7

I know some binary diff tool like VBinDiff and others.

Currently I have a large number of binary, around 500.

So I am looking for a binary tool to quantitatively evaluate the difference of binaries..

Like evaluate the difference of binary 10 and binary 100 is 56%. Difference of binary 50 and binary 200 is 78%.

Is there any tool like this?

Thank you!

6

You may want to give a try to ssdeep:

ssdeep is a program for computing context triggered piecewise hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.

  • Hi jvoisin,Thank you for your answer! So tools like VBinDiff can highlight all the different bytes in hex, and I am thinking to find a tool to sum up all the highlighted bytes, thus can get the number of different bytes... Do you know certain tools like this..? – lllllllllllll Jan 21 '14 at 18:03
  • Hi jvoisin, I finally find out how to do it, I write it down. – lllllllllllll Jan 21 '14 at 18:34
3

Here is my solution.

  1. I use radiff2 to find out all the difference between binaries.

    radiff2 binary1 binary2
    
  2. Then xxd to convert binary into hex

    xxd -p  final
    
  3. After that, wc to figure out the number of hex in one binary

    wc -c outputhex
    wc -l newlineneedtodelete
    
  4. Now I have the difference between two binaries and the total number of hex in each binary. A simple divide could figure out the percentage of difference as I want.

2

Given that you're looking to compare ~500 binaries to each other, what you really want is VxClass.

Unfortunately, Zynamics/Google is no longer selling VxClass. If anyone knows of a way to buy it or download it though, feel free to share the information here.

  • BTW, you probably could reimplement VxClass's functionality via BinDiff/DarunGrim/etc. and custom code, but it would be non-trivial. – Jason Geffner Jan 22 '14 at 1:15
  • zynamics@google employee here: unfortunately there is no way to buy vxclass and I don't think that will change in the future. – newgre Jan 22 '14 at 14:31
2

This is probably a bit further outside the normal reverse engineer's toolchest, but still a possibility. Courgette is the codename of the update mechanism behind Chromium and thus Chrome. Quote:

Courgette transforms the program into the primitive assembly language and does the diffing at the assembly level:

server:
    asm_old = disassemble(original)
    asm_new = disassemble(update)
    asm_new_adjusted = adjust(asm_new, asm_old)
    asm_diff = bsdiff(asm_old, asm_new_adjusted)
    transmit asm_diff

client:
    receive asm_diff
    asm_old = disassemble(original)
    asm_new_adjusted = bspatch(asm_old, asm_diff)
    update = assemble(asm_new_adjusted)

Of course this is limited by the number of CPU architectures. You didn't state your requirements (unless it was written with invisible pixels ;))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.