二进制差量工具 - bsdiff
二进制差量工具工具 (另存為zip解開)
http://hi.csdn.net/attachment/201107/29/0_1311908844Ghn2.gif
官方地址:
http://www.daemonology.net/bsdiff/
算法描述在这位牛博的暂未发表论文里面 Naive differences of executable code
Colin Percival, Naive differences of executable code, http://www.daemonology.net/bsdiff/, 2003.
更详细的原理描述在这位牛博的牛津大学博士论文里面
Doctoral Thesis
在gentoo下作的测试：
1) emerge bsdiff
gentoobox temp # emerge bsdiff * IMPORTANT: 5 news items need reading for repository 'gentoo'. * Use eselect news to read news items. * Last emerge --sync was 113d 9h 12m 38s ago. Calculating dependencies... done! >>> Verifying ebuild manifests >>> Emerging (1 of 1) dev-util/bsdiff-4.3-r3 * bsdiff-4.3.tar.gz SHA256 SHA512 WHIRLPOOL size ;-) ... [ ok ] >>> Unpacking source... >>> Unpacking bsdiff-4.3.tar.gz to /var/tmp/portage/dev-util/bsdiff-4.3-r3/work >>> Source unpacked in /var/tmp/portage/dev-util/bsdiff-4.3-r3/work >>> Preparing source in /var/tmp/portage/dev-util/bsdiff-4.3-r3/work/bsdiff-4.3 ... >>> Source prepared. >>> Configuring source in /var/tmp/portage/dev-util/bsdiff-4.3-r3/work/bsdiff-4.3 ... >>> Source configured. >>> Compiling source in /var/tmp/portage/dev-util/bsdiff-4.3-r3/work/bsdiff-4.3 ... i686-pc-linux-gnu-gcc -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -O2 -march=i686 -pipe -Wl,-O1 -Wl,--as-needed -o bsdiff bsdiff.c -lbz2 i686-pc-linux-gnu-gcc -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -O2 -march=i686 -pipe -Wl,-O1 -Wl,--as-needed -o bspatch bspatch.c -lbz2 >>> Source compiled. >>> Test phase [not enabled]: dev-util/bsdiff-4.3-r3 >>> Install bsdiff-4.3-r3 into /var/tmp/portage/dev-util/bsdiff-4.3-r3/image/ category dev-util >>> Completed installing bsdiff-4.3-r3 into /var/tmp/portage/dev-util/bsdiff-4.3-r3/image/ strip: i686-pc-linux-gnu-strip --strip-unneeded -R .comment -R .GCC.command.line -R .note.gnu.gold-version usr/bin/bsdiff usr/bin/bspatch ecompressdir: bzip2 -9 /usr/share/man >>> Installing (1 of 1) dev-util/bsdiff-4.3-r3 >>> Recording dev-util/bsdiff in "world" favorites file... >>> Auto-cleaning packages... >>> No outdated packages were found on your system. * GNU info directory index is up-to-date. * IMPORTANT: 5 news items need reading for repository 'gentoo'. * Use eselect news to read news items.
大家如果在windows上测试的话，可以去他的官方网站下载一个 windows port。也可以使用我在文章开始出给出的gif连接（另存为zip）。
2) 随便找2个二进制文件
gentoobox temp # ls -alh * -rw-r--r-- 1 root root 1.2M Aug 2 02:13 kernel32.dll -rw-r--r-- 1 root root 1.7M Aug 29 02:16 ntdll.dll
gentoobox temp # md5sum kernel32.dll ntdll.dll d8973e71f1b35cd3f3dea7c12d49d0f0 kernel32.dll caaac014c5c56a69f710b5f1b836de22 ntdll.dll
3) 做减法得到差量
基本语法是 bsdiff old new delta
gentoobox temp # bsdiff kernel32.dll ntdll.dll n-k.patch gentoobox temp # ls -alh * -rw-r--r-- 1 root root 1.2M Aug 2 02:13 kernel32.dll -rw-r--r-- 1 root root 820K Dec 31 11:52 n-k.patch -rw-r--r-- 1 root root 1.7M Aug 29 02:16 ntdll.dll
4) 做加法得到新文件
基本语法是 bspatch old new delta
gentoobox temp # bspatch kernel32.dll new_ntdll.dll n-k.patch gentoobox temp # md5sum * d8973e71f1b35cd3f3dea7c12d49d0f0 kernel32.dll 4e429b33c0383984d1872cdda9f75342 n-k.patch caaac014c5c56a69f710b5f1b836de22 new_ntdll.dll caaac014c5c56a69f710b5f1b836de22 ntdll.dll