ohjeongwook/darungrim

A patch analysis tool

darungrim's Issues

Native binary for linux without winapi traces

It'd be nice to have.

"IndexError: list index out of range" during diffing

I got a 500 Internal server error with this output: (on the page http://127.0.0.1/StartDiff?patch_id=1&download_id=2&file_id=1&source_id=0&target_id=0

after I clicked Start Diffing)
Traceback (most recent call last):
File "cherrypy_cprequest.pyc", line 606, in respond
File "cherrypy_cpdispatch.pyc", line 25, in call
File "DarunGrim3Server.py", line 62, in StartDiff
File "HTMLGenerator.pyc", line 839, in StartDiff
File "DarunGrimSessions.pyc", line 81, in InitFileDiffByID
IndexError: list index out of range

Before that, I was on this page below ...
List >MS10-001 >Windows XP Service Pack 2 and Windows XP Service Pack 3
Company Name Microsoft Corporation
Operating System xpsp
Service Pack sp2
Filename fontsub.dll
Unpatched Filename Not Found: Not Found
Patched Filename MS10-001: fontsub.dll

My guess is that this error is the result of not having a baseline file to diff against. Is that right?

Use this repository for public binary analysis intelligence service

DarunGrim2.plw permissions error

Upong connecting to localhost, there is an http 500 error when using darungrim on IDA 5.7 / Windows7.
The problem seems to be not having the right permissions to copy "C:\Program Files (x86)\IDA\plugins\DarunGrim2.plw" to the right folder.
This should either be done automatically, or mentioned in the manual that the user should copy the plugin manually.

FileStore.py uses incorrect GetFilesBySHA1 usage

It only passes the sha1, but the API requires 7 params.

Unpacking MS Patches issues

I went to MS10-057 and it caused the error:
"Command line option syntax error. Type Command /? for Help". The
extract command was using cmd.exe /c path1 /x:path2 /quiet ---
changing it to /T:path2 /C seemed to work instead.

Easy DarunGrim

• automatic search of IDA installed directory
• simple search through the patch history on the machine (no additional user configuration)
  and choose target patch to diff

For File Import, commit for some files fails

Here's an example. It happens randomly.

target_full_filename C:\Users\matt\Desktop\DarunGrim3\Bin\Binaries\Microsoft Corporation\PresentationNative_v0300.dll\3.0.6920.4902 built by_ NetFXw7\PresentationNative_v0300.dll
Failed to Commit
Traceback (most recent call last):
File "PatchDatabaseWrapper.pyc", line 312, in Commit
File "sqlalchemy\orm\session.pyc", line 655, in commit
File "sqlalchemy\orm\session.pyc", line 372, in commit
File "sqlalchemy\engine\base.pyc", line 1390, in commit
File "sqlalchemy\engine\base.pyc", line 1417, in _do_commit
File "sqlalchemy\engine\base.pyc", line 1037, in _commit_impl
File "sqlalchemy\engine\base.pyc", line 1034, in _commit_impl
File "sqlalchemy\engine\default.pyc", line 253, in do_commit
OperationalError: (OperationalError) cannot commit - no transaction is active No
ne None
Failed to Commit
Traceback (most recent call last):
File "PatchDatabaseWrapper.pyc", line 312, in Commit
File "sqlalchemy\orm\session.pyc", line 655, in commit
File "sqlalchemy\orm\session.pyc", line 372, in commit
File "sqlalchemy\engine\base.pyc", line 1390, in commit
File "sqlalchemy\engine\base.pyc", line 1417, in _do_commit
File "sqlalchemy\engine\base.pyc", line 1037, in _commit_impl
File "sqlalchemy\engine\base.pyc", line 1034, in _commit_impl
File "sqlalchemy\engine\default.pyc", line 253, in do_commit
OperationalError: (OperationalError) cannot commit - no transaction is active None None

Image on the page seems to be broken.

