/usr/share/doc/radare-doc/html/Section3.11.html is in radare-doc 1:1.5.2-4.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=US-ASCII">
<title>Comparing bytes</title>
<link rel="previous" href="Section3.10.html">
<link rel="ToC" href="contents.html">
<link rel="next" href="Section3.12.html">
</head>
<body>
<h1><a name="cmp"></a>3.11 Comparing bytes</h1>
<p>
You can compare data using the 'c' command that accepts different input formats and compares the input against the bytes in the current seek.
</p>
<pre><code>> c?
Usage: c[?|d|x|f] [argument]
c [string] - compares a plain with escaped chars string
cc [offset] - code bindiff current block against offset
cd [offset] - compare a doubleword from a math expression
cx [hexpair] - compare hexpair string
cf [file] - compare contents of file at current seek
</code></pre>
<p>
An example of memory comparision:
</p>
<pre><code>[0x08048000]> p8 4
7f 45 4c 46
[0x08048000]> cx 7f 45 90 46
Compare 3/4 equal bytes
0x00000002 (byte=03) 90 ' ' -> 4c 'L'
[0x08048000]>
</code></pre>
<p>
This is also useful for comparing memory pointers at certain offsets. The variable cfg.bigendian is used to change the value in the proper way to be compared against the contents at the '0x4A13B8C0' offset:
</p>
<pre><code>[0x4A13B8C0]> cd 0x39e8e089 @ 0x4A13B8C0
Compare 4/4 equal bytes
[0x4A13B8C0]> p8 4
89 e0 e8 39
</code></pre>
<p>
It takes 4 bytes from the current seek (0x4A13B8C0) and compares them to the number given. This number can be an math expressions using flag names and so:
</p>
<pre><code>[0x08048000]> cx 7f 45 90 46
Compare 3/4 equal bytes
0x00000002 (byte=03) 90 ' ' -> 4c 'L'
[0x08048000]>
</code></pre>
<p>
We can use the compare command against a file previously dumped to disk from the contents of the current block.
</p>
<pre><code>$ radare /bin/true
[0x08049A80]> s 0
[0x08048000]> cf /bin/true
Compare 512/512 equal bytes
</code></pre>
<!-- version IDs:
$Id: radare.but 2009-04-25 pancake $
-->
</body>
</html>
|