Subtract one PE file from another!

Overview

PEDiffGen

A simple PE subtraction utility.

PEDiffGen.exe <pe1> <pe2> <output>

The above command generates the result of pe1 - pe2 in memory (as in, matching up with virtual addresses). This can be applied onto an in-memory image easily:

  for (size_t i = 0; i < diff_size; i += 0x1000)
  {
    const auto curr = diff + i;
    const auto chunk_size = std::min((size_t)(diff_size - i), (size_t)0x1000);
    if (std::all_of(curr, curr + chunk_size, [](uint8_t c) { return !!c; }))
      continue;
    uint8_t page[0x1000];
    std::transform(curr, curr + chunk_size, dll_base + i, page, [](uint8_t a, uint8_t b) { return a + b; });
    unprotect_memcpy(dll_base + i, page, chunk_size);
  }

It is recommended that you compress the subtraction result as most of it is zeros. After compression, this should produce one of the smallest possible footprints compared to other diffing methods.

License

PEDiffGen - A PE file subtraction tool
Copyright (C) 2021  namazso <[email protected]>

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.
You might also like...
YARP - Yet Another Robot Platform

YARP __ __ ___ ____ ____ \ \/ // || _ \ | _ \ \ // /| || |/ / | |/ / / // ___ || _ \ | _/ /_//_/ |_||_| \_\|_| ===================

Just another short video app (not tiktok) but 3 in 1.
Just another short video app (not tiktok) but 3 in 1.

Short videos app - India Another short videos app for Hindi audience. Made with 3 different apis: Moj app Josh app Chingari app Authetication No authe

Just another
Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin.

RemotePotato0 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that allows you to escalate

YACHT: Yet Another C++ Helper Template

YACHT: Yet Another C++ Helper Template A template for C++ projects. Welcome to your YACHT! Because why build a boat from scratch, when you can enjoy a

Han: ANother SOLOminer
Han: ANother SOLOminer

HAN Han: ANother SOLOminer WARNING: you may have to wait longer than the current age of the universe to find a valid block. Introduction HAN is a solo

Yet another matrix client. Click packaging for locally running on Ubuntu Touch

Cinny Click Packaging Cinny is a Matrix client focusing primarily on simple, elegant and secure interface. License Cinny source package licensed under

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file
Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

Process Ghosting This is my implementation of the technique presented by Gabriel Landau: https://www.elastic.co/blog/process-ghosting-a-new-executable

"Sigma File Manager" is a free, open-source, quickly evolving, modern file manager (explorer / finder) app for Windows, MacOS, and Linux.

"Sigma File Manager" is a free, open-source, quickly evolving, modern file manager (explorer / finder) app for Windows, MacOS, and Linux.

Cobalt Strike Beacon Object File (BOF) that takes the name of of a PE file as an argument and spawns the process in a suspended state
Cobalt Strike Beacon Object File (BOF) that takes the name of of a PE file as an argument and spawns the process in a suspended state

Beacon Object File (BOF) that spawns an arbitrary process from beacons memory. Supports Parent Process ID (PPID) spoofing & blocking non-MS signed DLLs from loading into the processes memory (some EDR DLLs).

Owner
null
Second project for 42 : Reading text available on the file descriptor one line at a time.

get_next_line Initial commit This project will not only allow you to add a very convenient function to your collection, but it will also allow you to

Dieau 1 Mar 28, 2022
Simple one file header for hijacking windows version.dll for desired executable to do 3rd party modifying without dll injection.

Version-Hijack Simple one file header for hijacking windows version.dll for desired executable to do 3rd party modifying without dll injection. Usage

sneakyevil 6 Oct 19, 2022
Yet another alarm (control) panel for Home Assistant.

HASS-YAAP Yet another alarm (control) panel for Home Assistant. Change alarm system mode (away, home, night, disarmed) Welcome people arriving by thei

Paul-Vincent Roll 48 Dec 4, 2021
Another version of EVA using anti-debugging techs && using Syscalls

EVA2 Another version of EVA using anti-debugging techs && using Syscalls First thing: Dont Upload to virus total. this note is for you and not for me.

null 273 Dec 26, 2022
Yet Another Ghidra Integration for IDA

Yagi Yet Another Ghidra Integration for IDA Overview Yagi intends to include the wonderful Ghidra decompiler into both IDA pro and IDA Free. ?? You ca

Airbus CERT 390 Dec 8, 2022
Another try to re-create Project Astoria , or some bridge between A and W...

Bridge 1.0.10.0 Forked from: https://github.com/DroidOnUWP/Bridge Abstract Another "Project Astoria" remake (UWP) Original status: Forgotten (?) My ac

Media Explorer 6 Nov 15, 2022
Yet another abstraction layer - a general purpose C++ library.

Yet Another Abstraction Layer What yaal is a cross platform, general purpose C++ library. This library provides unified, high level, C++ interfaces an

Marcin Konarski 14 Jul 27, 2022
Yet another Hi-C scaffolding tool

YaHS: yet another Hi-C scaffolding tool Overview YaHS is scaffolding tool using Hi-C data. It relies on a new algothrim for contig joining detection w

null 55 Dec 19, 2022
This is just another Potato to get SYSTEM via SeImpersonate privileges.

MultiPotato First of all - credit to @splinter_code & @decoder_it for RoguePotato as this code heavily bases on it. This is just another Potato to get

null 467 Dec 29, 2022
Sysfex - Another system information tool written in C++

Sysfex Another neofetch-like system information fetching tool for linux-based systems written in C++ Installation To install this program using the pr

Mehedi Rahman Mahi 110 Dec 24, 2022