% docker run -it --rm -v $(pwd)/ghidriffs:/ghidriffs ghcr.io/clearbluejar/ghidriff:0.6.2 ghidriffs/archiveint.dll.x64.10.0.19041.3636 ghidriffs/archiveint.dll.x64.10.0.19041.3930
INFO | ghidriff | Init Ghidra Diff Engine...
INFO | ghidriff | Engine Console Log: INFO
INFO | ghidriff | Engine File Log: ghidriffs/ghidriff.log INFO
INFO | ghidriff | Starting Ghidra...
INFO Using log config file: jar:file:/ghidra/Ghidra/Framework/Generic/lib/Generic.jar!/generic.log4j.xml (LoggingInitialization)
INFO Using log file: /ghidriffs/ghidriff.log (LoggingInitialization)
INFO Loading user preferences: /home/vscode/.ghidra/.ghidra_11.0.1_PUBLIC/preferences (Preferences)
INFO Searching for classes... (ClassSearcher)
INFO Class search complete (1919 ms) (ClassSearcher)
INFO Initializing SSL Context (SSLContextInitializer)
INFO Initializing Random Number Generator... (SecureRandomFactory)
INFO Random Number Generator initialization complete: NativePRNGNonBlocking (SecureRandomFactory)
INFO Trust manager disabled, cacerts have not been set (ApplicationTrustManagerFactory)
INFO | ghidriff | GHIDRA_INSTALL_DIR: /ghidra
INFO | ghidriff | GHIDRA 11.0.1 Build Date: 2024-Jan-30 1212 EST Release: PUBLIC
INFO | ghidriff | Engine Args:
INFO | ghidriff | old: ['ghidriffs/archiveint.dll.x64.10.0.19041.3636']
INFO | ghidriff | new: [['ghidriffs/archiveint.dll.x64.10.0.19041.3930']]
INFO | ghidriff | engine: VersionTrackingDiff
INFO | ghidriff | output_path: ghidriffs
INFO | ghidriff | summary: False
INFO | ghidriff | project_location: ghidra_projects
INFO | ghidriff | project_name: ghidriff
INFO | ghidriff | symbols_path: symbols
INFO | ghidriff | threaded: True
INFO | ghidriff | force_analysis: False
INFO | ghidriff | force_diff: False
INFO | ghidriff | no_symbols: False
INFO | ghidriff | log_level: INFO
INFO | ghidriff | file_log_level: INFO
INFO | ghidriff | log_path: ghidriff.log
INFO | ghidriff | va: False
INFO | ghidriff | min_func_len: 10
INFO | ghidriff | use_calling_counts: False
INFO | ghidriff | bsim: True
INFO | ghidriff | bsim_full: False
INFO | ghidriff | max_ram_percent: 60.0
INFO | ghidriff | print_flags: False
INFO | ghidriff | jvm_args: None
INFO | ghidriff | side_by_side: False
INFO | ghidriff | max_section_funcs: 200
INFO | ghidriff | md_title: None
INFO | ghidriff | Setting Up Ghidra Project...
INFO Creating project: /ghidriffs/ghidra_projects/ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930/ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930 (DefaultProject)
INFO | ghidriff | Created project: ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930
INFO | ghidriff | Project Location: /ghidriffs/ghidra_projects/ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930/
INFO | ghidriff | Importing ghidriffs/archiveint.dll.x64.10.0.19041.3636 as archiveint.dll.x64.10.0.19041.3636-2965b7
INFO Starting cache cleanup: /tmp/vscode-Ghidra/fscache2 (FileCacheMaintenanceDaemon)
INFO Finished cache cleanup, estimated storage used: 0 (FileCacheMaintenanceDaemon)
INFO Using Loader: Portable Executable (PE) (AutoImporter)
INFO Using Language/Compiler: x86:LE:64:default:windows (AutoImporter)
INFO | ghidriff | Loaded archiveint.dll.x64.10.0.19041.3636 - .ProgramDB
INFO | ghidriff | Importing ghidriffs/archiveint.dll.x64.10.0.19041.3930 as archiveint.dll.x64.10.0.19041.3930-8e614a
INFO Using Loader: Portable Executable (PE) (AutoImporter)
INFO Using Language/Compiler: x86:LE:64:default:windows (AutoImporter)
INFO | ghidriff | Loaded archiveint.dll.x64.10.0.19041.3930 - .ProgramDB
INFO | ghidriff | Project Files:
INFO | ghidriff | ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930:/archiveint.dll.x64.10.0.19041.3636-2965b7
INFO | ghidriff | ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930:/archiveint.dll.x64.10.0.19041.3930-8e614a
INFO | ghidriff | Setting up Symbol Server for symbols...