The image on the 2nd page(1st image), 12th page, 13th page of the following document seems to be broken.
http://github.com/ohjeongwook/DarunGrim/blob/master/Publish/Docs/DarunGrim3%20Installation.odt

Don't run DarunGrim2 Plugin

After selecting a series of menu entries to open IDA as the following :
List >MS10-001 >Windows XP Service Pack 2 and Windows XP Service Pack 3 >fontsub.dll [Open IDA]

and then selecting the dfg file after running DarunGrim2 generates the following message, but the changes are not reflected in IDA.
Is a Gui Diff window supposed to pop up like the earlier versions of Darumgrim2?

Start DarunGrim2 Plugin
Opening Database [C:\CodeEngn\Tools\DarunGrim3\Output\1708_3324.dgf]
Retrieving File Information
Sending Analyzed Information
Sent All Analysis Informations
DarunGrim2 Analysis Finished 1.953 sec

Temporary IDC file extension issue with IDA 5.7

From blake:

I got the error "Dar16.tmp: unknown file extention", I
assume this is an error because recent versions of IDA now support
Python and IDC scripting. Therefore, you should change the temporary
filename to "Dar16.idc" instead!
I tested this with the command (and it seems to work now):
idag -A -Sc:\dar16.idc c:\iepeers.dll

The pre-built binary download link is not working

The download link is not working due to warning from google "this file is infected with a virus". Wouldn't it be create a release section with final compiled binaries ?

qstrncat error with IDA 5.7

From blake.

1. I seem to be getting an error in IDA.WLL, "The procedure entry
   point qstrncat could not be located in the dynamic link library
   IDA.WLL. The basic reason for this is that I never installed the
   DarunGrim2 IDA plugin. A copied DarunGrim2.plw into my plugins
   directory to fix this.

Issue with Analysing two binaries

Hey, I have been trying to analyse two binaries, but to no avail. Here is the error log:

