RADIFF2(1)

💖 radiff2 — Binary Diffing Utility 💖

okay bestie, sit DOWN. this is radiff2, the binary diffing queen of the radare2 suite, and she is so much. she diffs binary code and data, she does architecture and bits specification, delta diffing, graph-based comparisons — like, the whole menu. 🦋

she supports a wide range of formats and features, and that includes architecture and bits specification, delta diffing, graph diffing, and more. no cap.

---

✨ SYNOPSIS ✨

radiff2 [-abcCdDehiJjlmnoOprqsStuUvVxXzZ] [-A [A]] [-B addr] [-g sym]
        [-m mode] [-o offset] [-l length] [-t %] [-S name] file1 file2

---

🌸 DESCRIPTION 🌸

a utility for diffing binary code and data, living inside the Radare2 suite. she does architecture and bits specification, delta diffing, and graph-based comparisons. 💅

and it's not just one lil thing — it supports a wide range of formats and features, including architecture and bits specification, delta diffing, graph diffing, and more. main character energy fr fr.

---

🎀 OPTIONS 🎀

• -a arch — pick which architecture plugin to use (x86, arm, etc.).
• -A [A] — run aaa or aaaa after loading each binary (go look at -C).
• -b bits — set the register size for the architecture (16 (thumb), 32, 64, etc.).
• -B addr — define the base address that gets added to offsets when listing.
• -c cmd — run an r2 command on every single RCore instance that gets created.
• -C — graphdiff code (columns: off-A, match-ratio, off-B) (see -A).
• -d — use delta diffing.
• -D — show disasm instead of hexpairs.
• -e k=v — set an eval config var value for all RCore instances.
• -f format — select the output format (see -f help for details).
• -g sym — graph diff of [sym], or of functions in [off1,off2].
• -i type — compare bin information (imports, exports, symbols, sections, etc.). see -i help for details.
• -j — output in JSON format.
• -l len — specify the final offset (length) for diffing. can use the A:B format to give each file its own length. 👯
• -m mode — choose the graph output mode (aditsjJ). see -m help for details.
• -n — count the number of changes.
• -o offset — specify the initial offset for diffing. can use the A:B format to give each file its own offset.
• -O — code diffing with opcode bytes only.
• -p — use physical addressing (io.va=false) (only for radiff2 -AC).
• -q — quiet mode (disables colors, reduces output).
• -r — output in radare commands.
• -s — compute edit distance (no substitution, Eugene W. Myers O(ND) diff algorithm).
• -ss — compute Levenshtein edit distance (substitution is allowed, O(N^2)).
• -S name — sort code diff (name, namelen, addr, size, type, dist) (only for -C or -g).
• -t % — set the threshold for code diff (default is 70%).
• -T — analyze files in threads (EXPERIMENTAL, 30% faster and crashy). 🙈

bestie be careful: -T is labeled EXPERIMENTAL, it's 30% faster, and it's crashy. the manpage said it, i'm just saying it louder.

• -u — unified output (---+++).
• -U — unified output using the system 'diff'.
• -v — show version information.
• -V — be verbose (currently only for -s).
• -x — show two-column hexdump diffing.
• -X — use xpatch format for the diffing output.

---

🌈 ENVIRONMENT 🌈

no environment variables are used. that's it, that's the section. she's low maintenance like that. ✨

---

👑 GRAPH OUTPUT FORMATS (-m [mode]) 👑

• -a — ASCII art (default).
• -s — r2 commands.
• -d — Graphviz dot.
• -g — Graph Modelling Language (GML).
• -j — JSON.
• -J — JSON with disassembly.
• -k — sdb key-value.
• -t — Tiny ASCII art.
• -i — Interactive ASCII art.

---

💅 USAGE EXAMPLES 💅

comparing two binaries:

$ radiff2 bin1 bin2

using graph diffing to compare functions by name:

$ radiff2 -g main bin1 bin2

counting the number of changes between two binaries:

$ radiff2 -n bin1 bin2

outputting the diff in a unified format:

$ radiff2 -u bin1 bin2

comparing the opcodes of two functions:

$ radiff2 -O bin1 bin2

compare specific sections of binaries with custom offsets:

$ radiff2 -o 0x1000 bin1 bin2

compare different sections with different offsets:

$ radiff2 -o 0x1000:0x2000 bin1 bin2

compare specific lengths from given offsets:

$ radiff2 -o 0x1000 -l 0x500 bin1 bin2

---

🫶 RADARE2 COMMANDS 🫶

the 'c' command in r2 is used for various comparison operations within data inside the same file. here are some examples of its usage:

compare a plain string with escaped chars:

c "string to compare"

compare byte at a specific address with current offset:

c1 0x100

compare block size bytes from current offset and the 0x100 offset:

cc 0x100

unified diff of disassembly from current seek and given address:

cud 0x200 @ 0x100

compare memory hexdumps in unified diff format:

cu 0x100 @ 0x200

for more detailed usage of the 'c' command, refer to the c[?dfx] [argument] help section. iykyk. 🔥

---

⭐ SEE ALSO ⭐

radare2(1)

---

🌐 WWW 🌐

https://www.radare.org/

---

💜 AUTHOR 💜

pancake <pancake@nopcode.org>

---

and that's the whole page, bestie — written by pancake <pancake@nopcode.org> (yes, the legend), and it's part of the radare2 world over at https://www.radare.org/. go diff something cute. mwah. 🎀💖✨