INFO | ghidriff | path: ghidriffs/symbols level: 1
INFO | ghidriff | Symbol Server Configured path: SymbolServerService:
symbolStore: LocalSymbolStore: [ rootDir: /home/vscode/ghidriffs/symbols, storageLevel: -1],
symbolServers:
HttpSymbolServer: [ url: https://msdl.microsoft.com/download/symbols/, storageLevel: -1]
HttpSymbolServer: [ url: https://chromium-browser-symsrv.commondatastorage.googleapis.com/, storageLevel: -1]
HttpSymbolServer: [ url: https://symbols.mozilla.org/, storageLevel: -1]
HttpSymbolServer: [ url: https://software.intel.com/sites/downloads/symbols/, storageLevel: -1]
HttpSymbolServer: [ url: https://driver-symbols.nvidia.com/, storageLevel: -1]
HttpSymbolServer: [ url: https://download.amd.com/dir/bin/, storageLevel: -1]
INFO Connecting to https://msdl.microsoft.com/download/symbols/ (ConsoleTaskMonitor)
INFO Success (ConsoleTaskMonitor)
INFO Storing archiveint.pdb in local symbol store (954.37KB) (ConsoleTaskMonitor)
INFO | ghidriff | Pdb stored at: /home/vscode/ghidriffs/symbols/archiveint.pdb/FB22DBCC35667DDF4AABCA184DB6CDEE1/archiveint.pdb
INFO Connecting to https://msdl.microsoft.com/download/symbols/ (ConsoleTaskMonitor)
INFO Success (ConsoleTaskMonitor)
INFO Storing archiveint.pdb in local symbol store (954.37KB) (ConsoleTaskMonitor)
INFO | ghidriff | Pdb stored at: /home/vscode/ghidriffs/symbols/archiveint.pdb/50C4F199BABB8F890730E05FA35366B51/archiveint.pdb
INFO | ghidriff | Program: archiveint.dll.x64.10.0.19041.3636-2965b7 imported: True has_pdb: True pdb_loaded: False analyzed False
INFO | ghidriff | Program: archiveint.dll.x64.10.0.19041.3930-8e614a imported: True has_pdb: True pdb_loaded: False analyzed False
INFO | ghidriff | Starting analysis for 2 binaries
INFO | ghidriff | Analyzing: archiveint.dll.x64.10.0.19041.3930 - .ProgramDB
INFO | ghidriff | Analyzing: archiveint.dll.x64.10.0.19041.3636 - .ProgramDB
INFO | ghidriff | Starting Ghidra analysis of archiveint.dll.x64.10.0.19041.3636 - .ProgramDB...
INFO PDB analyzer parsing file: /home/vscode/ghidriffs/symbols/archiveint.pdb/FB22DBCC35667DDF4AABCA184DB6CDEE1/archiveint.pdb (PdbUniversalAnalyzer)
INFO resolveCount: 0 (DefaultPdbApplicator)
INFO | ghidriff | Starting Ghidra analysis of archiveint.dll.x64.10.0.19041.3930 - .ProgramDB...
INFO PDB analyzer parsing file: /home/vscode/ghidriffs/symbols/archiveint.pdb/50C4F199BABB8F890730E05FA35366B51/archiveint.pdb (PdbUniversalAnalyzer)
INFO resolveCount: 0 (DefaultPdbApplicator)
INFO PDB Terminated Normally (DefaultPdbApplicator)
INFO PDB Terminated Normally (DefaultPdbApplicator)
INFO Packed database cache: /tmp/vscode-Ghidra/packed-db-cache (PackedDatabaseCache)
INFO Applied data type archive: windows_vs12_64 (ApplyDataArchiveAnalyzer)
INFO Applied data type archive: windows_vs12_64 (ApplyDataArchiveAnalyzer)
WARN ghidra.app.script.GhidraScriptLoadException: Unexpected error: java.nio.channels.OverlappingFileLockException (OverlappingFileLockException)
ghidra.app.script.GhidraScriptLoadException: Unexpected error: java.nio.channels.OverlappingFileLockException
at ghidra.app.script.JavaScriptProvider.getScriptInstance(JavaScriptProvider.java:129)
at ghidra.app.plugin.prototype.MicrosoftCodeAnalyzerPlugin.WindowsResourceReferenceAnalyzer.runScript(WindowsResourceReferenceAnalyzer.java:97)
at ghidra.app.plugin.prototype.MicrosoftCodeAnalyzerPlugin.WindowsResourceReferenceAnalyzer.added(WindowsResourceReferenceAnalyzer.java:72)
at ghidra.app.plugin.core.analysis.AnalysisScheduler.runAnalyzer(AnalysisScheduler.java:186)
at ghidra.app.plugin.core.analysis.AnalysisTask.applyTo(AnalysisTask.java:39)
at ghidra.app.plugin.core.analysis.AutoAnalysisManager$AnalysisTaskWrapper.run(AutoAnalysisManager.java:686)
at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:786)
at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:665)
at ghidra.program.flatapi.FlatProgramAPI.analyzeChanges(FlatProgramAPI.java:229)
at ghidra.program.flatapi.FlatProgramAPI.analyzeAll(FlatProgramAPI.java:206)
INFO Evicting 3 filesystems from cache (FileSystemInstanceManager)
