Ytdyklly

As ~quack pointed out:

 % xxd b1 > b1.hex

 % xxd b2 > b2.hex

And then

 % diff b1.hex b2.hex

or

 % vimdiff b1.hex b2.hex

Try diff in the following combination of zsh/bash process substitution and colordiff in CLI:

diff -y <(xxd foo1.bin) <(xxd foo2.bin) | colordiff

Where:

• 
  -y shows you differences side-by-side (optional)


• 
  xxd is CLI tool to create a hexdump output of the binary file


• 
  colordiff will colorize diff output (install via: sudo apt-get install colordiff)


• add -W200 to diff for wider output (of 200 characters per line)

Hints:

• if files are too big, add limit (e.g. -l1000) for each xxd
  

Sample output:

There's a tool called DHEX which may do the job, and there's another tool called VBinDiff.

For a strictly command-line approach, try JDIFF.

Method that works for byte addition / deletion

diff <(od -An -tx1 -w1 -v file1) 

     <(od -An -tx1 -w1 -v file2)

Generate a test case with a single removal of byte 64:

for i in `seq 128`; do printf "%02x" "$i"; done | xxd -r -p > file1

for i in `seq 128`; do if [ "$i" -ne 64 ]; then printf "%02x" $i; fi; done | xxd -r -p > file2

Output:

64d63

<  40

If you also want to see the ASCII version of the character:

bdiff() (

  f() (

    od -An -tx1c -w1 -v "$1" | paste -d '' - -

  )

  diff <(f "$1") <(f "$2")

)



bdiff file1 file2

Output:

64d63

<   40   @

Tested on Ubuntu 16.04.

I prefer od over xxd because:

• it is POSIX, xxd is not (comes with Vim)


• has the -An to remove the address column without awk.

Command explanation:

• 
  -An removes the address column. This is important otherwise all lines would differ after a byte addition / removal.


• 
  -w1 puts one byte per line, so that diff can consume it. It is crucial to have one byte per line, or else every line after a deletion would become out of phase and differ. Unfortunately, this is not POSIX, but present in GNU.


• 
  -tx1 is the representation you want, change to any possible value, as long as you keep 1 byte per line.


• 
  -v prevents asterisk repetition abbreviation * which might interfere with the diff


• 
  paste -d '' - - joins every two lines. We need it because the hex and ASCII go into separate adjacent lines. Taken from: https://stackoverflow.com/questions/8987257/concatenating-every-other-line-with-the-next
  


• we use parenthesis () to define bdiff instead of {} to limit the scope of the inner function f, see also: https://stackoverflow.com/questions/8426077/how-to-define-a-function-inside-another-function-in-bash
  

See also:

• https://unix.stackexchange.com/questions/59849/diff-binary-files-of-different-sizes


• https://stackoverflow.com/questions/8385618/using-cmp-to-compare-two-binaries

Short answer

vimdiff <(xxd -c1 -p first.bin) <(xxd -c1 -p second.bin)

When using hexdumps and text diff to compare binary files, especially xxd, the additions and removals of bytes become shifts in addressing which might make it difficult to see. This method tells xxd to not output addresses, and to output only one byte per line, which in turn shows exactly which bytes were changed, added, or removed. You can find the addresses later by searching for the interesting sequences of bytes in a more "normal" hexdump (output of xxd first.bin).

I'd recommend hexdump for dumping binary files to textual format and kdiff3 for diff viewing.

hexdump myfile1.bin > myfile1.hex

hexdump myfile2.bin > myfile2.hex

kdiff3 myfile1.hex myfile2.hex

The hexdiff is a program designed to do exactly what you're looking for.

Usage:

hexdiff file1 file2

It displays the hex (and 7-bit ASCII) of the two files one above the other, with any differences highlighted. Look at man hexdiff for the commands to move around in the file, and a simple q will quit.

It may not strictly answer the question, but I use this for diffing binaries:

gvim -d <(xxd -c 1 ~/file1.bin | awk '{print $2, $3}') <(xxd -c 1 ~/file2.bin | awk '{print $2, $3}')

It prints both files out as hex and ASCII values, one byte per line, and then uses Vim's diff facility to render them visually.

dhex http://www.dettus.net/dhex/

DHEX is a more than just another hex editor: It includes a diff mode, which can be used to easily and conveniently compare two binary files. Since it is based on ncurses and is themeable, it can run on any number of systems and scenarios. With its utilization of search logs, it is possible to track changes in different iterations of files easily.

You can use gvimdiff tool that is included in vim-gui-common package

sudo apt-get update

sudo apt-get install vim-gui-common

Then you can compare 2 hex files using following commands :

ubuntu> gvimdiff <hex-file1> <hex-file2>

Tha's all. Hope tha help !

https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html

BinDiff is a great UI tool for comparing binary files that has been open sourced recently.

The go to open source product on Linux (and everything else) is Radare which provides radiff2 explicitly for this purpose. I voted to close this because myself and others have the same question, in the question you ask

for every different byte

That's insane though. Because as asked, if you insert one byte at the first byte in the file, you'd find every subsequent byte was different and so the diff would repeat the whole file, for an actual difference of one byte.

Slightly more practical is radiff -O. The -O is for ""Do code diffing with all bytes instead of just the fixed opcode bytes""

0x000000a4 0c01 => 3802 0x000000a4

0x000000a8 1401 => 3802 0x000000a8

0x000000ac 06 => 05 0x000000ac

0x000000b4 02 => 01 0x000000b4

0x000000b8 4c05 => 0020 0x000000b8

0x000000bc 4c95 => 00a0 0x000000bc

0x000000c0 4c95 => 00a0 0x000000c0

Like IDA Pro, Radare is a tool primary for binary analysis, you can also show delta diffing with -d, or display the disassembled bytes instead of hex with -D.

If you're asking these kind of questions though, check out

• Stack Overflow for the software questions,


• Reverse Engineering Stack Exchange


• Radare's radiff2 for binary diffing