[07/23/2015 23:03:27] [DarunGrim] DarunGrim::PerformDiff: (output storage: (Directory)/1322_134_compare.dgf)
[07/23/2015 23:03:27] [DarunGrim] source_address: 0
[07/23/2015 23:03:27] [DarunGrim] target_address: 0
[07/23/2015 23:03:27] [DarunGrim] Loading (Directory)/1322_134_compare.dgf
[07/23/2015 23:03:27] [DarunGrim] DiffMachine::Create
[07/23/2015 23:03:27] [DarunGrim] Loading (Directory)/dg1322.dgf
[07/23/2015 23:03:27] [DarunGrim] Loading (Directory)/dg134.dgf
[07/23/2015 23:03:27] [DarunGrim] DiffMachine::_Load
[07/23/2015 23:03:27] [DarunGrim] SourceFunctionAddress: 0
[07/23/2015 23:10:11] [DarunGrim] Analyze
[07/23/2015 23:10:11] [DarunGrim] DiffMachine::Analyze: Fingerprint Map Size 730542:859908
[07/23/2015 23:10:11] [DarunGrim] Name Match
[07/23/2015 23:10:12] [DarunGrim] Name Match Ended
[07/23/2015 23:10:12] [DarunGrim] DiffMachine::Analyze: Name matched number=3239
[07/23/2015 23:10:12] [DarunGrim] DiffMachine::Analyze: DoFingerPrintMatch
[07/23/2015 23:21:15] [DarunGrim] DiffMachine::DoFingerPrintMatch: Matched pair count=31040
[07/23/2015 23:21:15] [DarunGrim] DiffMachine::Analyze: Match Map Size: 31040
[07/23/2015 23:21:15] [DarunGrim] DiffMachine::Analyze: DoIsomorphMatch
[07/23/2015 23:21:15] [DarunGrim] DiffMachine::DoIsomorphMatch: Current match count=31040
[07/23/2015 23:21:15] [DarunGrim] DiffMachine::DoIsomorphMatch: 100/31040 Items processed and produced 197 match entries.
[07/23/2015 23:21:15] [DarunGrim] DiffMachine::DoIsomorphMatch: 200/31040 Items processed and produced 381 match entries.
[07/23/2015 23:21:16] [DarunGrim] DiffMachine::DoIsomorphMatch: 300/31040 Items processed and produced 626 match entries.
[07/23/2015 23:21:16] [DarunGrim] DiffMachine::DoIsomorphMatch: 400/31040 Items processed and produced 836 match entries.
[07/23/2015 23:21:16] [DarunGrim] DiffMachine::DoIsomorphMatch: 500/31040 Items processed and produced 965 match entries.
[07/23/2015 23:21:16] [DarunGrim] DiffMachine::DoIsomorphMatch: 600/31040 Items processed and produced 1129 match entries.
[07/23/2015 23:21:16] [DarunGrim] DiffMachine::DoIsomorphMatch: 700/31040 Items processed and produced 1297 match entries.
[07/23/2015 23:21:16] [DarunGrim] DiffMachine::DoIsomorphMatch: 800/31040 Items processed and produced 1480 match entries.
[07/23/2015 23:21:17] [DarunGrim] DiffMachine::DoIsomorphMatch: 900/31040 Items processed and produced 1610 match entries.
[07/23/2015 23:21:17] [DarunGrim] DiffMachine::DoIsomorphMatch: 1000/31040 Items processed and produced 1781 match entries.
[07/23/2015 23:21:17] [DarunGrim] DiffMachine::DoIsomorphMatch: 1100/31040 Items processed and produced 1937 match entries.
[07/23/2015 23:21:17] [DarunGrim] DiffMachine::DoIsomorphMatch: 1200/31040 Items processed and produced 2168 match entries.
[07/23/2015 23:21:17] [DarunGrim] DiffMachine::DoIsomorphMatch: 1300/31040 Items processed and produced 2331 match entries.
[07/23/2015 23:21:17] [DarunGrim] DiffMachine::DoIsomorphMatch: 1400/31040 Items processed and produced 2508 match entries.
[07/23/2015 23:21:18] [DarunGrim] DiffMachine::DoIsomorphMatch: 1500/31040 Items processed and produced 2650 match entries.
[07/23/2015 23:21:18] [DarunGrim] DiffMachine::DoIsomorphMatch: 1600/31040 Items processed and produced 2772 match entries.
[07/23/2015 23:21:18] [DarunGrim] DiffMachine::DoIsomorphMatch: 1700/31040 Items processed and produced 2912 match entries.
[07/23/2015 23:21:18] [DarunGrim] DiffMachine::DoIsomorphMatch: 1800/31040 Items processed and produced 3080 match entries.
[07/23/2015 23:21:18] [DarunGrim] DiffMachine::DoIsomorphMatch: 1900/31040 Items processed and produced 3271 match entries.
[07/23/2015 23:21:19] [DarunGrim] DiffMachine::DoIsomorphMatch: 2000/31040 Items processed and produced 3446 match entries.
[07/23/2015 23:21:19] [DarunGrim] DiffMachine::DoIsomorphMatch: 2100/31040 Items processed and produced 3610 match entries.
[07/23/2015 23:21:19] [DarunGrim] DiffMachine::DoIsomorphMatch: 2200/31040 Items processed and produced 3756 match entries.
[07/23/2015 23:21:20] [DarunGrim] DiffMachine::DoIsomorphMatch: 2300/31040 Items processed and produced 3967 match entries.
[07/23/2015 23:21:20] [DarunGrim] DiffMachine::DoIsomorphMatch: 2400/31040 Items processed and produced 4164 match entries.
[07/23/2015 23:21:20] [DarunGrim] DiffMachine::DoIsomorphMatch: 2500/31040 Items processed and produced 4352 match entries.
[07/23/2015 23:21:20] [DarunGrim] DiffMachine::DoIsomorphMatch: 2600/31040 Items processed and produced 4503 match entries.
[07/23/2015 23:21:20] [DarunGrim] DiffMachine::DoIsomorphMatch: 2700/31040 Items processed and produced 4654 match entries.
[07/23/2015 23:21:20] [DarunGrim] DiffMachine::DoIsomorphMatch: 2800/31040 Items processed and produced 4807 match entries.
[07/23/2015 23:21:21] [DarunGrim] DiffMachine::DoIsomorphMatch: 2900/31040 Items processed and produced 4978 match entries.
[07/23/2015 23:21:21] [DarunGrim] DiffMachine::DoIsomorphMatch: 3000/31040 Items processed and produced 5172 match entries.
[07/23/2015 23:21:21] [DarunGrim] DiffMachine::DoIsomorphMatch: 3100/31040 Items processed and produced 5349 match entries.
[07/23/2015 23:21:21] [DarunGrim] DiffMachine::DoIsomorphMatch: 3200/31040 Items processed and produced 5538 match entries.
[07/23/2015 23:21:22] [DarunGrim] DiffMachine::DoIsomorphMatch: 3300/31040 Items processed and produced 5709 match entries.
[07/23/2015 23:21:22] [DarunGrim] DiffMachine::DoIsomorphMatch: 3400/31040 Items processed and produced 5863 match entries.
