3

Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?

And, if I can't do it with x64dbg, what tool would be better than a debugger to find the modifications done on assembly code between the two files?

Improve this question
2
  • Do you want to compare two DLL files or do you want to see run-time patches on a DLL file? Commented Aug 8, 2018 at 11:32
  • i have original DLL file and the patched version of it and i want to know which line been patched Commented Aug 8, 2018 at 12:29

2 Answers 2

Reset to default
4

You shouldn't use a debugger to search for differences. You should use a diff tool. Of course, most diff tools work on ASCII text, but there are some that deal with binary files.

Some examples:

There are more and you probably will find one that matches exactly your need. If you would like to see your modifications in a nice visual manner with already bytes being presented as opcodes there are some options too. I haven't used them (so can't give you my recommendations) but there are at least two that I know of:

Improve this answer
6
  • how am i suppose to install patchdiff 2 with IDA and use it,there is no installation or using guide Commented Aug 8, 2018 at 12:42
  • Compile and then put in plugins folder as you would do with any other plugin Commented Aug 8, 2018 at 12:48
  • i tried that already but got too many errors and undefined variables, is there a compiled one? Commented Aug 8, 2018 at 22:16
  • I’ll try to see if I can get that compiling Commented Aug 9, 2018 at 11:03
  • would be really great help Commented Aug 9, 2018 at 16:34
2

In Windows, perhaps the simplest possibility is the built-in File Compare command with its /B (binary) switch, to be used from the command-line. It lists all different bytes together with their file offset.

Usage:

fc /B filepath1 filepath2

Improve this answer
5
  • i want to see the opcode different not the binarry Commented Aug 8, 2018 at 22:18
  • The file compare gives you the file offsets of the differences in your binaries. From these you can easily get the opcode diffs in a debugger. Should be no problem at all. Commented Aug 9, 2018 at 8:24
  • always give me this error, FC: cannot open C:\PROGRAM - No such file or folder Commented Aug 9, 2018 at 9:52
  • quote your path like fc /b "c:\prxxx\yyy ddd" "d:\xx xx xx\yyy yyy" spaces are treated as delimiters for most of the console apps so it cant find your file that has a space in the path Commented Aug 9, 2018 at 10:18
  • hundred lines of binaries and last line is FC: "c:\prxxx\yyy ddd" longer than "d:\xx xx xx\yyy yyy" Commented Aug 9, 2018 at 16:33

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.