joxeankoret/diaphora

Diaphora handing on 'Related compilation unit'

krystalgamer opened this issue · 3 comments

krystalgamer commented

I have two 5Mb EXEs that each generate a 400Mb~ db. (30k functions)

The diffing gets stuck on `Finding with heuristic 'Related compilation unit'

image

Is there a way to get more insights on what's going on?

joxeankoret commented

Uhm... I'm afraid there is little to do here (even when the binaries aren't too big at all). Take a look to this:

diaphora/diaphora.py

Line 3518 in a3f9be0

def find_related_compilation_unit(self, iteration):

It looks to me that the SQL queries are running for very-very long. So, your options are:

  1. Run the SQL queries outside of Diaphora with a tool like SQLitebrowser or something like this and see how long they take. I can help you with this if you need help.
  2. Disable this specific heuristic by writing a Diaphora script and just returning False when the on_special_heuristic event happens and heur == "Related compilation unit".
  3. Let it run for whatever time it requires.

For option #2, you have an example skeleton script here: https://github.com/joxeankoret/diaphora/blob/master/hooks/hooks_example2.py#L101. Again, if you need help, tell me.

krystalgamer commented

Hey sorry late response. Didn't catch the notification. Will try to update this as soon as I can access my setup!

joxeankoret commented

I have marked this heuristic as slow, as it was causing problems to some reversers. As so, I'm closing this issues, but please reopen it if you think it's required.