# Is there any tool to quantitatively evaluate the difference of binary?

I know some binary diff tool like VBinDiff and others.

Currently I have a large number of binary, around 500.

So I am looking for a binary tool to quantitatively evaluate the difference of binaries..

Like evaluate the difference of binary 10 and binary 100 is 56%. Difference of binary 50 and binary 200 is 78%.

Is there any tool like this?

Thank you!

You may want to give a try to ssdeep:

ssdeep is a program for computing context triggered piecewise hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.

• Hi jvoisin,Thank you for your answer! So tools like VBinDiff can highlight all the different bytes in hex, and I am thinking to find a tool to sum up all the highlighted bytes, thus can get the number of different bytes... Do you know certain tools like this..? Commented Jan 21, 2014 at 18:03
• Hi jvoisin, I finally find out how to do it, I write it down. Commented Jan 21, 2014 at 18:34

Here is my solution.

1. I use `radiff2` to find out all the difference between binaries.

``````radiff2 binary1 binary2
``````
2. Then `xxd` to convert binary into hex

``````xxd -p  final
``````
3. After that, `wc` to figure out the number of hex in one binary

``````wc -c outputhex
wc -l newlineneedtodelete
``````
4. Now I have the difference between two binaries and the total number of hex in each binary. A simple divide could figure out the percentage of difference as I want.

Given that you're looking to compare ~500 binaries to each other, what you really want is VxClass.

Unfortunately, Zynamics/Google is no longer selling VxClass. If anyone knows of a way to buy it or download it though, feel free to share the information here.

• BTW, you probably could reimplement VxClass's functionality via BinDiff/DarunGrim/etc. and custom code, but it would be non-trivial. Commented Jan 22, 2014 at 1:15
• zynamics@google employee here: unfortunately there is no way to buy vxclass and I don't think that will change in the future. Commented Jan 22, 2014 at 14:31

This is probably a bit further outside the normal reverse engineer's toolchest, but still a possibility. Courgette is the codename of the update mechanism behind Chromium and thus Chrome. Quote:

Courgette transforms the program into the primitive assembly language and does the diffing at the assembly level:

``````server:
asm_old = disassemble(original)
asm_new = disassemble(update)