SYNOPSIS¶

DESCRIPTION¶

A utility for diffing binary code and data within the Radare2 suite, supporting architecture and bits specification, delta diffing, and graph-based comparisons.

It supports a wide range of formats and features, including architecture and bits specification, delta diffing, graph diffing, and more.

OPTIONS¶

-a arch

Specify architecture plugin to use (x86, arm, etc.).

-A [A]

Run aaa or aaaa after loading each binary (see -C).

-b bits

Specify register size for architecture (16 (thumb), 32, 64, etc.).

-B addr

Define the base address to add the offsets when listing.

-c cmd

Run an r2 command on every RCore instance created.

-C

Graphdiff code (columns: off-A, match-ratio, off-B) (see -A).

-d

Use delta diffing.

-D

Show disasm instead of hexpairs.

-e k=v

Set eval config var value for all RCore instances.

-f format

Select output format (see -f help for details).

-g sym

Graph diff of [sym] or functions in [off1,off2].

-i type

Compare bin information (imports, exports, symbols, sections, etc.). See -i help for details.

-j

Output in JSON format.

-l len

Specify final offset (length) for diffing, can use A:B format to specify different lengths for each file.

-m mode

Choose the graph output mode (aditsjJ). See -m help for details.

-n

Count number of changes.

-o offset

Specify initial offset for diffing, can use A:B format to specify different offsets for each file.

-O

Code diffing with opcode bytes only.

-p

Use physical addressing (io.va=false) (only for radiff2 -AC).

-q

Quiet mode (disable colors, reduce output).

-r

Output in radare commands.

-s

Compute edit distance (no substitution, Eugene W. Myers O(ND) diff algorithm).

-ss

Compute Levenshtein edit distance (substitution is allowed, O(N^2)).

-S name

Sort code diff (name, namelen, addr, size, type, dist) (only for -C or -g).

-t %

Set threshold for code diff (default is 70%).

-T

Analyze files in threads (EXPERIMENTAL, 30% faster and crashy).

-u

Unified output (---+++).

-U

Unified output using system 'diff'.

-v

Show version information.

-V

Be verbose (current only for -s).

-x

Show two-column hexdump diffing.

-X

Use xpatch format for the diffing output.

ENVIRONMENT¶

No environment variables are used.

GRAPH OUTPUT FORMATS (-m [mode])¶

-a

ASCII art (default).

-s

r2 commands.

-d

Graphviz dot.

-g

Graph Modelling Language (GML).

-j

JSON.

-J

JSON with disassembly.

-k

sdb key-value.

-t

Tiny ASCII art.

-i

Interactive ASCII art.

USAGE EXAMPLES¶

Comparing two binaries

$ radiff2 bin1 bin2

Using graph diffing to compare functions by name

$ radiff2 -g main bin1 bin2

Counting the number of changes between two binaries

$ radiff2 -n bin1 bin2

Outputting the diff in a unified format

$ radiff2 -u bin1 bin2

Comparing the opcodes of two functions

$ radiff2 -O bin1 bin2

Compare specific sections of binaries with custom offsets

$ radiff2 -o 0x1000 bin1 bin2

Compare different sections with different offsets

$ radiff2 -o 0x1000:0x2000 bin1 bin2

Compare specific lengths from given offsets

$ radiff2 -o 0x1000 -l 0x500 bin1 bin2

RADARE2 COMMANDS¶

The 'c' command in r2 is used for various comparison operations within data inside the same file. Here are some examples of its usage:

Compare a plain string with escaped chars

c "string to compare"

Compare byte at a specific address with current offset

c1 0x100

Compare block size bytes from current offset and the 0x100 offset

cc 0x100

Unified diff of disassembly from current seek and given address

cud 0x200 @ 0x100

Compare memory hexdumps in unified diff format

cu 0x100 @ 0x200

SEE ALSO¶

radare2(1)

WWW¶

https://www.radare.org/

AUTHOR¶

pancake <pancake@nopcode.org>