如何在Linux中比较二进制文件？

  00 90 00 11

  00 91 00 10

  00000001 90 91
  00000003 11 10

#1 楼

这将以十六进制形式打印偏移量和字节：

cmp -l file1.bin file2.bin | gawk '{printf "%08X %02X %02X\n", , strtonum(0), strtonum(0)}'

或执行-1以使第一个打印的偏移量从0开始。

cmp -l file1.bin file2.bin | gawk '{printf "%08X %02X %02X\n", -1, strtonum(0), strtonum(0)}'

不幸的是，strtonum()是特定于GAWK的，因此对于其他版本的awk（例如mawk），您将需要使用八进制到十进制的转换函数。例如，

cmp -l file1.bin file2.bin | mawk 'function oct2dec(oct,     dec) {for (i = 1; i <= length(oct); i++) {dec *= 8; dec += substr(oct, i, 1)}; return dec} {printf "%08X %02X %02X\n", , oct2dec(), oct2dec()}'

为便于阅读而中断：

cmp -l file1.bin file2.bin |
    mawk 'function oct2dec(oct,    dec) {
              for (i = 1; i <= length(oct); i++) {
                  dec *= 8;
                  dec += substr(oct, i, 1)
              };
              return dec
          }
          {
              printf "%08X %02X %02X\n", , oct2dec(), oct2dec()
          }'

#2 楼

正如〜quack指出的那样：

 % xxd b1 > b1.hex
 % xxd b2 > b2.hex

然后

 % diff b1.hex b2.hex

或

 % vimdiff b1.hex b2.hex

#3 楼

diff + xxd


在以下zsh / bash进程替换组合中尝试diff：

diff -y <(xxd foo1.bin) <(xxd foo2.bin)

其中：



-y并排显示差异（可选）。

xxd是CLI工具，用于创建二进制文件的hexdump输出文件。
将-W200添加到diff以实现更宽的输出（每行200个字符）。
对于颜色，请使用colordiff，如下所示。


colordiff + xxd


如果使用colordiff，它可以使diff的输出着色，例如： />
样本输出：




sudo apt-get install colordiff + vimdiff


也可以使用xxd ，例如

colordiff -y <(xxd foo1.bin) <(xxd foo2.bin)

提示：


如果文件太大，请添加限制（例如vimdiff）每个-l1000

#4 楼

有一个叫做DHEX的工具可以完成这项工作，还有另一个叫VBinDiff的工具。

对于严格的命令行方法，请尝试jojodiff。

#5 楼

适用于字节添加/删除的方法

diff <(od -An -tx1 -w1 -v file1) \
     <(od -An -tx1 -w1 -v file2)

删除一个字节64即可生成测试用例：

for i in `seq 128`; do printf "%02x" "$i"; done | xxd -r -p > file1
for i in `seq 128`; do if [ "$i" -ne 64 ]; then printf "%02x" $i; fi; done | xxd -r -p > file2

输出：

64d63
<  40

如果还想查看字符的ASCII版本：

bdiff() (
  f() (
    od -An -tx1c -w1 -v "" | paste -d '' - -
  )
  diff <(f "") <(f "")
)

bdiff file1 file2

输出：

64d63
<   40   @

在Ubuntu 16.04上进行了测试。

我更喜欢od而不是xxd，因为：
它是POSIX，xxd不是（Vim附带）
具有-An删除不带awk的地址列。

命令说明：



-An删除地址列。这很重要，否则所有的行在添加/删除字节后都会有所不同。

-w1每行放置一个字节，以便diff可以使用它。每行只有一个字节至关重要，否则删除后的每一行将变得异相并且有所不同。不幸的是，这不是POSIX，而是存在于GNU中。

-tx1是您想要的表示形式，只要您每行保留1个字节，就可以更改为任何可能的值。

-v防止星号重复缩写*，这可能会影响差异

paste -d '' - -每两行连接一次。我们需要它，因为十六进制和ASCII会进入单独的相邻行。摘自：https://stackoverflow.com/questions/8987257/concatenating-every-other-line-with-the-next

我们使用括号()定义bdiff而不是{}来限制范围内部函数f的详细信息，另请参见：https://stackoverflow.com/questions/8426077/how-to-define-a-function-inside-another-function-in-bash


另请参见：


https://unix.stackexchange.com/questions/59849/diff-binary-files-of-different-sizes
https：// stackoverflow.com/questions/8385618/using-cmp-to-compare-two-binaries

#6 楼

简短答案

vimdiff <(xxd -c1 -p first.bin) <(xxd -c1 -p second.bin)

