diaphora-diff

Diaphora Program Diff

Match functions between two builds of a program, recover symbol names from a build that has them onto builds that don't, and emit per-function pseudocode diffs that document what actually changed.

When to use

• Name recovery — one build shipped unstripped (or you reversed it by hand); its siblings are stripped. Match them and carry the names across. This is the highest-value use and the reason to prefer Diaphora over bindiff: it keeps every function's pseudocode on both sides, so a match is reviewable rather than a bare address pair.
• Version lineage — a chain of releases with no source history. Diff each adjacent pair to establish what changed, when, and in which subsystem.
• Source reconstruction — recovered C++ mangled names carry Class::method plus parameter types, which maps binary functions back onto a source tree you're rebuilding.
• Patch analysis — the changed list, sorted by ascending ratio, is the worklist.

Reach for bindiff when you want a fast structural answer or you only have Ghidra; reach for this when match quality matters or you need the pseudocode to read.

The two halves

Export is cached by binary hash, so a corpus of N builds costs N exports and then any pairing is cheap. Export once, diff forever.

Usage

# one-shot: export both (cached) then diff
rekit run diaphora-diff compare ./unstripped.bin ./stripped.bin ./out --decompiler

# or drive the halves yourself, sharing exports across many pairings
rekit run diaphora-diff export ./v1.01 ./cache/v1.01.sqlite --decompiler
rekit run diaphora-diff export ./v1.02 ./cache/v1.02.sqlite --decompiler
rekit run diaphora-diff diff ./cache/v1.01.sqlite ./cache/v1.02.sqlite ./out/1.01-1.02

# re-report an existing results database with different thresholds — no re-diffing
rekit run diaphora-diff report ./cache/v1.01.sqlite ./cache/v1.02.sqlite ./out \
    --results ./out/results.sqlite --min-ratio 0.9