01The premise
What the tool is for
BinDiff supports variant triage, build comparisons and the question of which static properties two files share. Both inputs stay on the analyst machine and are processed read-only. The tool changes nothing, uploads nothing and creates no binary.
The interface offers an overview without hiding the individual values. Similarity can be traced down to chunks, strings, sections and metadata declarations. The report supplies leads for the next investigation rather than a finished verdict.
02Inside the system
Seven perspectives on two binary files
Byte diff
Content-defined chunking, a Jaccard view and a histogram keep shared regions visible even when offsets move.
CHUNKS / JACCARDFuzzy hashes
MinHash sketches and a CTPH-like digest add robust similarity signals to exact byte comparison.
MINHASH / CTPHPE and ELF
Defensively bounded parsers read headers and section information without pretending to be a full disassembler.
PE / ELFEntropy
Block-level density changes become visible. High entropy remains a lead, never proof.
0–8 BITS / BYTEPatterns
Shared and file-specific byte sequences are listed with frequency and first offset.
SEQUENCES / OFFSETSStrings
Bounded ASCII and UTF-16LE strings include encoding, first offset and occurrence count.
ASCII / UTF-16LE.NET metadata
Assembly identity, target framework, references, types, methods and P/Invoke are read directly from PE metadata without loading the assembly.
METADATA ONLY03Concrete workflow
A typical use case
A team compares two versions of an internal tool. Similar byte and entropy profiles suggest proximity; the metadata view then reveals a new reference and two additional P/Invoke declarations. That creates a concrete review path without making a claim about intent or origin.
bindiff old.exe patched.exe --html comparison.html --json comparison.jsonFrom input to evidence
Read only
Two authorized files remain local and unchanged.
Analyze
Seven separate views produce measurements and evidence.
Compare
Chunks, strings, sections and declarations remain independently reviewable.
Export
Text, JSON and standalone HTML preserve the result.
Design boundaries
What BinDiff deliberately does not claim
- Not a malware scanner and not proof of common origin
- Similarity says nothing about whether a file is safe
- Printable strings can be absent, compressed or generated dynamically
- Declared .NET methods do not have to be reachable
- PE and ELF analysis remains a bounded static view
05RC facts
BinDiff · RC facts
- Release candidate
- 2.0.0-rc.1
- Interfaces
- CLI and Windows WPF
- Exports
- Text, JSON, standalone HTML
- Analyses
- Byte diff, fuzzy hash, format, entropy, patterns, strings, .NET metadata
- Quality assurance
- 52 automated tests in the RC state
- Data path
- local, read-only, no network access
BinDiff is meant to make an investigation narrower and more verifiable—not replace it with a score.