[07/23/2015 23:21:22] [DarunGrim] DiffMachine::DoIsomorphMatch: 3500/31040 Items processed and produced 6030 match entries.
[07/23/2015 23:21:23] [DarunGrim] DiffMachine::DoIsomorphMatch: 3600/31040 Items processed and produced 6212 match entries.
[07/23/2015 23:21:23] [DarunGrim] DiffMachine::DoIsomorphMatch: 3700/31040 Items processed and produced 6380 match entries.
[07/23/2015 23:21:23] [DarunGrim] DiffMachine::DoIsomorphMatch: 3800/31040 Items processed and produced 6513 match entries.
[07/23/2015 23:21:23] [DarunGrim] DiffMachine::DoIsomorphMatch: 3900/31040 Items processed and produced 6694 match entries.
[07/23/2015 23:21:23] [DarunGrim] DiffMachine::DoIsomorphMatch: 4000/31040 Items processed and produced 6865 match entries.
[07/23/2015 23:21:24] [DarunGrim] DiffMachine::DoIsomorphMatch: 4100/31040 Items processed and produced 7052 match entries.
[07/23/2015 23:21:24] [DarunGrim] DiffMachine::DoIsomorphMatch: 4200/31040 Items processed and produced 7228 match entries.
[07/23/2015 23:21:24] [DarunGrim] DiffMachine::DoIsomorphMatch: 4300/31040 Items processed and produced 7410 match entries.
[07/23/2015 23:21:25] [DarunGrim] DiffMachine::DoIsomorphMatch: 4400/31040 Items processed and produced 7602 match entries.
[07/23/2015 23:21:25] [DarunGrim] DiffMachine::DoIsomorphMatch: 4500/31040 Items processed and produced 7772 match entries.
[07/23/2015 23:21:25] [DarunGrim] DiffMachine::DoIsomorphMatch: 4600/31040 Items processed and produced 7950 match entries.
[07/23/2015 23:21:25] [DarunGrim] DiffMachine::DoIsomorphMatch: 4700/31040 Items processed and produced 8138 match entries.
[07/23/2015 23:21:25] [DarunGrim] DiffMachine::DoIsomorphMatch: 4800/31040 Items processed and produced 8305 match entries.
[07/23/2015 23:21:26] [DarunGrim] DiffMachine::DoIsomorphMatch: 4900/31040 Items processed and produced 8507 match entries.
[07/23/2015 23:21:26] [DarunGrim] DiffMachine::DoIsomorphMatch: 5000/31040 Items processed and produced 8695 match entries.
[07/23/2015 23:21:27] [DarunGrim] DiffMachine::DoIsomorphMatch: 5100/31040 Items processed and produced 8881 match entries.
[07/23/2015 23:21:29] [DarunGrim] DiffMachine::DoIsomorphMatch: 5200/31040 Items processed and produced 9073 match entries.
[07/23/2015 23:21:30] [DarunGrim] DiffMachine::DoIsomorphMatch: 5300/31040 Items processed and produced 9237 match entries.
[07/23/2015 23:21:30] [DarunGrim] DiffMachine::DoIsomorphMatch: 5400/31040 Items processed and produced 9426 match entries.
[07/23/2015 23:21:33] [DarunGrim] DiffMachine::DoIsomorphMatch: 5500/31040 Items processed and produced 9619 match entries.
[07/23/2015 23:21:33] [DarunGrim] DiffMachine::DoIsomorphMatch: 5600/31040 Items processed and produced 9805 match entries.
[07/23/2015 23:21:33] [DarunGrim] DiffMachine::DoIsomorphMatch: 5700/31040 Items processed and produced 9952 match entries.
[07/23/2015 23:21:33] [DarunGrim] DiffMachine::DoIsomorphMatch: 5800/31040 Items processed and produced 10118 match entries.
[07/23/2015 23:21:33] [DarunGrim] DiffMachine::DoIsomorphMatch: 5900/31040 Items processed and produced 10271 match entries.
[07/23/2015 23:21:34] [DarunGrim] DiffMachine::DoIsomorphMatch: 6000/31040 Items processed and produced 10442 match entries.
[07/23/2015 23:21:34] [DarunGrim] DiffMachine::DoIsomorphMatch: 6100/31040 Items processed and produced 10624 match entries.
[07/23/2015 23:21:35] [DarunGrim] DiffMachine::DoIsomorphMatch: 6200/31040 Items processed and produced 10821 match entries.
[07/23/2015 23:21:35] [DarunGrim] DiffMachine::DoIsomorphMatch: 6300/31040 Items processed and produced 11031 match entries.
[07/23/2015 23:21:36] [DarunGrim] DiffMachine::DoIsomorphMatch: 6400/31040 Items processed and produced 11213 match entries.
[07/23/2015 23:21:36] [DarunGrim] DiffMachine::DoIsomorphMatch: 6500/31040 Items processed and produced 11341 match entries.
[07/23/2015 23:21:37] [DarunGrim] DiffMachine::DoIsomorphMatch: 6600/31040 Items processed and produced 11507 match entries.
[07/23/2015 23:21:38] [DarunGrim] DiffMachine::DoIsomorphMatch: 6700/31040 Items processed and produced 11693 match entries.
[07/23/2015 23:21:38] [DarunGrim] DiffMachine::DoIsomorphMatch: 6800/31040 Items processed and produced 11867 match entries.
[07/23/2015 23:21:38] [DarunGrim] DiffMachine::DoIsomorphMatch: 6900/31040 Items processed and produced 12038 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7000/31040 Items processed and produced 12265 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7100/31040 Items processed and produced 12435 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7200/31040 Items processed and produced 12601 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7300/31040 Items processed and produced 12706 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7400/31040 Items processed and produced 12827 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7500/31040 Items processed and produced 12947 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7600/31040 Items processed and produced 13033 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7700/31040 Items processed and produced 13126 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7800/31040 Items processed and produced 13221 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 7900/31040 Items processed and produced 13345 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 8000/31040 Items processed and produced 13459 match entries.