当使用hexdumps和text diff比较二进制文件时，尤其是xxd时，字节的增加和减少会导致寻址移位，这可能使它很难看清。此方法告诉xxd不输出地址，并且每行仅输出一个字节，从而准确显示更改，添加或删除的字节。您可以稍后通过在更“正常”的十六进制转储（xxd first.bin的输出）中搜索有趣的字节序列来找到地址。

#7 楼

我建议使用hexdump将二进制文件转储为文本格式，将kdiff3转储为不同的视图。

hexdump myfile1.bin > myfile1.hex
hexdump myfile2.bin > myfile2.hex
kdiff3 myfile1.hex myfile2.hex

#8 楼

hexdiff是一个旨在完全满足您所寻找目的的程序。

用法：

hexdiff file1 file2

它显示十六进制（和7位ASCII码），两个文件一个接一个地显示，并突出显示所有差异。查看man hexdiff中要在文件中四处移动的命令，然后将退出一个简单的q。

#9 楼

它可能不能严格回答这个问题，但是我用它来区分二进制文件：

gvim -d <(xxd -c 1 ~/file1.bin | awk '{print , }') <(xxd -c 1 ~/file2.bin | awk '{print , }')

它以十六进制和ASCII值打印文件，每行一个字节，并且然后使用Vim的diff工具以可视方式呈现它们。

#10 楼

固件分析工具binwalk通过其-W / --hexdump命令行选项也具有此功能，该选项提供了仅显示不同字节的选项：

    -W, --hexdump                Perform a hexdump / diff of a file or files
    -G, --green                  Only show lines containing bytes that are the same among all files
    -i, --red                    Only show lines containing bytes that are different among all files
    -U, --blue                   Only show lines containing bytes that are different among some files
    -w, --terse                  Diff all files, but only display a hex dump of the first file

在OP中进行binwalk -W file1.bin file2.bin时的示例：



添加| less -r进行分页。

#11 楼

dhex http://www.dettus.net/dhex/

DHEX不只是另一个十六进制编辑器：它包括diff模式，可用于轻松方便地比较两个二进制文件。由于它基于ncurses且具有主题性，因此它可以在任何数量的系统和方案上运行。利用搜索日志，可以轻松跟踪文件不同迭代中的更改。

#12 楼

下面是一个Perl脚本colorbindiff，它执行二进制diff，并考虑了字节更改，但也考虑了字节加/减（此处提出的许多解决方案仅处理字节更改），就像在文本diff中一样。它也可以在GitHub上使用。

它与颜色并排显示结果，这极大地方便了分析。

colorbindiff输出快照

要使用它：

perl colorbindiff.pl FILE1 FILE2

脚本：

#!/usr/bin/perl
#########################################################################
#
# VBINDIFF.PL : A side-by-side visual diff for binary files.
#               Consult usage subroutine below for help.
#
# Copyright (C) 2020 Jerome Lelasseux jl@jjazzlab.com
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
#
#########################################################################

use warnings;
use strict;
use Term::ANSIColor qw(colorstrip colored);
use Getopt::Long qw(GetOptions);
use File::Temp qw(tempfile);
use constant BLANK => "..";
use constant BUFSIZE =>  64 * 1024;     # 64kB

sub usage
{
    print "USAGE: q4312078q [OPTIONS] FILE1 FILE2\n";
    print "Show a side-by-side binary comparison of FILE1 and FILE2. Show byte modifications but also additions and deletions, whatever the number of changed bytes. Rely on the 'diff' external command such as found on Linux or Cygwin. The algorithm is not suited for large and very different files.\n";
    print "Author: Jerome Lelasseux \@2021\n";
    print "OPTIONS: \n";
    print " --cols=N       : display N columns of bytes.diff Default is 16.\n";
    print " --no-color     : don't colorize output. Needed if you view the output in an editor.\n";
    print " --no-marker    : don't use the change markers (+ for addition, - for deletion, * for modified).\n";
    print " --no-ascii     : don't show the ascii columns.\n";
    print " --only-changes : only display lines with changes.\n";
    exit;
}

# Command line arguments
my $maxCols = 16;
my $noColor = 0;
my $noMarker = 0;
my $noAscii = 0;
my $noCommon = 0;
GetOptions(
    'cols=i'       => $maxCols,
    'no-ascii'     => $noAscii,
    'no-color'     => $noColor,
    'no-marker'    => $noMarker,
    'only-changes' => $noCommon
) or usage();
usage() unless ($#ARGV == 1);
my ($file1, $file2) = (@ARGV);


