BinDiff in game hacking

From the name it follows that it compares binary files (IDA databases) and matches functions. And it is very helpful in game hack development as games can update frequently and it is hard to manually transfer all reversed functions from old reverse to a new. This is where BinDiff helps, it can automatically match functions using a bunch of algorithms. However it struggles in matching functions that have changed significantly (for example, after a huge game update). But it still can find ~90% of functions and make your game reverse process much easier.

How to install?

For IDA <= 8.x you need just download and install from official GitHub repo.

For IDA 9.0, additionally replace files at C:\Users\<YourUsername>\AppData\Roaming\Hex-Rays\IDA Pro\plugins with files in ZIP archive attached to this message.

How to use?

Rename old IDA database to something like game_module_old.i64. Then open updated binary and let IDA fully analyze it (until it says "idle" in the left bottom corner). After analyze finished, click File -> BinDiff, choose old IDA database and wait a few minutes.

After BinDiff performs function matching you will see 4 windows: Secondary Unmatched, Primary Unmatched, Statistics and Matched Functions. In first two windows functions that BinDiff failed to match are listed, where "Secondary" is old IDA database, "Primary" is new. I suggest you to explore "Secondary Unmatched" list to know which functions you should manually find later. Hint: use filtering (right-click -> "Modify filters", common filters you can see below). The most interesting window is "Matched Functions". The "Simliraty" column is pretty trivial, it shows how similar function is to its old version. The "Confidence" tells how confident BinDiff is that it matched functions correctly. Usually values >0.95 means it is correct, 0.60>x>0.95 - verify manually, <0.6 can often indicate that match is incorrect, but still check yourself. Next, "EA" is a function address, "Algorithm" is how BinDiff matched functions. Usually you can filter out "Name Hash" algorithm, because names are already the same (if you want just to import names). The remainig numbers are mostly useless, you can read manual for its descriptions.

Now when you filtered out all functions you don't need, you can select function(-s) you want to import, right click and hit "Import Symbols and Comments" button. Congratulations, you now have latest game module with imported function names you reversed previously and you don't need to reverse from scratch! So now you can get new patterns for these function using SigMaker (this one is for IDA 9). This was just the basics, you can explore more BinDiff functionality yourself.