TurboDiff is a new IDA Pro plugin for binary patch diffing by Nicolás Economou. Binary diffing in this context means the analysis of a vendor-supplied patch (such as Microsoft Tuesday patches, for example) to find out exactly how the vulnerability it’s fixing works. This is essential in both developing an effective IDS signature (from a defensive standpoint) and a working exploit for it (from the attacker’s point of view).
As you can surely guess, doing a naive byte per byte comparison of the files before and after applying a patch simply doesn’t work. Any modern compiler performs a number of optimizations and small changes that vary from one compilation to the next – not to mention the changes introduced by changing to a new compiler version altogether. What binary diffing tools do to cope with this is analyze the semantics of the code by breaking it up into basic blocks (like IDA does to disassemble from version 5.0 and above) and matching them using one or more graph comparison algorithms. First each function needs to be identified and matched in each binary, despite of the reordering of code blocks made by the compiler. Then, each function’s basic block graph from each binary must be compared to look for differences.
This technology is not really new – there are other tools (Zynamic’s BinDiff, eEye’s DarunGrim, Tenable’s PatchDiff) and several papers published on the topic. I very much recommend to read Tyler Durden’s article on the Phrack Magazine, Julien Vanegue’s Ekoparty presentation, and the CanSecWest 2009 talk from Thomas Dullien and Sebastian Porst. There’s also a very interesting presentation at BlackHat USA 2009 by Jeongwook Oh on anti-binary diffing techniques, to thwart reverse engineers efforts to analyze patches. I’m probably forgetting something else, but Google is your friend. 
TurboDiff, however, takes on a much more simple approach to binary diffing. While other tools are using intermediate language decompilers and very complex general purpose graph algorithms, which take a long time to run, TurboDiff applies a series of optimized heuristics tried and tested on real life examples, and custom made graph algorithms specific to the kind of output a compiler may generate. The result of this is an incredibly fast binary diffing tool: it spits out the diff in only a few seconds for a patch that other tools may take literally days to chew on! If anythink, this alone justifies it’s use: there’s so little effort involved in trying this out, you might as well look at it’s results while your other diffing tool is still working in the background… 
But there’s another benefit – many times I’ve seen it point out changes in a patch that some of the other differs could not find. Here’s a real life example from the Microsoft Tuesday patch for MS09-023:
 Unpatched |
 Patched |
Those are the pros, but naturally there are also cons. This tool is still on it’s first released version, so many bugfixes and improvements are to be expected in the near future. The user interface is still a bit sketchy, but nothing one can’t get quickly used to. Also, it’s mostly focused on reversing patches, while other tools may be more flexible due to the nature of the algorithms they use – most notably, BinDiff is also used for symbol porting as explained by Halvar Flake in his blog.
So, enough reading! It’s time to start reversing some patches to see and judge for yourself!
Download
IDA plugin with sources:
