0

I have a task where I need to proof that one binary file contains another binary file. "No problem", I thought, "that's what a diff-tool is there for". Unfortunately it didn't give me the result I expected. Instead of telling me that 100% of the original bytes exist in the larger file as one block, it showed thousands of single bytes that are identical and other thousands of bytes which are different.

Which tool would allow me to proof visually that a smaller binary file is 100% contained in a larger binary file? It should

  • run on Windows 10
  • be gratis
  • have a built-in hex-viewer which shows the values of both files side by side so that people could compare the files themselves if they like. For optimal results, one of the columns probably requires shifting.

I have tried

  • WinMerge as a diff tool
  • 010 Editor worked with some custom comparison setting, especially the "Quick Match Length" needs to be increased. Unfortunately that tool is commercial.
Improve this question
2
  • This is a case where you should consider that actually writing a small program for this purpose might be quicker than looking for a program that does it.
    – kutschkem
    Jun 29, 2021 at 13:45
  • @kutschkem: indeed, it wouldn't be far-fetched. And maybe I'll do it. It's just ... I have written so many special purpose tools already. It starts making me tired and often it's just boring. Maybe I need to learn a new programming language so it's more fun.
    – Thomas Weller
    Jun 29, 2021 at 14:20

1 Answer 1

Reset to default
0

This is a one-liner in many programming languages. For example, in Python, supposing the larger file is named "haystack" and the file you want to find inside it is named "needle":

$ python3 -c 'print("Present" if open("needle", "rb").read() in open("haystack", "rb").read() else "Not present")'

To see the actual bytes, any hex editor or hex-dumping program (such as hexdump, likely available on Windows via Cygwin) will do. Just open "needle" with it. When "needle" is in "haystack", then the corresponding bytes of "haystack" are necessarily equal. It's not difficult to extend this program to show some bytes before or after the match if you want to.

Improve this answer
2
  • Sorry, I need the hex dumps of the two files in order to be able explain it to someone who has no clue about programming. It is not sufficient to say "it's identical anyway, so let's look at one file only." They need to see it with their own eyes in two files. To them print("Present") is no different to the code you wrote.
    – Thomas Weller
    Jul 1, 2021 at 5:40
  • @ThomasWeller Try print(open("haystack", "rb").read().index(open("needle", "rb").read())). This will show you the byte position at which "needle" starts in "haystack". You can then hexdump the files and scroll the view of "haystack" to the given position.
    – Kodiologist
    Jul 1, 2021 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.