NAME¶

radiff2 — unified binary diffing utility

SYNOPSIS¶

DESCRIPTION¶

radiff2 implements many binary diffing algorithms for data and code.

-1

Binary output (GDIFF format)

-A

Analyze binary after loading it with RCore (see -C) and use -AA to run aaaa instead of aaa.

-a

Specify architecture (x86, arm, ..)

-b

Select register size bits for given arch

-B baddr

Specify the base address to add to the offsets in the diff listings

-c

Count number of differences.

-e -[k=v]

Specify eval config vars for all RCore instances created.

-C

Code diffing using graphdiff algorithm. Output columns are: file-a-address, percentage of most similar function in B file | file-b-address. (Use with -A to analyze the binaries to find more functions)

-d

Use delta diffing (slower).

-D

Show disasm instead of hexpairs (honors -a arch and -b bits)

-g sym | off1,off2

Graph diff output of given symbol, or between two functions, at given offsets: one for each binary.

-G [cmd]

Run given command after creating each core instance

-h

Show usage help message.

-i i, s, c, m, f

Compare (i)mports, (s)ymbols, (c)lassnames, (m)ethods, (f)ields from given files (radiff2 -ii /bin/ls /bin/cat)

-j

Use JSON for output

-n

Suppress address names (show only addresses) when code diffing.

-O

Do code diffing with opcode bytes only.

-m [graphmode]

Specify the graph mode (i)nteractive, (k)ey-value, (j)son, (J)son2, (t)iny, (d)ot, (s)tar, (g)ml, (m)ermaid

-p

Use physical addressing (io.va=0)

-q

Quiet mode: disable colors and reduce output

-r

Output in radare commands as a binary patch.

-x

Show two column hexdump diffing.

-X

Show two column hexII diffing.

-s

Compute edit distance (no substitution, Eugene W. Myers' O(ND) diff algorithm) between two files.

-ss

Compute Levenshtein edit distance (substitution is allowed, O(N^2)) between two files.

-S [name, namelen, dist, size, ...]

Specify which column of the code diffing algo use for diffing

-t 0-100

Choose matching threshold for binary code diffing

-u

Unified diff output

-U

Unified diff output using system´s diff program

-v

Show version information.

-V

Be verbose sometimes

-z

Perform diff on extracted strings

-Z

Perform diff using zignatures instead of function list (NEW)

SEE ALSO¶

radare2(1)

AUTHORS¶

pancake <pancake@nopcode.org>