[07/23/2015 23:21:39] [DarunGrim] DiffMachine::DoIsomorphMatch: 8100/31040 Items processed and produced 13555 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8200/31040 Items processed and produced 13633 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8300/31040 Items processed and produced 13753 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8400/31040 Items processed and produced 13857 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8500/31040 Items processed and produced 14120 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8600/31040 Items processed and produced 14201 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8700/31040 Items processed and produced 14313 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8800/31040 Items processed and produced 14438 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 8900/31040 Items processed and produced 14553 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9000/31040 Items processed and produced 14719 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9100/31040 Items processed and produced 14874 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9200/31040 Items processed and produced 15040 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9300/31040 Items processed and produced 15151 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9400/31040 Items processed and produced 15313 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9500/31040 Items processed and produced 15446 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9600/31040 Items processed and produced 15578 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9700/31040 Items processed and produced 15721 match entries.
[07/23/2015 23:21:40] [DarunGrim] DiffMachine::DoIsomorphMatch: 9800/31040 Items processed and produced 15820 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 9900/31040 Items processed and produced 15991 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10000/31040 Items processed and produced 16135 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10100/31040 Items processed and produced 16244 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10200/31040 Items processed and produced 16356 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10300/31040 Items processed and produced 16483 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10400/31040 Items processed and produced 16597 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10500/31040 Items processed and produced 16702 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10600/31040 Items processed and produced 16811 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10700/31040 Items processed and produced 16937 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10800/31040 Items processed and produced 17061 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 10900/31040 Items processed and produced 17206 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11000/31040 Items processed and produced 17320 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11100/31040 Items processed and produced 17441 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11200/31040 Items processed and produced 17557 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11300/31040 Items processed and produced 17650 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11400/31040 Items processed and produced 17781 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11500/31040 Items processed and produced 17896 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11600/31040 Items processed and produced 18008 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11700/31040 Items processed and produced 18124 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11800/31040 Items processed and produced 18208 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 11900/31040 Items processed and produced 18301 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12000/31040 Items processed and produced 18409 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12100/31040 Items processed and produced 18520 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12200/31040 Items processed and produced 18619 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12300/31040 Items processed and produced 18749 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12400/31040 Items processed and produced 18861 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12500/31040 Items processed and produced 19041 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12600/31040 Items processed and produced 19166 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12700/31040 Items processed and produced 19286 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12800/31040 Items processed and produced 19382 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 12900/31040 Items processed and produced 19495 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 13000/31040 Items processed and produced 19607 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 13100/31040 Items processed and produced 19723 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 13200/31040 Items processed and produced 19825 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 13300/31040 Items processed and produced 19964 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 13400/31040 Items processed and produced 20108 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 13500/31040 Items processed and produced 20247 match entries.
[07/23/2015 23:21:41] [DarunGrim] DiffMachine::DoIsomorphMatch: 13600/31040 Items processed and produced 20370 match entries.
