Overview
Program Diff extends the CodeBrowser to display two programs side-by-side, computing and visualizing differences between them. Unlike Version Tracking which focuses on transferring analysis, Program Diff emphasizes interactive comparison and selective markup application.Program Diff allows you to compare any two compatible programs and selectively apply differences from one program to another.
Core Capabilities
Side-by-Side View
Synchronized dual-panel display of programs
Difference Highlighting
Visual marking of all differences between programs
Selective Application
Apply specific differences to the target program
Detail View
Examine detailed differences at cursor location
Getting Started
Opening a Second Program
Choose Program
Select from:
- Currently open programs in the tool
- Programs from project repository
- Versioned programs from Ghidra Server
Program Compatibility
Programs are compatible when:- Same processor architecture (language)
- Similar memory organization
- Overlapping address spaces
Computing Differences
Execute Diff Dialog
Configure Filters
Select which difference types to compute:
- Bytes
- Instructions
- Comments
- Labels
- Functions
- References
- And more…
Difference Types
Program Diff can detect differences in:- Code
- Symbols
- Annotations
- Structure
- Bytes: Raw byte differences
- Instructions: Disassembly differences
- Mnemonics: Instruction mnemonics only
- Operands: Instruction operands
Diff Filters
Customize which differences to display:Options: All Diffs, Code Diffs Only, User-Defined Only, Custom
Viewing Differences
Difference Highlighting
Differences are highlighted in both program views:- Background color: Marks addresses with differences
- Margin markers: Overview of diff locations
- Navigation: Jump between difference locations
Navigation Actions
Next Difference
Navigate to the next highlighted difference
Previous Difference
Navigate to the previous highlighted difference
Go to Address
Jump to specific address in both programs
Select All Diffs
Select all difference addresses in view
Synchronized Views
Both program panels remain synchronized:- Cursor location: Both views track the same address
- Scrolling: Synchronized scroll positions
- Selection: Selections span both programs
- Field focus: Same field types visible
Difference Details
Details Window
View detailed information about differences at current location:
Details include:
- Byte values: Hexadecimal comparison
- Disassembly: Instruction differences
- Markup: Comment and label differences
- Type information: Data type differences
Difference details update automatically as you navigate through the program.
Applying Differences
Apply Settings
Configure which differences to apply:Select Categories
Choose which difference types to apply:
- Replace: Overwrite with second program’s value
- Merge: Combine both values (where applicable)
- Ignore: Don’t apply this type
Applying Changes
- Apply Current
- Apply Selection
- Apply and Next
Apply differences at current cursor location:
- Position cursor on difference
- Click Apply in Diff Apply Settings
- Changes applied to primary program
Apply Filters
Control which categories are applied:| Category | Replace | Merge | Ignore |
|---|---|---|---|
| Bytes | Overwrite bytes | N/A | Skip |
| Instructions | Replace instruction | N/A | Skip |
| Comments | Replace comment | Append both | Skip |
| Labels | Replace label | Add alternate | Skip |
| Functions | Replace signature | Combine params | Skip |
| References | Replace refs | Add refs | Skip |
Selection Management
Making Selections
Selections work across both programs:- Click and drag: Select range in either panel
- Shift+Click: Extend selection
- Ctrl+Click: Add to selection
- Select All Diffs: Select all highlighted differences
Selection Actions
Set P1 Selection on P2
Set P1 Selection on P2
Transfer primary program’s selection to secondary program view.Use: Focus on same code in both programs
Ignore Selection
Ignore Selection
Mark selected differences to be ignored (not highlighted).Use: Hide unimportant differences
Apply Selection
Apply Selection
Apply all differences within selection to primary program.Use: Bulk apply related changes
Ignore Functionality
Temporarily hide specific differences:Advanced Features
Program Context
Diff can operate in different program contexts:- Same context: Compare identical address ranges
- Different context: Handle memory layout differences
- Overlay support: Compare overlay address spaces
Address Mapping
Program Diff handles address translation:- Compatible addresses: Direct mapping between programs
- Overlay conversion: Map overlay spaces appropriately
- Only in P1: Addresses existing only in first program
- Only in P2: Addresses existing only in second program
Addresses that exist in only one program are specially marked and handled during diff operations.
Diff History
Program Diff maintains history:- Previous location: Track last cursor position
- Navigation stack: Return to previous locations
- Undo/Redo: Revert applied changes
Tool Configuration
Options
Configure Diff behavior via Edit → Tool Options:Background color for highlighting differences
Keep cursors synchronized between programs
Automatically apply when navigating to next diff
Window Layout
Customize panel arrangement:- Resize second program panel
- Dock/undock details window
- Show/hide apply settings
- Configure field visibility
Comparison with Version Tracking
| Feature | Program Diff | Version Tracking |
|---|---|---|
| Purpose | Interactive comparison | Analysis transfer |
| Workflow | Immediate visual diff | Multi-step correlation |
| Scope | Address-by-address | Function/data matching |
| Application | Selective manual apply | Bulk automated apply |
| Best For | Quick comparisons | Version migration |
Use Cases
Patch Analysis
Compare original and patched executables to find fixes
Malware Variants
Identify differences between malware samples
Build Comparison
Compare debug vs. release builds
Binary Auditing
Verify compiled binary matches expected source
Obfuscation Analysis
Compare obfuscated and clean versions
Optimization Review
Analyze compiler optimization effects
Limitations and Considerations
Performance Tips
Troubleshooting
Can't Open Second Program
Can't Open Second Program
Checks:
- Verify programs have similar languages
- Check if another diff is already open
- Ensure program is in accessible project
- Confirm memory compatibility
No Differences Shown
No Differences Shown
Causes:
- Diff filter too restrictive
- Programs are identical in selected categories
- Comparison scope excludes differences
Apply Doesn't Work
Apply Doesn't Work
Checks:
- Verify apply settings configured (not all “Ignore”)
- Ensure selection includes differences
- Check for transaction conflicts
- Confirm program is not read-only
Slow Diff Performance
Slow Diff Performance
Solutions:
- Reduce diff scope to selection
- Disable some diff filters
- Use faster system or more memory
- Consider splitting into multiple sessions
Keyboard Shortcuts
| Action | Shortcut | Description |
|---|---|---|
| Next Diff | Ctrl+N | Navigate to next difference |
| Previous Diff | Ctrl+P | Navigate to previous difference |
| Apply and Next | Ctrl+Shift+N | Apply current and go to next |
| Select All Diffs | Ctrl+A | Select all differences in view |
| Show Details | Ctrl+D | Toggle Diff Details window |
Shortcuts can be customized via Edit → Tool Options → Key Bindings.
Source Code References
Menu Reference
Tools → Program Diff Menu
- Open/Close Second Program: Select program to compare
- Execute Diff: Compute differences with filters
- Next Difference: Navigate forward
- Previous Difference: Navigate backward
- Apply Differences: Apply at cursor or selection
- Ignore Selection and Goto Next: Skip differences
- Select All Differences: Select all diffs in view
Window Menu
- Diff Details: Show/hide detailed differences
- Diff Apply Settings: Configure apply behavior
Next Steps
Version Tracking
Advanced version comparison and analysis transfer
Graph Visualization
Visualize program structure and relationships
