README
¶
Magento Corediff
A forensic tool to quickly find unauthorized modifications in an open source code base, such as Magento. Corediff compares each line of code with a database of 4.3M legitimate code hashes and shows you the lines that have not been seen before. A bit like @NYT_first_said.
"Corediff saved us countless hours"
"Very useful to gauge foreign codebases"
Corediff was created by Sansec, specialist in Magento security and digital forensics since 2010. Corediff analysis helped to uncover numerous cases of server side payment skimming that would otherwise have gone undetected.
Usage
Scanning
corediff [OPTIONS] <path>...
Scan a codebase against the hash database. In default mode, only official platform paths are checked. Use --ignore-paths to scan all files.
| Flag | Description |
|---|---|
-d, --database |
Hash database path (default: download Sansec database) |
-i, --ignore-paths |
Scan everything, not just core paths |
-s, --suspect |
Show suspect code lines only |
-t, --text |
Scan all valid UTF-8 text files |
--no-platform |
Don't check for app root |
-f, --path-filter |
Filter paths before diffing (e.g. vendor/magento) |
-v, --verbose |
Verbose output (-vv for per-file details) |
In the following example, Corediff reports a malicious backdoor in cron.php:
Database management
Index local paths
corediff db index -d custom.db <path>...
Index Packagist packages
corediff db index -d m2.db -p brick/math composer/ca-bundle guzzlehttp/guzzle
The -p / --packagist flag treats positional arguments as Packagist package names. Supports version pinning with vendor/pkg:1.2.3 or vendor/pkg@1.2.3.
Index from composer.json
corediff db index -d m2.db --composer /path/to/composer.json
Update previously indexed packages
corediff db index -d m2.db --update
Merge databases
corediff db merge -d all.db magento1.db magento2.db *.db
Self-update
corediff update
Installation
Use our binary package (available for Linux & Mac, arm64 & amd64)
osarch=$(uname -sm | tr 'LD ' 'ld-')
curl https://sansec.io/downloads/$osarch/corediff -O
chmod 755 corediff
./corediff <store-path> | less -SR
Or compile from source (requires recent Go version):
go install github.com/sansecio/corediff/cmd/corediff@latest
corediff <store-path>
At the first run, corediff will automatically download the hash database.
Community contributed datasets
@fros_it has kindly contributed hashes for his collection of Magento Connect extensions, including all available historical copies. Download the extension hash database here (62MB) and use it like this:
Contributing
Adding or maintaining hashes?
# Index a local path
corediff db index -d custom.db <path>
# Index Packagist packages
corediff db index -d custom.db -p vendor/package
# Merge databases for release
corediff db merge -d all.db magento1.db magento2.db *.db
In some cases, it is better to not add file paths to the hash database. All paths found in the database will be examined and reported in default mode. Should many varieties exist for a particular file (such as in DI/compiled code), we would rather exclude its scanning from default output, until we can be reasonably certain to have coverage for 99%+ versions out there. So for volatile paths, use the --ignore-paths flag when indexing.
Contributions welcome! Naturally, we only accept hashes from trusted sources.
About
Created by Willem de Groot. Malware contributions welcome.
(C) 2023-2026 Sansec BV
Directories