/diff

description: Binary diffing — compare two binaries for patch analysis
allowed-tools: Bash, Read, Write, Glob, Grep
argument-hint: <path-to-binary1> <path-to-binary2>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Binary Diffing

Parse `$ARGUMENTS` for two binary paths (space-separated).

Step 1 — Hash Both Binaries

node "${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js" hash "<binary1>"
node "${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js" hash "<binary2>"

If hashes are identical, report "Binaries are identical" and exit.

Step 2 — File Size Comparison

Compare file sizes and report delta.

Step 3 — Byte-Level Diff

radiff2 <binary1> <binary2>

This shows byte-level differences between the two files.

Step 4 — Section Comparison

r2 -qc 'iS' <binary1>
r2 -qc 'iS' <binary2>

Compare section names, sizes, entropy, and virtual addresses.

Step 5 — Import/Export Diff

r2 -qc 'ii' <binary1> > imports1.txt
r2 -qc 'ii' <binary2> > imports2.txt
diff imports1.txt imports2.txt

Compare new imports, removed imports, and changed ordinals.

Step 6 — Function-Level Diff

r2 -qc 'aaa; afl' <binary1>
r2 -qc 'aaa; afl' <binary2>

Compare function lists: new functions, removed functions, changed sizes.

Step 7 — ssdeep Similarity

ssdeep <binary1> <binary2>

Report similarity percentage.

Step 8 — Report

Save report to `diff-<name1>-vs-<name2>.md` with sections:

• File Identification (both binaries)
• Size Delta
• Section Differences
• Import/Export Changes
• Function Changes
• ssdeep Similarity Score
• Security-Relevant Changes (if any)
• Recommendations