INFO -----------------------------------------------------
ASCII Strings 1.710 secs
Apply Data Archives 2.027 secs
Call Convention ID 0.135 secs
Call-Fixup Installer 0.009 secs
Create Address Tables 0.222 secs
Create Address Tables - One Time 0.136 secs
Create Function 0.177 secs
Data Reference 0.541 secs
Decompiler Parameter ID 28.533 secs
Decompiler Switch Analysis 1.575 secs
Demangler Microsoft 2.271 secs
Disassemble 0.001 secs
Disassemble Entry Points 0.759 secs
Disassemble Entry Points - One Time 0.104 secs
Embedded Media 0.056 secs
External Entry References 0.001 secs
Function ID 0.968 secs
Function Start Search 0.098 secs
Non-Returning Functions - Discovered 0.132 secs
Non-Returning Functions - Known 0.011 secs
PDB Universal 4.921 secs
Reference 0.256 secs
Scalar Operand References 0.825 secs
Shared Return Calls 0.379 secs
Stack 12.328 secs
Subroutine References 0.327 secs
Subroutine References - One Time 0.016 secs
Windows x86 PE Exception Handling 0.141 secs
Windows x86 PE RTTI Analyzer 0.007 secs
Windows x86 Thread Environment Block (TEB) Analyzer 0.042 secs
WindowsResourceReference 0.030 secs
x86 Constant Reference Analyzer 8.010 secs
-----------------------------------------------------
Total Time 66 secs
-----------------------------------------------------
(AutoAnalysisManager)
INFO | ghidriff | Analysis for ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930:/archiveint.dll.x64.10.0.19041.3636-2965b7 complete
INFO -----------------------------------------------------
ASCII Strings 0.071 secs
Apply Data Archives 2.025 secs
Call Convention ID 0.090 secs
Call-Fixup Installer 0.022 secs
Create Address Tables 0.224 secs
Create Address Tables - One Time 0.124 secs
Create Function 0.171 secs
Data Reference 0.475 secs
Decompiler Parameter ID 28.842 secs
Decompiler Switch Analysis 1.599 secs
Demangler Microsoft 2.282 secs
Disassemble 0.003 secs
Disassemble Entry Points 0.766 secs
Disassemble Entry Points - One Time 0.096 secs
Embedded Media 0.048 secs
External Entry References 0.001 secs
Function ID 0.960 secs
Function Start Search 0.090 secs
Non-Returning Functions - Discovered 0.120 secs
Non-Returning Functions - Known 0.020 secs
PDB Universal 4.524 secs
Reference 0.295 secs
Scalar Operand References 0.779 secs
Shared Return Calls 0.399 secs
Stack 8.183 secs
Subroutine References 0.337 secs
Subroutine References - One Time 0.033 secs
Windows x86 PE Exception Handling 0.140 secs
Windows x86 PE RTTI Analyzer 0.004 secs
Windows x86 Thread Environment Block (TEB) Analyzer 0.040 secs
WindowsResourceReference 6.972 secs
x86 Constant Reference Analyzer 8.055 secs
-----------------------------------------------------
Total Time 67 secs
-----------------------------------------------------
(AutoAnalysisManager)
INFO | ghidriff | Analysis for ghidriff-archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930:/archiveint.dll.x64.10.0.19041.3930-8e614a complete
INFO | ghidriff | Diffing bins: ghidriffs/archiveint.dll.x64.10.0.19041.3636 - ghidriffs/archiveint.dll.x64.10.0.19041.3930
INFO | ghidriff | Setup 16 decompliers
INFO | ghidriff | Loaded old program: archiveint.dll.x64.10.0.19041.3636
INFO | ghidriff | Loaded new program: archiveint.dll.x64.10.0.19041.3930
INFO | ghidriff | p1 sym count: reported: 15300 analyzed: 1970
INFO | ghidriff | p2 sym count: reported: 15415 analyzed: 1988
INFO | ghidriff | Found unmatched: 20 matched: 1969 symbols
INFO Hashing symbols in archiveint.dll.x64.10.0.19041.3636 (ConsoleTaskMonitor)
INFO Hashing symbols in archiveint.dll.x64.10.0.19041.3930 (ConsoleTaskMonitor)
INFO Eliminate non-unique matches (ConsoleTaskMonitor)
INFO Finding symbol matches (ConsoleTaskMonitor)
INFO | ghidriff | Exec time: 0.1081 secs
INFO | ghidriff | Match count 6219
INFO | ghidriff | Counter({('SymbolsHash',): 1698})
INFO | ghidriff | Running correlator: ExactBytesFunctionHasher
INFO | ghidriff | name: ExactBytesFunctionHasher one_to_one: True one_to_many: False
INFO Hashing functions in archiveint.dll.x64.10.0.19041.3636 (ConsoleTaskMonitor)