# Convert input files into hex lists
my $fileHex1 = createHexListFile($file1);
my $fileHex2 = createHexListFile($file2);


# Process diff -y output to get an easy-to-read side-by-side view
my $colIndex = 0;
my $oldPtr = 0;
my $newPtr = 0;
my $oldLineBuffer = sprintf("0x%04X ", 0);
my $newLineBuffer = sprintf("0x%04X ", 0);
my $oldCharBuffer;
my $newCharBuffer;
my $isDeleting = 0;
my $isAdding = 0;
my $isUnchangedLine = 1;

open(my $fh, '-|', qq(diff -y $fileHex1 $fileHex2)) or die $!;
while (<$fh>)
{
    # Parse line by line the output of the 'diff -y' on the 2 hex list files.
    # We expect:
    # "xx      | yy" for a modified byte
    # "        > yy" for an added byte
    # "xx      <"    for a deleted byte
    # "xx        xx" for identicial bytes

   my ($oldByte, $newByte);
   my ($oldChar, $newChar);
   if (/\|/)
   {
        # Changed
        if ($isDeleting || $isAdding)
        {
            printLine($colIndex);
        }
        $isAdding = 0;
        $isDeleting = 0;
        $isUnchangedLine = 0;

        /([a-fA-F0-9]+)([^a-fA-F0-9]+)([a-fA-F0-9]+)/;
        $oldByte = formatByte(, 3);
        $oldChar = toPrintableChar(, 3);
        $newByte = formatByte(, 3);
        $newChar = toPrintableChar(, 3);
        $oldPtr++;
        $newPtr++;
   }
   elsif (/</)
   {
        # Deleted in new
        if ($isAdding)
        {
            printLine($colIndex);
        }
        $isAdding = 0;
        $isDeleting = 1;
        $isUnchangedLine = 0;

        /([a-fA-F0-9]+)/;
        $oldByte=formatByte(, 2);
        $oldChar=toPrintableChar(, 2);
        $newByte=formatByte(BLANK, 2);
        $newChar=colorize(".", 2);
        $oldPtr++;
   }
   elsif (/>/)
   {
        # Added in new
        if ($isDeleting)
        {
            printLine($colIndex);
        }
        $isAdding = 1;
        $isDeleting = 0;
        $isUnchangedLine = 0;

        /([a-fA-F0-9]+)/;
        $oldByte=formatByte(BLANK, 1);
        $oldChar=colorize(".", 1);
        $newByte=formatByte(, 1);
        $newChar=toPrintableChar(, 1);
        $newPtr++;
   }
   else
   {
        # Unchanged
        if ($isDeleting || $isAdding)
        {
            printLine($colIndex);
        }
        $isDeleting = 0;
        $isAdding = 0;

        /([a-fA-F0-9]+)([^a-fA-F0-9]+)([a-fA-F0-9]+)/;
        $oldByte=formatByte(, 0);
        $oldChar=toPrintableChar(, 0);
        $newByte=formatByte(, 0);
        $newChar=toPrintableChar(, 0);
        $oldPtr++;
        $newPtr++;
   }

   # Append the bytes to the old and new buffers
    $oldLineBuffer .= $oldByte;
    $oldCharBuffer .= $oldChar;
    $newLineBuffer .= $newByte;
    $newCharBuffer .= $newChar;
    $colIndex++;
    if ($colIndex == $maxCols)
    {
        printLine();
    }
}

printLine($colIndex);    # Possible remaining line


#================================================================
# subroutines
#================================================================

#  a string representing a data byte
#  0=unchanged, 1=added, 2=deleted, 3=changed
# return the formatted string (color/maker)
sub formatByte
{
    my ($byte, $type) = @_;
    my $res;
    if (!$noMarker)
    {
        if    ($type == 0  || $byte eq BLANK)     { $res = "  " . $byte; }    # Unchanged or blank
        elsif ($type == 1)     { $res = " +" . $byte; }    # Added
        elsif ($type == 2)     { $res = " -" . $byte; }    # Deleted
        elsif ($type == 3)     { $res = " *" . $byte; }    # Changed
        else  { die "Error"; }
    } else
    {
        $res = " " . $byte;
    }
    $res = colorize($res, $type);
    return $res;
}

#  a string
#  0=unchanged, 1=added, 2=deleted, 3=changed
# return the colorized string according to 
sub colorize
{
    my ($res, $type) = @_;
    if (!$noColor)
    {
        if ($type == 0)     {  }        # Unchanged
        elsif ($type == 1)     { $res = colored($res, 'bright_green'); }  # Added
        elsif ($type == 2)     { $res = colored($res, 'bright_red'); }    # Deleted
        elsif ($type == 3)     { $res = colored($res, 'bright_cyan'); }   # Changed
        else   { die "Error"; }
    }
    return $res;
}

