BINDIFF & DIAPHORA ENGINE
1-DAY PATCH ANALYZERAST Subgraph + Prime Sieve MatcherBinary Diffing & Patch Dissection Studio
Autonomous binary comparison engine for identifying backdoored functions, newly hooked threads, compiler changes, and 1-day vulnerability security patches across x86, x64, and .NET binaries.
Preset Pair:
TARGET A (CLEAN)putty.exe (Official Release)
Ver: 0.70.0.0 (Clean Simon Tatham)•Arch: x86 (32-bit PE)•Size: 1,048,576 bytes
VS
sillyputty.exe (TCM Challenge)TARGET B (WEAPONIZED)
Ver: 0.70.0.0 (Modified Trojan)•Arch: x86 (32-bit PE)•Size: 1,085,440 bytes
Overall Similarity
68.5%
Functions Analyzed
4
Identical
2
Modified
1
New / Rogue Blocks
1
Functions in Pair (4)
int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
WinMain prologue modified with injected CreateThread call spawning malicious worker subroutine at 0x00412880.
MODIFIEDAlgorithm: Control Flow Graph Isomorphism + Call Graph Topology
TARGET A: putty.exe (Official Release) (0x004127A0)
TARGET B: sillyputty.exe (TCM Challenge) (0x004127A0)
10x004127A055push ebp
10x004127A055push ebp
20x004127A18B ECmov ebp, esp
20x004127A18B ECmov ebp, esp
30x004127A383 EC 20sub esp, 0x20
30x004127A383 EC 20sub esp, 0x20
40x004127A6E8 45 10 00 00call sub_004137F0 ; InitCommonControls
40x004127A6E8 45 10 00 00call sub_004137F0 ; InitCommonControls
5---------
50x004127AB6A 00push 0 ; lpThreadIdRogue thread parameter
6---------
60x004127AD6A 00push 0 ; dwCreationFlagsRun immediately
7---------
70x004127AF6A 00push 0 ; lpParameter
8---------
80x004127B168 80 28 41 00push 0x00412880 ; lpStartAddress (RogueWorker)Points to reverse shell payload
9---------
90x004127B66A 00push 0 ; dwStackSize
10---------
100x004127B86A 00push 0 ; lpThreadAttributes
11---------
110x004127BAFF 15 40 80 43 00call ds:[CreateThread]Detached background execution
120x004127ABE8 A0 34 00 00call sub_00415C50 ; RegInitSettings
120x004127C0E8 A0 34 00 00call sub_00415C50 ; RegInitSettings
130x004127B085 C0test eax, eax
130x004127C585 C0test eax, eax
140x004127B274 18jz loc_004127CC
140x004127C774 18jz loc_004127E1