INFO Hashing functions in archiveint.dll.x64.10.0.19041.3930 (ConsoleTaskMonitor)
INFO Finding function matches (ConsoleTaskMonitor)
INFO | ghidriff | Match count: 26
INFO | ghidriff | ExactBytesFunctionHasher Exec time: 0.0823 secs
INFO | ghidriff | Running correlator: ExactInstructionsFunctionHasher
INFO | ghidriff | name: ExactInstructionsFunctionHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 52
INFO | ghidriff | ExactInstructionsFunctionHasher Exec time: 0.0592 secs
INFO | ghidriff | Running correlator: StructuralGraphExactHash
INFO | ghidriff | name: StructuralGraphExactHash one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | StructuralGraphExactHash Exec time: 0.2106 secs
INFO | ghidriff | Running correlator: ExactMnemonicsFunctionHasher
INFO | ghidriff | name: ExactMnemonicsFunctionHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | ExactMnemonicsFunctionHasher Exec time: 0.0390 secs
INFO | ghidriff | Running correlator: BSIM
INFO | ghidriff | name: BSIM one_to_one: True one_to_many: False
INFO | ghidriff | Starting BSIM correlator
INFO | ghidriff | Match Set 0 - 1776 matches [Correlator=Manual Match]
INFO | ghidriff | Match Set -1 - 0 matches [Correlator=Implied Match]
INFO BSim Program Correlator could not find any seeds (BSimProgramCorrelator)
INFO | ghidriff | Match Set 1 - 0 matches [Correlator=BSim Function Matching]
INFO | ghidriff | BSIM Exec time: 2.6747 secs
INFO | ghidriff | Running correlator: BulkInstructionHash
INFO | ghidriff | name: BulkInstructionHash one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | BulkInstructionHash Exec time: 0.0404 secs
INFO | ghidriff | Running correlator: SigCallingCalledHasher
INFO | ghidriff | name: SigCallingCalledHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | SigCallingCalledHasher Exec time: 0.0427 secs
INFO | ghidriff | Running correlator: StringsRefsHasher
INFO | ghidriff | name: StringsRefsHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | StringsRefsHasher Exec time: 1.7513 secs
INFO | ghidriff | Running correlator: StrUniqueFuncRefsHasher
INFO | ghidriff | name: StrUniqueFuncRefsHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | StrUniqueFuncRefsHasher Exec time: 0.0197 secs
INFO | ghidriff | Running correlator: SwitchSigHasher
INFO | ghidriff | name: SwitchSigHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | SwitchSigHasher Exec time: 0.6567 secs
INFO | ghidriff | Running correlator: StructuralGraphHash
INFO | ghidriff | name: StructuralGraphHash one_to_one: True one_to_many: True
INFO | ghidriff | Match count: 4
INFO | ghidriff | StructuralGraphHash Exec time: 0.0486 secs
INFO | ghidriff | Running correlator: BulkBasicBlockMnemonicHash
INFO | ghidriff | name: BulkBasicBlockMnemonicHash one_to_one: True one_to_many: True
INFO | ghidriff | Match count: 0
INFO | ghidriff | BulkBasicBlockMnemonicHash Exec time: 0.0294 secs
INFO | ghidriff | Running correlator: SigCallingCalledHasher
INFO | ghidriff | name: SigCallingCalledHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | SigCallingCalledHasher Exec time: 0.0239 secs
INFO | ghidriff | Running correlator: StringsRefsHasher
INFO | ghidriff | name: StringsRefsHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | StringsRefsHasher Exec time: 0.0131 secs
INFO | ghidriff | Running correlator: StrUniqueFuncRefsHasher
INFO | ghidriff | name: StrUniqueFuncRefsHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | StrUniqueFuncRefsHasher Exec time: 0.0216 secs
INFO | ghidriff | Running correlator: SwitchSigHasher
INFO | ghidriff | name: SwitchSigHasher one_to_one: True one_to_many: False
INFO | ghidriff | Match count: 0
INFO | ghidriff | SwitchSigHasher Exec time: 0.0127 secs
INFO | ghidriff | Counter({('SymbolsHash',): 1698, ('ExactInstructionsFunctionHasher',): 52, ('ExactBytesFunctionHasher',): 26, ('StructuralGraphHash',): 4})
INFO | ghidriff | Running correlator: Implied matches on p1:0 p2:0
INFO | ghidriff | p1 missing = 0
INFO | ghidriff | p2 missing = 8
INFO | ghidriff | Externs - deleted: 0 added: 2 matched:162
INFO | ghidriff | Deduping symbols and functions...
