RADIFF2(1)

radiff2 - Binary Diffing Utility

SYNOPSIS
radiff2 [-abcCdDehiJjlmnoOprqsStuUvVxXzZ] [-A [A]] [-B addr] [-g sym] [-m mode] [-o offset] [-l length] [-t %] [-S name] file1 file2

DESCRIPTION
A utility for diffing binary code and data within the Radare2 suite, supporting architecture and bits specification, delta diffing, and graph-based comparisons.

It supports a wide range of formats and features, including architecture and bits specification, delta diffing, graph diffing, and more.

OPTIONS

-a arch
    Specify architecture plugin to use (x86, arm, etc.).

-A [A]
    Run aaa or aaaa after loading each binary (see -C).

-b bits
    Specify register size for architecture (16 (thumb), 32, 64, etc.).

-B addr
    Define the base address to add the offsets when listing.

-c cmd
    Run an r2 command on every RCore instance created.

-C  Graphdiff code (columns: off-A, match-ratio, off-B) (see -A).

-d  Use delta diffing.

-D  Show disasm instead of hexpairs.

-e k=v
    Set eval config var value for all RCore instances.

-f format
    Select output format (see -f help for details).

-g sym
    Graph diff of [sym] or functions in [off1,off2].

-i type
    Compare bin information (imports, exports, symbols, sections, etc.). See -i help for details.

-j  Output in JSON format.

-l len
    Specify final offset (length) for diffing, can use A:B format to specify different lengths for each file.

-m mode
    Choose the graph output mode (aditsjJ). See -m help for details.

-n  Count number of changes.

-o offset
    Specify initial offset for diffing, can use A:B format to specify different offsets for each file.

-O  Code diffing with opcode bytes only.

-p  Use physical addressing (io.va=false) (only for radiff2 -AC).

-q  Quiet mode (disable colors, reduce output).

-r  Output in radare commands.

-s  Compute edit distance (no substitution, Eugene W. Myers O(ND) diff algorithm).

-ss Compute Levenshtein edit distance (substitution is allowed, O(N^2)).

-S name
    Sort code diff (name, namelen, addr, size, type, dist) (only for -C or -g).

-t %
    Set threshold for code diff (default is 70%).

-T  Analyze files in threads (EXPERIMENTAL, 30% faster and crashy).

-u  Unified output (---+++).

-U  Unified output using system 'diff'.

-v  Show version information.

-V  Be verbose (current only for -s).

-x  Show two-column hexdump diffing.

-X  Use xpatch format for the diffing output.

ENVIRONMENT

No environment variables are used.

GRAPH OUTPUT FORMATS (-m [mode])

-a  ASCII art (default).

-s  r2 commands.

-d  Graphviz dot.

-g  Graph Modelling Language (GML).

-j  JSON.

-J  JSON with disassembly.

-k  sdb key-value.

-t  Tiny ASCII art.

-i  Interactive ASCII art.

USAGE EXAMPLES

Comparing two binaries
    $ radiff2 bin1 bin2

Using graph diffing to compare functions by name
    $ radiff2 -g main bin1 bin2

Counting the number of changes between two binaries
    $ radiff2 -n bin1 bin2

Outputting the diff in a unified format
    $ radiff2 -u bin1 bin2

Comparing the opcodes of two functions
    $ radiff2 -O bin1 bin2

Compare specific sections of binaries with custom offsets
    $ radiff2 -o 0x1000 bin1 bin2

Compare different sections with different offsets
    $ radiff2 -o 0x1000:0x2000 bin1 bin2

Compare specific lengths from given offsets
    $ radiff2 -o 0x1000 -l 0x500 bin1 bin2

RADARE2 COMMANDS
The 'c' command in r2 is used for various comparison operations within data inside the same file. Here are some examples of its usage:

Compare a plain string with escaped chars
    c "string to compare"

Compare byte at a specific address with current offset
    c1 0x100

Compare block size bytes from current offset and the 0x100 offset
    cc 0x100

Unified diff of disassembly from current seek and given address
    cud 0x200 @ 0x100

Compare memory hexdumps in unified diff format
    cu 0x100 @ 0x200
For more detailed usage of the 'c' command, refer to the `c[?dfx] [argument]` help section.

SEE ALSO

radare2(1)

WWW

https://www.radare.org/

AUTHOR

pancake <pancake@nopcode.org>