[07/23/2015 23:21:42] [DarunGrim] DiffMachine::DoIsomorphMatch: 13700/31040 Items processed and produced 20503 match entries.
[07/23/2015 23:21:42] [DarunGrim] DiffMachine::DoIsomorphMatch: 13800/31040 Items processed and produced 20623 match entries.
[07/23/2015 23:21:42] [DarunGrim] DiffMachine::DoIsomorphMatch: 13900/31040 Items processed and produced 20751 match entries.
[07/23/2015 23:21:42] [DarunGrim] DiffMachine::DoIsomorphMatch: 14000/31040 Items processed and produced 20856 match entries.
[07/23/2015 23:21:42] [DarunGrim] DiffMachine::DoIsomorphMatch: 14100/31040 Items processed and produced 20946 match entries.
[07/23/2015 23:21:42] [DarunGrim] DiffMachine::DoIsomorphMatch: 14200/31040 Items processed and produced 21092 match entries.
[07/23/2015 23:21:42] [DarunGrim] DiffMachine::DoIsomorphMatch: 14300/31040 Items processed and produced 21187 match entries.
[07/23/2015 23:21:45] [DarunGrim] DiffMachine::DoIsomorphMatch: 14400/31040 Items processed and produced 21300 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 14500/31040 Items processed and produced 21450 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 14600/31040 Items processed and produced 21589 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 14700/31040 Items processed and produced 21693 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 14800/31040 Items processed and produced 21810 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 14900/31040 Items processed and produced 21914 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 15000/31040 Items processed and produced 22037 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 15100/31040 Items processed and produced 22198 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 15200/31040 Items processed and produced 22361 match entries.
[07/23/2015 23:21:46] [DarunGrim] DiffMachine::DoIsomorphMatch: 15300/31040 Items processed and produced 22491 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 15400/31040 Items processed and produced 22601 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 15500/31040 Items processed and produced 22736 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 15600/31040 Items processed and produced 22852 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 15700/31040 Items processed and produced 23000 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 15800/31040 Items processed and produced 23372 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 15900/31040 Items processed and produced 23709 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16000/31040 Items processed and produced 24245 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16100/31040 Items processed and produced 24670 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16200/31040 Items processed and produced 24922 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16300/31040 Items processed and produced 25163 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16400/31040 Items processed and produced 25474 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16500/31040 Items processed and produced 25696 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16600/31040 Items processed and produced 25928 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16700/31040 Items processed and produced 26039 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16800/31040 Items processed and produced 26180 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 16900/31040 Items processed and produced 26368 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17000/31040 Items processed and produced 26537 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17100/31040 Items processed and produced 26686 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17200/31040 Items processed and produced 26862 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17300/31040 Items processed and produced 27238 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17400/31040 Items processed and produced 27552 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17500/31040 Items processed and produced 27840 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17600/31040 Items processed and produced 28205 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17700/31040 Items processed and produced 28600 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17800/31040 Items processed and produced 29027 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 17900/31040 Items processed and produced 29233 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 18000/31040 Items processed and produced 29490 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 18100/31040 Items processed and produced 29725 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 18200/31040 Items processed and produced 30073 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 18300/31040 Items processed and produced 30339 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 18400/31040 Items processed and produced 30612 match entries.
