Attribute VB_Name = "modPEDifferExamples"
Option Explicit

'PE Differ Usage Examples
'David's Malware Analysis Toolkit

Sub Example1_SimpleComparison()
    'Basic comparison with text report
    
    Dim pe1 As New CPEEditor
    Dim pe2 As New CPEEditor
    Dim differ As New CPEDiffer
    
    'Load two versions of a file
    If Not pe1.LoadFile("C:\samples\malware_original.exe") Then Exit Sub
    If Not pe2.LoadFile("C:\samples\malware_modified.exe") Then Exit Sub
    
    'Compare
    If differ.Compare(pe1, pe2) Then
        If differ.HasChanges Then
            Debug.Print differ.GetTextReport
        Else
            Debug.Print "Files are identical!"
        End If
    End If
End Sub

Sub Example2_CategoryFiltering()
    'Get differences by category
    
    Dim pe1 As New CPEEditor
    Dim pe2 As New CPEEditor
    Dim differ As New CPEDiffer
    
    pe1.LoadFile "C:\samples\file1.exe"
    pe2.LoadFile "C:\samples\file2.exe"
    
    If differ.Compare(pe1, pe2) Then
        'Get only import differences
        Dim importDiffs As Collection
        Set importDiffs = differ.GetDifferencesByCategory(dcImports)
        
        If importDiffs.count > 0 Then
            Debug.Print "Import Differences:"
            Dim i As Long
            Dim d As CDiffEntry
            For i = 1 To importDiffs.count
                Set d = importDiffs(i)
                Debug.Print d.ToString
            Next
        End If
        
        'Get only section differences
        Dim sectDiffs As Collection
        Set sectDiffs = differ.GetDifferencesByCategory(dcSections)
        Debug.Print vbCrLf & "Section Differences: " & sectDiffs.count
    End If
End Sub

Sub Example3_ExportToFile()
    'Compare and export report to file
    
    Dim pe1 As New CPEEditor
    Dim pe2 As New CPEEditor
    Dim differ As New CPEDiffer
    
    pe1.LoadFile "C:\samples\packed.exe"
    pe2.LoadFile "C:\samples\unpacked.exe"
    
    If differ.Compare(pe1, pe2) Then
        Dim report As String
        report = differ.GetTextReport
        
        'Save to file
        Dim ff As Integer
        ff = FreeFile
        Open "C:\analysis\diff_report.txt" For Output As #ff
        Print #ff, report
        Close #ff
        
        Debug.Print "Report saved. Found " & differ.DiffCount & " differences."
    End If
End Sub

Sub Example4_BeforeAfterPacking()
    'Analyze changes from packing/unpacking
    
    Dim original As New CPEEditor
    Dim packed As New CPEEditor
    Dim differ As New CPEDiffer
    
    original.LoadFile "C:\samples\original.exe"
    packed.LoadFile "C:\samples\packed.exe"
    
    If differ.Compare(original, packed) Then
        Debug.Print "=== Packer Analysis ==="
        Debug.Print "Total Changes: " & differ.DiffCount
        Debug.Print vbCrLf
        
        'Check for common packer indicators
        Dim diffs As Collection
        Set diffs = differ.GetDifferences
        
        Dim d As CDiffEntry
        Dim i As Long
        For i = 1 To diffs.count
            Set d = diffs(i)
            
            'Look for suspicious changes
            If InStr(d.fieldName, "EntryPoint") > 0 Then
                Debug.Print "EntryPoint changed: " & d.value1 & " => " & d.value2
            ElseIf InStr(d.fieldName, "Section") > 0 And InStr(d.fieldName, "Characteristics") > 0 Then
                Debug.Print "Section characteristics modified: " & d.fieldName
            ElseIf InStr(d.fieldName, "Import") > 0 Then
                Debug.Print "Import modification: " & d.fieldName
            End If
        Next
    End If
End Sub

Sub Example5_ImpHashComparison()
    'Quick check if imports changed using imphash
    
    Dim pe1 As New CPEEditor
    Dim pe2 As New CPEEditor
    
    pe1.LoadFile "C:\samples\variant1.exe"
    pe2.LoadFile "C:\samples\variant2.exe"
    
    If pe1.impHash = pe2.impHash Then
        Debug.Print "Import hashes match - same import profile"
    Else
        Debug.Print "Import hashes differ:"
        Debug.Print "  File1: " & pe1.impHash
        Debug.Print "  File2: " & pe2.impHash
        
        'Now do detailed comparison
        Dim differ As New CPEDiffer
        differ.Compare pe1, pe2
        
        Dim importDiffs As Collection
        Set importDiffs = differ.GetDifferencesByCategory(dcImports)
        Debug.Print "  Import differences: " & importDiffs.count
    End If
End Sub

Sub Example6_MonitorForChanges()
    'Monitor a file for modifications over time
    
    Dim baseline As New CPEEditor
    Dim current As New CPEEditor
    Dim differ As New CPEDiffer
    
    Dim targetFile As String
    targetFile = "C:\monitored\suspicious.dll"
    
    'Load baseline
    baseline.LoadFile targetFile
    
    'Simulate time passing...
    'Later, check for changes
    
    current.LoadFile targetFile
    
    If differ.Compare(baseline, current) Then
        If differ.HasChanges Then
            Debug.Print "WARNING: File has been modified!"
            Debug.Print differ.GetTextReport
            
            'Alert on critical changes
            Dim diffs As Collection
            Set diffs = differ.GetDifferences
            
            Dim d As CDiffEntry, i As Long
            For i = 1 To diffs.count
                Set d = diffs(i)
                If InStr(d.fieldName, "Checksum") > 0 Or _
                   InStr(d.fieldName, "Timestamp") > 0 Or _
                   InStr(d.fieldName, "EntryPoint") > 0 Then
                    Debug.Print "CRITICAL: " & d.ToString
                End If
            Next
        Else
            Debug.Print "File unchanged."
        End If
    End If
End Sub

Sub Example7_BatchCompare()
    'Compare multiple file pairs in a batch
    
    Dim pairs() As String
    pairs = Split("original.exe:modified1.exe,original.exe:modified2.exe,original.exe:modified3.exe", ",")
    
    Dim pe1 As New CPEEditor
    Dim pe2 As New CPEEditor
    Dim differ As New CPEDiffer
    
    Dim i As Long
    For i = LBound(pairs) To UBound(pairs)
        Dim files() As String
        files = Split(pairs(i), ":")
        
        Debug.Print "Comparing: " & files(0) & " vs " & files(1)
        
        If pe1.LoadFile("C:\samples\" & files(0)) And _
           pe2.LoadFile("C:\samples\" & files(1)) Then
            
            differ.Compare pe1, pe2
            Debug.Print "  Changes: " & differ.DiffCount
            
            'Quick summary by category
            Debug.Print "    Imports: " & differ.GetDifferencesByCategory(dcImports).count
            Debug.Print "    Sections: " & differ.GetDifferencesByCategory(dcSections).count
            Debug.Print "    Resources: " & differ.GetDifferencesByCategory(dcResources).count
        End If
        Debug.Print ""
    Next
End Sub

Sub Example8_ShowDifferGUI()
    'Launch the GUI differ form
    frmPEDiffer.Show
End Sub
