Diaphora is a program diffing tool that works as an IDA plugin for identifying and analyzing differences between binary files.
The tool addresses the problem of comparing compiled binaries to detect changes, vulnerabilities, and similarities across different versions or variants of software. It operates by analyzing assembler code, control flow graphs, and pseudo-code through multiple heuristics based on graph theory and binary features. The tool can match functions across binaries, calculate similarity ratios, and port metadata like symbol names, comments, structs, enums, and typedefs from one binary to another.
Diaphora suits security researchers, reverse engineers, and patch analysts who need to understand what changed between software versions. It is particularly valuable for vulnerability research and patch diffing workflows. The tool distinguishes itself through capabilities not found in other public diffing tools, including support for porting type information across binaries, detection of potentially fixed vulnerabilities, compilation unit analysis, microcode-level diffing, parallel diffing execution, pseudo-code comparison with syntax highlighting, and pseudo-code patch generation. It supports batch automation and scripting for both the export and diffing processes, allowing integration into larger analysis workflows.
Development activity shows consistent maintenance across multiple IDA versions spanning more than a decade, with the tool regularly ported to each minor release. The project maintains active community engagement through a dedicated Discord channel and GitHub issue tracking. The codebase is written in Python and requires Python 3.X, with testing performed against recent Python versions. The tool can be deployed either as a standalone script run from within IDA or integrated as a formal plugin through IDA's plugin directory.
