Diaphora 3.4.3 adds IDA 9.5 beta support and a retrained matching model

What happened on 2026-10-11

At 10:51 UTC on 2026-10-11, Diaphora published 3.4.3 on GitHub, describing it as yet another maintenance release with support for IDA 9.5, currently in beta. The release notes list a retrained model supporting scikit-learn 1.4 or later, with the supplied trained model re-enabled by default. They also list fixes: Qt components no longer load when Diaphora runs without a GUI, such as under idalib or idat; the "MD-Index and KOKA hash" and "Brute-forcing (Compilation Unit)" heuristics no longer ignore partial results entirely; and call_on_match_hook() no longer sets the main function's name as the diff function name. Several typos were fixed, mostly reported by AI tools according to the notes, the README was updated, and dark mode support was added in IDA. Diaphora is an open-source tool for comparing functions between two binaries.

What it means for a defender's threat model

Binary diffing relates to defenders in two ways. One is risk: comparing adjacent versions of the same app quickly shows which functions changed, so a release that changes only a few places effectively tells an analyst where to look. Analysis work can carry over between versions, and churning a little code in each release does little on its own to resist analysis. The fix for headless runs makes such comparisons easier to batch and automate. The other is utility: the same technique can help you check your own artifacts. For example, you can confirm that a hardening step took effect in two consecutive releases, or, when you suspect an imitation of your app, compare your binary with the suspect sample to assemble technical evidence for follow-up (legal questions need professional advice). The honest conclusion stays the same: do not rely on obscurity, and keep core rules on the server.

Checks on your own builds

You can make diffing part of your own release checks. Keep the build artifacts and symbol files for every official release so you can compare them later. Before shipping, diff the new binary against the previous release to confirm that the scope of changes matches expectations, and check that hardening or obfuscation applied to every function you intended, so no build silently skips a protection step. When you must ship a security fix, assess whether the related decision can also move to the server, because the changed client code will stand out. Run these comparisons only on artifacts you own, and run analysis tools in an isolated environment. Before upgrading an analysis tool, read its release notes and re-confirm earlier comparison results under the new version.

Your checklist

• Archive build artifacts and symbol files for every official release
• Diff your own consecutive releases before shipping to confirm change scope and hardening coverage
• Keep security-relevant decisions on the server where possible