{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/README.md#L282-L315",
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/setup.cfg",
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/ghidriff/ghidra_diff_engine.py#L205-L226",
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/ghidriff/ghidra_diff_engine.py#L845-L876",
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/ghidriff/ghidra_diff_engine.py#L1453-L1474",
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/www/docs/README/Supported%20Platforms.md",
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/docs/progress-log.md",
    "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/LICENSE",
    "https://github.com/clearbluejar/ghidriff/releases/tag/v1.0.0",
    "https://pypi.org/project/ghidriff/1.0.0/"
  ],
  "category": "binary-diffing",
  "description_en": "Command-line binary diffing engine that drives Ghidra headlessly through pyghidra: it imports and analyzes an old and a new binary, then reports added, deleted and modified functions, with patch diffing as its main use. The default VersionTrackingDiff engine combines several Ghidra Version Tracking correlators with BSim matching, alongside simpler symbol-name and structural-graph engines and a GhidraDiffEngine base class for custom differs. Results are written as JSON and Markdown with Mermaid charts and meta diffs of strings, called and calling functions and binary metadata, plus optional side-by-side HTML.",
  "description_zh": "命令行二进制差异分析引擎，通过 pyghidra 以无界面方式驱动 Ghidra：导入并分析新旧两个版本的二进制，列出新增、删除和修改的函数，主要用于补丁比对。默认的 VersionTrackingDiff 引擎组合了多个 Ghidra 版本跟踪关联器和 BSim 匹配，另有基于符号名和结构图的较简单引擎，并提供 GhidraDiffEngine 基类供编写自定义比对器。结果以 JSON 和带 Mermaid 图表的 Markdown 输出，附有字符串、被调用与调用函数及二进制元数据的元差异，也可另外生成并排对照的 HTML。",
  "entry_url": "https://awesomerea.org/resources/ghidriff/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ghidriff/",
  "evidence_url": "https://github.com/clearbluejar/ghidriff/blob/4f5d895fcbb1eacd65efd81145922c15bb7e741d/README.md",
  "group": "tools",
  "id": "ghidriff",
  "json_url": "https://awesomerea.org/resources/ghidriff/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ghidriff/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ghidriff/index.md",
  "name": "ghidriff",
  "name_zh": "ghidriff Ghidra 二进制差异分析引擎",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.0.0, published 2025-07-04 on GitHub and PyPI, which requires Python 3.9+ and pyghidra 2.0+. The reviewed main commit, merged 2026-05-11, is six commits ahead and still reports version 1.0.0: it requires Python 3.10+ and pyghidra 3.x, targets Ghidra 12.0.4 and logs a warning when another Ghidra or pyghidra version is running. setup.cfg classifies the package as Alpha.",
    "Install Ghidra with a JDK supported by that release, set GHIDRA_INSTALL_DIR and install the package with pip or uvx; the README covers Windows, Linux and macOS, and its x64/arm64 Docker image ships the PyPI release so Ghidra and Java need not be installed on the host. Large binaries may need a larger JVM memory share.",
    "Supply two or more versions of the same binary, ordered oldest to newest, with an optional summary across several new versions; anything Ghidra can import and analyze can be compared, with a custom base address for firmware or bootloader images, analyzer options and GDT type archives. The supported-platforms page says native code works best, managed .NET results are mixed and native libraries must be taken out of an APK first. A preflight check stops the diff when the two programs' processor languages differ or their symbol counts differ by 4,000 or more, unless --force-diff is given. By default Ghidra's well-known PDB symbol servers are configured with a local symbol store unless --no-symbols is set.",
    "GPL-3.0. Matching quality depends on Ghidra's analysis and decompilation. The README's use cases and the documentation site's sample diffs cover Windows and macOS system binaries obtained separately; the repository ships no target binaries."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.0.0，于 2025-07-04 发布到 GitHub 和 PyPI，要求 Python 3.9+ 和 pyghidra 2.0+。所审阅的 main 分支提交合并于 2026-05-11，比该版本多六个提交，版本号仍为 1.0.0：它要求 Python 3.10+ 和 pyghidra 3.x，以 Ghidra 12.0.4 为目标版本，运行其他版本的 Ghidra 或 pyghidra 时会记录警告。setup.cfg 将该软件包标为 Alpha 阶段。",
    "需安装 Ghidra 及该版本支持的 JDK，设置 GHIDRA_INSTALL_DIR，再用 pip 或 uvx 安装；README 介绍了 Windows、Linux 和 macOS 上的配置，其 x64/arm64 Docker 镜像内置 PyPI 发布版，无需在主机上安装 Ghidra 和 Java。分析大型二进制时可能需要调高 JVM 内存占比。",
    "需提供同一二进制的两个或更多版本，按从旧到新的顺序排列，多个新版本时可附加汇总；凡是 Ghidra 能导入和分析的文件都可比较，并可为固件或引导程序镜像指定基址、自定义分析器选项和 GDT 类型库。支持平台页面指出原生代码效果最好，托管 .NET 代码结果不一，APK 中的原生库需先取出。预检若发现两个程序的处理器语言不同，或符号数量相差 4,000 个及以上，就会中止比对，除非指定 --force-diff。默认会配置 Ghidra 内置的知名 PDB 符号服务器和本地符号库，可用 --no-symbols 关闭。",
    "采用 GPL-3.0 许可。匹配质量取决于 Ghidra 的分析和反编译结果。README 的用例和文档站的示例差异报告针对另行获取的 Windows 和 macOS 系统二进制；仓库本身不附带任何目标二进制。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/clearbluejar/ghidriff",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}