Diffing & Merging
IDA's diff mode
The IDA diff mode lets the user compare two databases, in a traditional "diff" fashion: essentially a two-panel window, showing the unmodified file on the left and the version with your changes on the right.
After performing reverse-engineering work on an IDA database, you can review the resulting changes using a special diff mode. To access it, right-click within the database and select Diff against… from the context menu.
Diff and Merge Differences
It is important to note the difference between the terms "diff" and "merge".
Through the docs, these terms sometimes are used interchangeably. This is because to IDA, a diff is just a specialized merge. Both diffing and merging are handled by IDA's "merge mode", which involves up to 3 databases, one of which can be modified to contain the result of the merge.
A diff is simply a merge operation that involves only 2 databases, neither of which are modified.
This is why often times you will see the term "merge" used in the context of a diff. In this case "merge" is referring to IDA's "merge mode", rather than the process of merging multiple databases together into a combined database.
Using IDA as a diffing tool
Performing a merge between two IDA databases is substantially different from, for example, merging two text files. A change in a chunk of text file will not have an impact on another chunk.
IDA databases are not so simple. A change in one place in an idb will often have an impact on another place. For example, if a structure mystruct changed between two databases, it will have an impact not only on the name of the structure, but on cross-references to structure members, function prototypes, etc.
This is why IDA's merge mode is split into a strict series of "steps":
Within a single step it is possible to go forward & backward between different chunks. But because of possible inter-dependencies between steps, it is not possible to move backwards between steps, you can only go forward:
Since IDA's diff mode is just a variation of its merge mode, diffing databases is also subject to this sequential application of steps in order to view certain bits of information. That is why, in some steps (e.g., the "Disassembly/Items") IDA might not report some changes that were performed at another level.
For instance, if a user marked a function as noret, the listings that will be shown in "Disassembly/Items" step, will not advertise that there was a change at that place (even though the "Attributes: noreturn" is visible in the left-hand listing), only the changes to the instructions (and data, ...) are visible in the current step:
The change will, however, be visible at a later step (i.e., "Functions/Registry"):
The changes applied during the "diff" process are only temporary. Exiting IDA (at any moment) will not alter the files being compared.
Learn more about merging steps here.
Merging concurrent modifications (conflicts)
As with any collaborative tool, it may happen that two coworkers work on the same dataset (e.g., IDA database), and make modifications to the same areas, resulting in "conflicts". Conflicts must be "resolved" prior to committing.
To do that, right-click and pick one of the "resolve" options:
IDA Teams provides the following merge strategies.
Interactive merging
If the option that was chosen (e.g., Interactive merge mode) requires user interaction due to conflicts, IDA will show in 3-pane "merge" mode.
When a conflict is encountered, you'll have the ability to pick, for all conflicts, which change should be kept (yours, or the other). Every time you pick a change (and thus resolve a conflict), IDA will proceed with the merging, applying all the non-conflicting changes it can, until the next conflict - if any. When all conflicts are resolved, you can leave IDA, and the new resulting file is ready to be submitted.
The "Progress" widget
Represents the current step in the diff process.
The left panel
Shows the "untouched" version of the database (i.e., the one without your changes)
The right panel
Shows your version of the database (i.e., featuring your changes)
Diff region details
Notice how both panels have a little area at the bottom, that is labeled "Details".
Details are available on certain steps of the diffing process, and provide additional information about the change that is currently displayed.
The "diffing" toolbar
The actions in the toolbar are:
Previous chunk: Move to the previous change
Center chunk: Re-center the panels to show the current chunk (useful if you navigated around to get more context)
Next chunk: Move to the next change
Proceed to the next step: Move to the next step step in the diffing process
Toggle 'Details': Toggle the visibility of the "Details" widgets in the various panels (note that some steps do not provide details, so even if the "Details" are requested, they might not be currently visible)
Using actions in the toolbar, you can iterate through the differences between the two databases, with each change shown in context as if viewed through a normal IDA window.
What's next?
Ready to Get Started?
Last updated
Was this helpful?