3.11 Comparing bytes

You can compare data using the 'c' command that accepts different input formats and compares the input against the bytes in the current seek.

> c?
Usage: c[?|d|x|f] [argument]
 c  [string]   - compares a plain with escaped chars string
 cc [offset]   - code bindiff current block against offset
 cd [offset]   - compare a doubleword from a math expression
 cx [hexpair]  - compare hexpair string
 cf [file]     - compare contents of file at current seek

An example of memory comparision:

[0x08048000]> p8 4
7f 45 4c 46 

[0x08048000]> cx 7f 45 90 46
Compare 3/4 equal bytes
0x00000002 (byte=03)   90 ' '  ->  4c 'L'

This is also useful for comparing memory pointers at certain offsets. The variable cfg.bigendian is used to change the value in the proper way to be compared against the contents at the '0x4A13B8C0' offset:

[0x4A13B8C0]> cd 0x39e8e089 @ 0x4A13B8C0
Compare 4/4 equal bytes

[0x4A13B8C0]> p8 4
89 e0 e8 39 

It takes 4 bytes from the current seek (0x4A13B8C0) and compares them to the number given. This number can be an math expressions using flag names and so:

[0x08048000]> cx 7f 45 90 46
Compare 3/4 equal bytes
0x00000002 (byte=03)   90 ' '  ->  4c 'L'

We can use the compare command against a file previously dumped to disk from the contents of the current block.

$ radare /bin/true
[0x08049A80]> s 0
[0x08048000]> cf /bin/true
Compare 512/512 equal bytes