Awesome GitHub RepositoriesBinary Diffing

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

fq 是一个命令行二进制数据处理器，用于将原始字节流和位级数据解码、转换和分析为结构化格式。它作为一个函数式二进制查询引擎，允许对二进制结构进行过滤和映射，同时也是一个转换器，将复杂的二进制 Blob 和专有文件格式转换为标准的 JSON、YAML 或 XML。 该工具作为低级位操作器，能够对原始文件执行位级切片、位运算和加密哈希。它还作为一个网络协议分析器，能够重组碎片化的 TCP 流并解密 TLS 流量以进行应用级检查。 该项目涵盖了二进制解析和数据转换方面的广泛功能，包括对自定义解码器定义的支持，以及对 Mach-O、ASN1 BER 和 Avro OCF 等多种专业格式的支持。它提供了用于二进制树搜索、结构化文本解码以及二进制与文本格式之间双向序列化的工具。 用户可以通过命令行界面和用于实时查询测试的交互式 REPL 与系统进行交互。

AndFix is a binary patching framework and update system for Android applications. It provides tools for generating binary diffs and applying runtime method replacements to fix bugs without requiring a full application update. The system utilizes a binary diff generator to isolate minimal code changes between package versions. It supports the consolidation of multiple incremental patches into a single update file and employs native hooks to replace specific method implementations in memory during the application initialization phase. The framework covers capabilities for binary patch generati

A fast and clever hex editor for macOS

HexFiend is a native macOS hex editor designed for opening and editing binary files of any size without loading them entirely into memory. It uses a 64-bit addressable data model with memory-mapped file access, enabling navigation of multi-gigabyte files while maintaining byte-level undo for insert and delete operations. The editor distinguishes itself through a diff algorithm for binary file comparison that accounts for insertions and deletions, and a template-based structure parsing system that uses user-defined scripts to visualize binary file layouts. It also includes a typed data interpr

Bloaty 是一个二进制大小分析器和可执行格式分析器，将二进制文件的每个字节归因于特定的符号或编译单元。它作为一个编译单元分析器和 C++ 符号反混淆器，将二进制大小映射回源文件，并将混淆后的名称转换为人类可读的格式。 该项目作为二进制差异工具脱颖而出，能够比较二进制文件的两个版本，以隔离导致大小回归的特定符号或部分。它提供专门的支持，通过使用构建标识符将符号与外部调试文件关联，从而恢复剥离二进制文件中的符号。 该工具为 ELF、Mach-O、PE/COFF 和 WebAssembly 格式提供全面的二进制分析。其功能包括分析链接器部分、内存段和静态库归档，以及识别内联函数消耗的空间。用户可以进一步使用正则表达式过滤隔离数据，并以 CSV 或 TSV 格式导出分析结果。

Diaphora 是一款二进制差异分析工具和相似度引擎，旨在比较编译后的二进制文件并识别已更改或匹配的代码段。它作为逆向工程插件运行，通过汇编分析和图论映射函数之间的关系并检测编译单元。 该项目专注于漏洞补丁分析，允许用户通过比较二进制文件的不同版本来检测安全修复。它在二进制文件之间同步分析元数据（如符号名称和注释），并通过比较反编译的伪代码来生成补丁。 该引擎利用控制流图和启发式匹配来计算函数之间的相似度比率。其更广泛的功能包括映射调用图、识别目标文件边界，以及通过关系数据库管理分析状态，以促进大规模的交叉引用。

PE-bear is a graphical portable executable analysis tool designed for inspecting, disassembling, and modifying the structure of Windows PE binary files. It functions as a static analysis framework used to identify malicious patterns and reverse engineer program logic. The project provides a binary diffing tool to identify structural and content differences between two executable files. It also includes a section editor for modifying binary layouts by adding or altering sections and imports. The tool covers a range of binary analysis capabilities, including machine code disassembly, file layo