AwesomeREA.org

Tool

ghidriff

Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. The default VersionTrackingDiff engine combines several Ghidra Version Tracking correlators with BSim matching, alongside simpler symbol-name and structural-graph engines and a GhidraDiffEngine base class for custom differs. Results are written as JSON and Markdown with Mermaid charts and meta diffs of strings, called and calling functions and binary metadata, plus optional side-by-side HTML.

Requirements and limitations

  • Latest release at review: v1.0.0, published 2025-07-04 on GitHub and PyPI, which requires Python 3.9+ and pyghidra 2.0+. The reviewed main commit, merged 2026-05-11, is six commits ahead and still reports version 1.0.0: it requires Python 3.10+ and pyghidra 3.x, targets Ghidra 12.0.4 and logs a warning when another Ghidra or pyghidra version is running. setup.cfg classifies the package as Alpha.
  • Install Ghidra with a JDK supported by that release, set GHIDRA_INSTALL_DIR and install the package with pip or uvx; the README covers Windows, Linux and macOS, and its x64/arm64 Docker image ships the PyPI release so Ghidra and Java need not be installed on the host. Large binaries may need a larger JVM memory share.
  • Supply two or more versions of the same binary, ordered oldest to newest, with an optional summary across several new versions; anything Ghidra can import and analyze can be compared, with a custom base address for firmware or bootloader images, analyzer options and GDT type archives. The supported-platforms page says native code works best, managed .NET results are mixed and native libraries must be taken out of an APK first. A preflight check stops the diff when the two programs' processor languages differ or their symbol counts differ by 4,000 or more, unless --force-diff is given. By default Ghidra's well-known PDB symbol servers are configured with a local symbol store unless --no-symbols is set.
  • GPL-3.0. Matching quality depends on Ghidra's analysis and decompilation. The README's use cases and the documentation site's sample diffs cover Windows and macOS system binaries obtained separately; the repository ships no target binaries. No binaries were diffed for this entry.

About this entry

Type
Tool
Category
Binary comparison tools
Relationship
Foundation tool
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · clearbluejar/ghidriff · Revision 4f5d895
  2. README.md#L282-L315 GitHub · clearbluejar/ghidriff · Revision 4f5d895
  3. setup.cfg GitHub · clearbluejar/ghidriff · Revision 4f5d895
  4. ghidriff/ghidra_diff_engine.py#L205-L226 GitHub · clearbluejar/ghidriff · Revision 4f5d895
  5. ghidriff/ghidra_diff_engine.py#L845-L876 GitHub · clearbluejar/ghidriff · Revision 4f5d895
  6. ghidriff/ghidra_diff_engine.py#L1453-L1474 GitHub · clearbluejar/ghidriff · Revision 4f5d895
  7. www/docs/README/Supported%20Platforms.md GitHub · clearbluejar/ghidriff · Revision 4f5d895
  8. docs/progress-log.md GitHub · clearbluejar/ghidriff · Revision 4f5d895
  9. LICENSE GitHub · clearbluejar/ghidriff · Revision 4f5d895
  10. https://github.com/clearbluejar/ghidriff/releases/tag/v1.0.0
  11. https://pypi.org/project/ghidriff/1.0.0/