# Print the buffered line
sub printLine
{
    if (length($oldLineBuffer) <=10)
    {
        return;        # No data to display
    }

    if (!$isUnchangedLine)
    {
        # Colorize and add a marker to the address of each line if some bytes are changed/added/deleted
        my $prefix = substr($oldLineBuffer, 0, 6) . ($noMarker ? " " : "*");
        $prefix = colored($prefix, 'magenta') unless $noColor;
        $oldLineBuffer =~ s/^......./$prefix/;
        $prefix = substr($newLineBuffer, 0, 6) . ($noMarker ? " " : "*");
        $prefix = colored($prefix, 'magenta') unless $noColor;
        $newLineBuffer =~ s/^......./$prefix/;
    }

    my $oldCBuf = $noAscii ? "" : $oldCharBuffer;
    my $newCBuf = $noAscii ? "" : $newCharBuffer;
    my $spacerChars = $noAscii ? "" : (" " x ($maxCols - $colIndex));
    my $spacerData = ($noMarker ? "   " : "    ") x ($maxCols - $colIndex);
    if (!($noCommon && $isUnchangedLine))
    {
        print "${oldLineBuffer}${spacerData} ${oldCBuf}${spacerChars}  ${newLineBuffer}${spacerData} ${newCBuf}\n";
    }

    # Reset buffers and counters
    $oldLineBuffer = sprintf("0x%04X ", $oldPtr);
    $newLineBuffer = sprintf("0x%04X ", $newPtr);
    $oldCharBuffer = "";
    $newCharBuffer = "";
    $colIndex = 0;
    $isUnchangedLine = 1;
}

# Convert a hex byte string into a printable char, or '.'.
#  = hex str such as A0
#  0=unchanged, 1=added, 2=deleted, 3=changed
# Return the corresponding char, possibly colorized
sub toPrintableChar
{
    my ($hexByte, $type) = @_;
    my $char = chr(hex($hexByte));
    $char = ($char =~ /[[:print:]]/) ? $char : ".";
    return colorize($char, $type);
}

# Convert file  into a text file with 1 hex byte per line.
# =input file name
# Return the output file name
sub createHexListFile
{
    my ($inFileName) = @_;
    my $buffer;
    my $in_fh;
    open($in_fh,  "<:raw", $inFileName) || die "q4312078q: cannot open $inFileName for reading: $!";
    my ($out_fh, $filename) = tempfile();

    while (my $nbReadBytes = read($in_fh, $buffer, BUFSIZE))
    {
        my @hexBytes = unpack("H2" x $nbReadBytes, $buffer);
        foreach my $hexByte (@hexBytes)
        {
            print $out_fh "$hexByte\n" || die "couldn't write to $out_fh: $!";
        }
    }
    close($in_fh);
    return $filename;
}

#13 楼

您可以使用vim-gui-common软件包中包含的gvimdiff工具

sudo apt-get install vim-gui-common

然后您可以使用以下命令比较两个十六进制文件：

ubuntu> gvimdiff <hex-file1> <hex-file2>

#14 楼

我写了一个简单的脚本来比较二进制文件。它将打印第一个不同的块（40字节）和偏移量：

https://gist.github.com/guyskk/98621a9785bd88cf2b4e804978950122

$ bindiff file1 file2
8880> 442408E868330300488D05825337004889042448C744240802000000E84F330300E88A2A0300488B
                      ^^^^^^^^^ ^^
      442408E868330300E59388E59388004889042448C744240802000000E84F330300E88A2A0300488B

#15 楼

https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html

BinDiff是一个很棒的UI工具，用于比较最近开源的二进制文件。

#16 楼

Linux（以及其他所有产品）上的开源产品是Radare，它为此提供了明确的radiff2。


每个不同的字节


不过这太疯狂了。因为按照要求，如果在文件的第一个字节插入一个字节，则会发现随后的每个字节都是不同的，因此差异将重复整个文件，实际差异为一个字节。

radiff -O稍微实用一点。 -O适用于“”使用所有字节而不是固定操作码字节进行代码差异“”

0x000000a4 0c01 => 3802 0x000000a4
0x000000a8 1401 => 3802 0x000000a8
0x000000ac 06 => 05 0x000000ac
0x000000b4 02 => 01 0x000000b4
0x000000b8 4c05 => 0020 0x000000b8
0x000000bc 4c95 => 00a0 0x000000bc
0x000000c0 4c95 => 00a0 0x000000c0

像IDA Pro一样，Radare是二进制分析的主要工具，还可以使用-d显示差异增量，或使用-D显示反汇编后的字节而不是十六进制。