[07/23/2015 23:21:47] [DarunGrim] DiffMachine::DoIsomorphMatch: 18500/31040 Items processed and produced 30918 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 18600/31040 Items processed and produced 31185 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 18700/31040 Items processed and produced 31482 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 18800/31040 Items processed and produced 31778 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 18900/31040 Items processed and produced 32113 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19000/31040 Items processed and produced 32337 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19100/31040 Items processed and produced 32601 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19200/31040 Items processed and produced 32819 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19300/31040 Items processed and produced 33006 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19400/31040 Items processed and produced 33292 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19500/31040 Items processed and produced 33599 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19600/31040 Items processed and produced 33869 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19700/31040 Items processed and produced 34110 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19800/31040 Items processed and produced 34293 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 19900/31040 Items processed and produced 34559 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20000/31040 Items processed and produced 34791 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20100/31040 Items processed and produced 34995 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20200/31040 Items processed and produced 35211 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20300/31040 Items processed and produced 35442 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20400/31040 Items processed and produced 35655 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20500/31040 Items processed and produced 35980 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20600/31040 Items processed and produced 36224 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20700/31040 Items processed and produced 36485 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20800/31040 Items processed and produced 36778 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 20900/31040 Items processed and produced 37048 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 21000/31040 Items processed and produced 37230 match entries.
[07/23/2015 23:21:48] [DarunGrim] DiffMachine::DoIsomorphMatch: 21100/31040 Items processed and produced 37405 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21200/31040 Items processed and produced 37860 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21300/31040 Items processed and produced 38006 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21400/31040 Items processed and produced 38275 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21500/31040 Items processed and produced 38480 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21600/31040 Items processed and produced 38761 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21700/31040 Items processed and produced 38932 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21800/31040 Items processed and produced 39120 match entries.
[07/23/2015 23:21:49] [DarunGrim] DiffMachine::DoIsomorphMatch: 21900/31040 Items processed and produced 39349 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22000/31040 Items processed and produced 39547 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22100/31040 Items processed and produced 39759 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22200/31040 Items processed and produced 39983 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22300/31040 Items processed and produced 40305 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22400/31040 Items processed and produced 40540 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22500/31040 Items processed and produced 40771 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22600/31040 Items processed and produced 40970 match entries.
[07/23/2015 23:21:50] [DarunGrim] DiffMachine::DoIsomorphMatch: 22700/31040 Items processed and produced 41162 match entries.
Diffing process finished.Traceback (most recent call last):
File "", line 924, in new
File "", line 1032, in StartPerformDiff
File "", line 1314, in OpenDatabase
File "", line 32, in init
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\DarunGrimDatabase", line 333, in init
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.orm.query", line 2320, in all
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.orm.query", line 2438, in iter
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.orm.query", line 2453, in _execute_and_instances
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.engine.base", line 729, in execute
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.sql.elements", line 322, in _execute_on_connection
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.engine.base", line 826, in _execute_clauseelement
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.engine.base", line 958, in _execute_context
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.engine.base", line 1159, in _handle_dbapi_exception
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.util.compat", line 199, in raise_from_cause
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.engine.base", line 951, in _execute_context
File "C:\mat\Src\DarunGrim\Src\Scripts\build\DarunGrim\out00-PYZ.pyz\sqlalchemy.engine.default", line 436, in do_execute
sqlalchemy.exc.OperationalError: (OperationalError) no such table: FileList u'SELECT "FileList"."Type" AS "FileList_Type", "FileList"."Filename" AS "FileList_Filename", "FileList"."FileID" AS "FileList_FileID", "FileList".id AS "FileList_id" \nFROM "FileList"' ()

