# NullSec BinaryDiff

**Binary Comparison Tool**

A comprehensive binary diff and analysis tool written in Swift, demonstrating protocol-oriented programming for security-focused binary comparison.

![Swift](https://img.shields.io/badge/Swift-FA7343?style=for-the-badge&logo=swift&logoColor=white)
![Security](https://img.shields.io/badge/Security-Tool-red?style=for-the-badge)
![Version](https://img.shields.io/badge/Version-1.0.0-blue?style=for-the-badge)
![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge)

## 🎯 Overview

NullSec BinaryDiff compares binary files to identify changes in sections, functions, imports, and exports. It highlights security-sensitive modifications and calculates similarity scores for patch analysis and malware research.

## ✨ Features

- **Section Comparison** - Detect changes in .text, .data, .bss sections
- **Function Diffing** - Track function additions, removals, modifications
- **Import/Export Analysis** - Monitor library dependencies
- **Security Highlighting** - Flag changes to sensitive functions
- **Similarity Scoring** - Calculate binary similarity percentage
- **Complexity Tracking** - Monitor cyclomatic complexity changes

## 🔍 Analysis Types

| Type | Description | Severity |
|------|-------------|----------|
| .text Modified | Code section changed | High |
| Security Func Changed | auth/crypto function modified | High |
| Section Added | New section in binary | Low |
| Function Removed | Function deleted | Medium |
| Import Added | New library dependency | Info |

## 📦 Installation

```bash
# Clone the repository
git clone https://github.com/bad-antics/nullsec-binarydiff
cd nullsec-binarydiff

# Compile with swiftc
swiftc -O binarydiff.swift -o binarydiff

# Or run directly
swift binarydiff.swift
```

## 🚀 Usage

```bash
# Compare two binaries
./binarydiff app_v1 app_v2

# Function-level diff only
./binarydiff -f old.so new.so

# Section-level diff only
./binarydiff -s binary1 binary2

# JSON output
./binarydiff -j old new

# Run demo mode
./binarydiff
```

## 💻 Example Output

```
╔══════════════════════════════════════════════════════════════════╗
║            NullSec BinaryDiff - Binary Comparison Tool           ║
╚══════════════════════════════════════════════════════════════════╝

[Demo Mode]

Comparing sample binaries...

  Section Differences:

  [~] .text
    Type:   MODIFIED
    Reason: Section content changed

  [~] .data
    Type:   MODIFIED
    Reason: Section content changed

  [+] .plt
    Type:   ADDED
    Reason: New section added

  Function Differences:

  [HIGH] ~ auth_user 🔒
    • Size: 200 → 350
    • Complexity: 8 → 12

  [MEDIUM] ~ main
    • Size: 500 → 600
    • Complexity: 15 → 18

  [HIGH] - unsafe_strcpy 🔒
    • Function removed

  [INFO] + new_feature
    • New function

  Import Changes:
    [-] libssl.so.1.1
    [+] libssl.so.3
    [+] libpthread.so.0

═══════════════════════════════════════════

  Summary:
    Old Binary:  /usr/bin/app_v1.0
    New Binary:  /usr/bin/app_v2.0
    Similarity:  20.0%

  Changes:
    Sections:    4
    Functions:   5
    Imports:     3
    Exports:     1

  Security-Sensitive Changes: 2
```

## 🏗️ Architecture

```
┌─────────────────────────────────────────────────────────────┐
│                   Binary Parser                              │
│           ELF | Mach-O | PE Format Support                  │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│              Binary Info Extraction                          │
│    Sections | Functions | Imports | Exports | Hashes        │
└─────────────────────────────────────────────────────────────┘
                           │
           ┌───────────────┼───────────────┐
           ▼               ▼               ▼
     ┌──────────┐   ┌──────────┐   ┌──────────┐
     │ Section  │   │ Function │   │  Symbol  │
     │ Compare  │   │ Compare  │   │ Compare  │
     └──────────┘   └──────────┘   └──────────┘
           │               │               │
           └───────────────┼───────────────┘
                           ▼
                   ┌──────────────┐
                   │ DiffAnalysis │
                   │   Result     │
                   └──────────────┘
```

## 🦅 Swift Features Demonstrated

- **Enums with Associated Values** - `DiffType`, `Severity`
- **Structs** - Value types for `Section`, `FunctionEntry`, `BinaryInfo`
- **Computed Properties** - `Severity.color`
- **Protocol Extensions** - `CaseIterable`
- **Optionals** - Safe handling of missing data
- **Higher-Order Functions** - `filter`, `map`, `contains`
- **Set Operations** - `subtracting` for diff calculation
- **String Interpolation** - Clean output formatting

## 🔧 Data Structures

```swift
struct BinaryInfo {
    let path: String
    let size: UInt64
    let hash: String
    let sections: [Section]
    let functions: [FunctionEntry]
    let imports: [String]
    let exports: [String]
}

struct FunctionDiff {
    let diffType: DiffType
    let oldFunc: FunctionEntry?
    let newFunc: FunctionEntry?
    let severity: Severity
    let changes: [String]
}
```

## 🔐 Security-Sensitive Functions

The tool flags changes to these function patterns:
- **Memory**: `strcpy`, `memcpy`, `malloc`, `free`
- **System**: `system`, `exec`, `popen`, `fork`
- **Network**: `connect`, `bind`, `recv`, `send`
- **Crypto**: `crypt`, `encrypt`, `decrypt`
- **Auth**: `auth`, `login`, `verify`, `validate`

## 🛡️ Security Use Cases

- **Patch Analysis** - Understand security patch changes
- **Malware Research** - Compare malware variants
- **Supply Chain** - Verify binary integrity
- **Forensics** - Identify unauthorized modifications
- **Vulnerability Research** - Track function changes

## ⚠️ Legal Disclaimer

This tool is intended for:
- ✅ Authorized security research
- ✅ Malware analysis (authorized samples)
- ✅ Patch verification
- ✅ Educational purposes

**Only analyze binaries you're authorized to examine.**

## 🔗 Links

- **Portal**: [bad-antics.github.io](https://bad-antics.github.io)
- **Discord**: [x.com/AnonAntics](https://x.com/AnonAntics)
- **GitHub**: [github.com/bad-antics](https://github.com/bad-antics)

## 📄 License

MIT License - See LICENSE file for details.

## 🏷️ Version History

- **v1.0.0** - Initial release with binary comparison and security analysis

---

*Part of the NullSec Security Toolkit*