-
-
Notifications
You must be signed in to change notification settings - Fork 400
Explanation of every single field in the export diffing dialog
Joxean edited this page Jan 18, 2018
·
2 revisions
- Export IDA database to SQLite: Name of the output SQLite format database.
- SQLite database to diff against: Name of the other previously exported SQLite format database to diff against the current one.
- From/to address: Used exclusively for the export process; it limits the range of addresses to export.
- Use the decompiler if available: Diaphora will try to decompile every single function in the current database and generate signatures.
- Do not export library and thunk functions: We usually don't want to export imports and thunks. If, for a reason, you want to export them too (why?), uncheck this option.
- Export only non-IDA generated functions: Functions with prefixes like "sub_" or "j_" or functions identified by IDA with FLIRT signatures and names like "unknown_XXX" will be ignored. Useful when porting your work to newer versions of your target.
- Do not export instructions and basic blocks: It will just export functions summaries and is a way of making the export process faster. If you're just worried in porting your work between different versions of your target and do not care about instruction or basic block level changes, check this option.
- Use probably unreliable methods: Diaphora uses many heuristics and some are more reliable than others. However, in some cases, unreliable methods will find good matches. If you want to use also unreliable heuristics because the vanilla results aren't very good, check this option. It will also cause, in general, many false positives, this is why it's called "unreliable" but, in any case, it's called "probably unreliable" because, for some targets, the results are really good (but not in all cases).
- Use slow heuristics: Some heuristics are very slow. Check this option for small databases or when the by-default results aren't good.
- Relaxed calculations on difference ratios: It will make the comparison method for functions to "relax". For example, if only the size of a variable, or the type, or some other small thing changed, it will still mark the match as "Best" with a ratio of 1.0. Usage of this option is recommended when porting your work between different versions of your target and is not recommended for patch diffing.
- Use experimental heuristics: Sometimes I develop heuristics that, on my mind (or with my limited test-suite) look like "good" but turns out that they aren't that good. Those heuristics are moved to the "experimental" side. If the by-default results you're getting aren't good, check this option.
- Ignore automatically generated names: By default, Diaphora will ignore function name matches for functions with the "sub_" prefix. If you know this is wrong for your specific target, uncheck this option.
- Ignore all function names: Diaphora uses function names as one "heuristic" to match functions. For some targets, it can be an error. If you know this is the case, check this option.
- Ignore small functions: Many heuristics will cause false positives when comparing small functions (for example, functions with less than 5 instructions). The default set of heuristics will discard small functions but not all heuristics. If it's causing you problems, check this option to remove most or all false positives caused because the compared functions are too small.