Could you please tell me the source of this issue? Thanks!

Remove binaries?

I was wondering if the binaries in the repo are all for compiling and just there for convenience?

I am a part of several projects that do this, and if everybody is against it, that is fine, but if we can remove them we should for cleanliness sake. Git isn't meant to be used for binaries and compressed archives.

If we can, we should tell people what they need to compile the software so they can download and install that stuff themselves.

GitHub has the releases functionality for binary releases, and we have a README that we can use for instructing users on how to compile and use the software.

Let me know what you think.

diff large PE files issue

like as mshtml ms14-65 vs. ms14-80, log output:

[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::_Load
[02/17/2015 10:24:11]  [DarunGrim] SourceFunctionAddress: 0
[02/17/2015 10:24:11]  [DarunGrim] Analyze
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::Analyze: Fingerprint Map Size 0:0
[02/17/2015 10:24:11]  [DarunGrim] Name Match
[02/17/2015 10:24:11]  [DarunGrim] Name Match Ended
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::Analyze: Name matched number=0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::Analyze: DoFingerPrintMatch
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::DoFingerPrintMatch: Matched pair count=0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::Analyze: Match Map Size: 0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::Analyze: DoIsomorphMatch
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::Analyze: Match Map Size: 0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::GenerateFunctionMatchInfo: FunctionMatchList.size()=0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::GenerateFunctionMatchInfo: unpatched_unidentified_number=0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::GenerateFunctionMatchInfo: patched_unidentified_number=0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::GenerateFunctionMatchInfo: FunctionMatchList.size()=0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::GenerateFunctionMatchInfo: unpatched_unidentified_number=0
[02/17/2015 10:24:11]  [DarunGrim] DiffMachine::GenerateFunctionMatchInfo: patched_unidentified_number=0
[02/17/2015 10:24:11]  [DarunGrim] Save
[02/17/2015 10:24:11]  [DarunGrim] DiffResults->MatchMap.size()=0
[02/17/2015 10:24:11]  [DarunGrim] DiffResults->MatchMap.size()=0
[02/17/2015 10:24:11]  [DarunGrim] FunctionMatchList.size()=0

32bit version

Hi I am using windows 7 32bit version and your software does not work on that. do you have a 32bit version

32/64 bit binary running issues

IDA supports 32/64 bit binaries with different executables, idag.exe and idag64.exe, but DG simply tries to run idag.exe for both 32/64bit binaries.
Though DG knows the supporting architecture of the binary now, still DG needs to run an appropriate one according to the supporting architecture of the binary.

How to compile and use

I want to know how to compile this project. How to use Python script, there seems to be no corresponding package

wrong column type in OneLocationInfo table ? should be String rather Integer?

hi,

while looking around the DarunGrimDatabaseWrapper.py, i found the following column types are different with DarunGrim2, maybe its a typo?

/DarunGrim/Src/Diff Inspector/DarunGrimDatabaseWrapper.py 18-20:
name = Column( Integer, name = "Name" )
disasm_lines = Column( Integer, name = "DisasmLines" )
fingerprint = Column( Integer, name = "Fingerprint" )

differ with DarunGrim2:
sqlite> .schema OneLocationInfo
CREATE TABLE OneLocationInfo (
id INTEGER PRIMARY KEY AUTOINCREMENT,
FileID INTEGER,
StartAddress INTEGER,
EndAddress INTEGER,
Flag INTEGER,
FunctionAddress INTEGER,
BlockType INTEGER,
Name TEXT,
DisasmLines TEXT,
Fingerprint TEXT
);

injection error on "DarunGrim3Server.exe"

Pressing Start Diffing while IDA is running generates an injection error on "DarunGrim3Server.exe"

Malware detected

Can't download this executable.

Installer Was blocked on google drive

Can you upload it to mega or something please ?