Skip to content

Commit

Permalink
doc updates
Browse files Browse the repository at this point in the history
  • Loading branch information
clearbluejar committed Dec 20, 2023
1 parent 5f78f4c commit ff0bd71
Show file tree
Hide file tree
Showing 10 changed files with 507 additions and 467 deletions.
25 changes: 1 addition & 24 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -137,27 +137,4 @@ ghidriffs/
# pytest data (pulled from https://github.com/clearbluejar/ghidriff-test-data)
tests/data

.DS_Store


# docusaurus .gitignore
# Dependencies
/node_modules

# Production
/build

# Generated files
.docusaurus
.cache-loader

# Misc
.DS_Store
.env.local
.env.development.local
.env.test.local
.env.production.local

npm-debug.log*
yarn-debug.log*
yarn-error.log*
.DS_Store
6 changes: 6 additions & 0 deletions www/docs/README/Ghidriff vs Bindiff.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@



[![ghidriff vs bindiff](../../static/img/ghidriff-v-bindiff.png)](https://twitter.com/clearbluejar/status/1712093656708976868)

> 😆 In all seriousness, #bindiff is amazing. I use it alongside #ghidriff for really complicated diffs. (ie bindiff matching > ghidriff matching). Currently, I see ghidriff offering an edge for automation (via command-line diffing) and output (markdown). As the tools are both now open source, it will be fun to see how they evolve for the benefit of the community. - [Tweet](https://twitter.com/clearbluejar/status/1712095731924779370)
440 changes: 1 addition & 439 deletions www/docs/README/Use Cases.md

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion www/docs/README/_category_.json
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,5 @@
"type": "generated-index",
"description": "README Sections"
},
"collapsed": false
"collapsed": true
}
53 changes: 53 additions & 0 deletions www/docs/Social Diffing/Social Diffing.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
---
description: Sharing diff results
img: /static/img/social-diffing.png
---

![Alt text](../../static/img/social-diffing.png)
As the diff output of `ghidriff` is markdown, it can be shared almost anywhere.

### Sample Diffs

<div>
<a href="https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282"><img width="30%" align=top alt="image" src="https://github.com/clearbluejar/ghidriff/assets/3752074/d53b681f-8cc9-479c-af4c-5ec697cf4989"></a>
<a href="https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282#visual-chart-diff"><img width="30%" align=top alt="image" src="https://github.com/clearbluejar/ghidriff/assets/3752074/16d7ae4c-4df9-4bcd-b4af-0ce576d49ad1"></a>
<div>


## Github

### Gists

- Host your recent diff in a GitHub gist: [https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282](https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282)
- Deep link to interesting
- functions
- [CnRenameKey](https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282#cmrenamekey)
- command-line
- [ghidriff command line](https://gist.github.com/clearbluejar/b95ae854a92ee917cd0b5c7055b60282#command-line)


### READMEs

## Posting to a Github Gist

After you create you diff it will be located in `ghidriffs/diff.md`.

### Option 1: Post using `gh` client

`cat` to `stdin`:

```bash
cat ghidriff.md | gh gist create -f ghidriff.gist.filename.md -
```

### Option 2: Copy/Paste Markdown to new gist

Just copy paste to new file and make sure to set the filetype to `md`.

## Publishing on a blog

See some of the samples posted in the diffs(/diffs). If the blog enginer can render markdown, it should work.


## Tweet with deep links

26 changes: 26 additions & 0 deletions www/docs/guides/Diffing afd.sys - CVE-2023-21768.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
---
description: Diffing CVE-2023-21768 - The perfect diff (one line change only)
---


Details of the CVE-2023-21768 (detailed in this blog [post](https://securityintelligence.com/posts/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/)). What if you wanted to repeat this patch diff with `ghidriff`?

1. Download two versions of `AFD.sys` (vulnerable and patched):

```bash
wget https://msdl.microsoft.com/download/symbols/afd.sys/0C5C6994A8000/afd.sys -O afd.sys.x64.10.0.22621.1028
wget https://msdl.microsoft.com/download/symbols/afd.sys/50989142A9000/afd.sys -O afd.sys.x64.10.0.22621.1415
```

2. Run `ghidriff`:

```bash
ghidriff afd.sys.x64.10.0.22621.1028 afd.sys.x64.10.0.22621.1415
```

3. Review results

The diff results are posted in this GitHub [gist](https://gist.github.com/clearbluejar/f6fecbc507a9f1a92c9231e3db7ef40d). The vulnerable function `AfdNotifyRemoveIoCompletion` was identified here with a [single line change](https://gist.github.com/clearbluejar/f6fecbc507a9f1a92c9231e3db7ef40d#afdnotifyremoveiocompletion-diff).

Want to see the entire diff in a side by side? https://diffpreview.github.io/?f6fecbc507a9f1a92c9231e3db7ef40d or jump to the [single line change](https://diffpreview.github.io/?f6fecbc507a9f1a92c9231e3db7ef40d#d2h-703858:~:text=ProbeForWrite(*(PVOID%20*)(param_3%20%2B%200x18)%2C4%2C4)%3B)

419 changes: 419 additions & 0 deletions www/docs/guides/Diffing the Windows Kernel.md

Large diffs are not rendered by default.

3 changes: 0 additions & 3 deletions www/docs/guides/Getting Started.md

This file was deleted.

Binary file added www/static/img/ghidriff-v-bindiff.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added www/static/img/social-diffing.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit ff0bd71

Please sign in to comment.