
post #2

To be clear, it is still a plugin for a ~$5000 application. Nonetheless, thanks Google for lowering the bar for entry into professional security work!

You only need the IDA Pro Starter Edition (589 USD, 32-bit files only) or the regular IDA Pro version for a single architecture (1129 USD). Even so, IDA comes with decades of RE experience baked into its heuristics and analysis features. It's quirky, yes, but as a professional tool it's also worth the money.

Re: BinDiff now available for free

#32
post #6

Why is the linked site served over http? http://www.zynamics.com/software.html Changing to https reveals a security cert valid for *.google.com, but not for www.zynamics.com.

Yeah that's a sore point :-/ The downloads are served via HTTPS, though. Also, publishing the SHA1 hashes over HTTP kind of defeats the purpose, so here they are again (HackerNews is HTTPS :)):

bindiff420-debian8-amd64.deb 38fbea8070495fc8730d7c86eae03bc68fde291f bindiff420-debian8-i386.deb 49cdd6ae7ebe5b1813a5fcafaae9fde19005c824 bindiff420-win-pluginsonly.zip e2b786d405aac23aced989e02080dd69c18ab75e bindiff420-win-x86.msi 89f2eadc6582d4acca1e78db3617b5fba3eced0f bindiff-license-key.zip 95715a8bd7469106fc60b03f94f3cc87604e354c

Re: BinDiff now available for free

#34
post #25

Shameless plug: Several years ago I did a tool that shows differences between disassembled functions basic-block graphs, that you can use for free and it is GPLv2 licensed. I believe my tool shows the differences in a better way than bindiff, and it piggybacks on a disassembler made by a former coworker and friend. Maybe someone wants to use it. http://www.coresecurity.com/corelabs-research/open-source-to... PS: I do…

> I don't work at Core Security anymore Where do you work now?

Now I work at a small company named Disarmista.

Re: BinDiff now available for free

#35

This would have been news worthy 10 years ago. Today, it's more like shrug who cares. Dependency on IDA, closed source, limited platform support, Java/Swing ... Far better free solutions out there.

LOL, haters gonna hate. So let's see...

- BinDiff would work stand-alone if someone wrote an exporter for another disassembler (BinDiff uses https://github.com/google/binexport for that).

- Closed source - yeah it contains some secret sauce and also depends on a commercial graph library (yFiles). Not easily replaced. Their product is also pretty good.

- Limited platform support - well, there is an older OS X version as well and we have this on our radar for future releases.

- Far better free solutions - please do show. Maybe we can do a diff-off some time :)

YOLO :P

Post reply on HN