WARNING| ghidriff | Removing function dupe: GetProcAddress
WARNING| ghidriff | Removing symbol dupe: GetProcAddress
INFO | ghidriff | Sorting symbols and strings...
INFO | ghidriff | Sorting functions...
INFO | ghidriff | Starting esym lookups for 38 symbols using 8 threads
INFO | ghidriff | Completed 2 at 5%
INFO | ghidriff | Completed 4 at 10%
INFO | ghidriff | Completed 6 at 15%
INFO | ghidriff | Completed 8 at 21%
INFO | ghidriff | Completed 10 at 26%
INFO | ghidriff | Completed 12 at 31%
INFO | ghidriff | Completed 14 at 36%
INFO | ghidriff | Completed 16 at 42%
INFO | ghidriff | Completed 18 at 47%
INFO | ghidriff | Completed 20 at 52%
INFO | ghidriff | Completed 22 at 57%
INFO | ghidriff | Completed 24 at 63%
INFO | ghidriff | Completed 26 at 68%
INFO | ghidriff | Completed 28 at 73%
INFO | ghidriff | Completed 30 at 78%
INFO | ghidriff | Completed 32 at 84%
INFO | ghidriff | Completed 34 at 89%
INFO | ghidriff | Completed 36 at 94%
INFO | ghidriff | Completed 38 at 100%
INFO | ghidriff | Finished diffing old program: archiveint.dll.x64.10.0.19041.3636
INFO | ghidriff | Finished diffing program: archiveint.dll.x64.10.0.19041.3930
INFO | ghidriff | Writing md diff...
INFO | ghidriff | Generating markdown from {'added_funcs_len': 9, 'deleted_funcs_len': 0, 'modified_funcs_len': 8, 'added_symbols_len': 15, 'deleted_symbols_len': 0, 'diff_time': 10.457451820373535, 'deleted_strings_len': 0, 'added_strings_len': 4, 'match_types': Counter({'SymbolsHash': 1698, 'ExternalsName': 162, 'ExactInstructionsFunctionHasher': 52, 'ExactBytesFunctionHasher': 26, 'StructuralGraphHash': 4}), 'items_to_process': 32, 'diff_types': Counter({'refcount': 7, 'address': 7, 'calling': 6, 'code': 1, 'length': 1, 'sig': 1, 'called': 1}), 'unmatched_funcs_len': 9, 'total_funcs_len': 3566, 'matched_funcs_len': 3557, 'matched_funcs_with_code_changes_len': 1, 'matched_funcs_with_non_code_changes_len': 7, 'matched_funcs_no_changes_len': 3549, 'match_func_similarity_percent': '99.7751%', 'func_match_overall_percent': '99.7476%', 'first_matches': Counter({'SymbolsHash': 1698, 'ExactInstructionsFunctionHasher': 52, 'ExactBytesFunctionHasher': 26, 'StructuralGraphHash': 4})}
INFO | ghidriff | Known Command line: ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --bsim --max-ram-percent 60.0 --max-section-funcs 200 archiveint.dll.x64.10.0.19041.3636 archiveint.dll.x64.10.0.19041.3930
INFO | ghidriff | Extra Command line: --engine VersionTrackingDiff --output-path ghidriffs
INFO | ghidriff | Writing pdiff json...
INFO | ghidriff | Wrote ghidriffs/archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930.ghidriff.md
INFO | ghidriff | Wrote ghidriffs/json/archiveint.dll.x64.10.0.19041.3636-archiveint.dll.x64.10.0.19041.3930.ghidriff.json
Last active
March 6, 2024 18:06
-
-
Save clearbluejar/b733ce20947b1c92a85bbc6a33fabaec to your computer and use it in GitHub Desktop.
Patch Diffing CVE-2024-20696 With `ghidriff` Console Output
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment