• No results found

File Comparison Tools

In document Hack Proofing Your Network pdf (Page 161-163)

The first step in diffing files is to determine the differences between two files. To do this, we’ll need some file comparison tools. Let’s examine a couple of them.

Figure 5.2

The same game after the saved game was manually edited. Note the

Fc

The first tool we used was fc, which has been included in DOS (and later, Windows) for many years. If you’ve got a Windows 9xmachine, it can be found in c:\windows\command, or whatever your Windows directory is if it’s not c:\windows. By default, c:\windows\command is in the path, so you can just type fc when you need it. These are the options available in fc:

C:\windows\COMMAND>fc /?

Compares two files or sets of files and displays the differences between them.

FC [/A] [/C] [/L] [/LBn] [/N] [/T] [/W] [/nnnn] [drive1:][path1]filename1 [drive2:][path2]filename2

FC /B [drive1:][path1]filename1 [drive2:][path2]filename2

/A Displays only first and last lines for each set of differences. /B Performs a binary comparison.

/C Disregards the case of letters. /L Compares files as ASCII text.

/LBn Sets the maximum consecutive mismatches to the specified number of lines.

/N Displays the line numbers on an ASCII comparison. /T Does not expand tabs to spaces.

/W Compresses white space (tabs and spaces) for comparison.

/nnnn Specifies the number of consecutive lines that must match after a mismatch.

There’s the /b switch that was mentioned. If you’re comparing binary files without that, the comparison will stop if it hits an end-of-file character or a zero byte. With this particular command, the command-line switches aren’t case sensitive, as evidenced by the fact that the help shows /B, while we’ve demonstrated that /b works fine. There are a number of text options that you can explore on your own. As we’ll see next, there’s a much better utility for comparing text files, but if you find yourself working on someone else’s

machine that doesn’t have it, fc is almost always there (on Windows machines) and it will do in a pinch.

The rough UNIX equivalent of fc /b is the command cmp –l (lowercase L).

Diff

The diff command originates on the UNIX platform. It has limited binary com- parison capabilities, but is useful primarily for text file comparison. In fact, its text comparison features are exceptional. The complete list of capabilities for diff is much too large to include here; check the UNIX man pages or equivalent for the full list.

To give you an idea of what diff can do if you’ve not heard of it before, we’ll list a few of the most commonly used features. With a simple-minded text comparison tool, if you were to take a copy of a file and insert a line somewhere in the middle, it would probably flag everything after the added lines as a mismatch. Diff is smart enough to understand that a line has been added or removed.

[root@rh /tmp]$ diff decode.c decode2.c 14a15

> #include <newinclude.h>

[root@rh /tmp]$ diff decode2.c decode.c 15d14

< #include <newinclude.h>

The two files in question (decode.c and decode2.c) are identical, except for a line that has been added to decode2.c that reads “#include <newinclude.h>.” In the first example, decode.c is the first argument to the diff command, and decode2.c is the second. The output indicates that a line has been added in the second file, after line 14 and going through line 15, and then lists the con- tents. If you reverse the arguments, the difference becomes a delete instead of an add (note the “a” in the first output and the “d” in the second).

This output is called “diff output” or a “diff file,” and has the property that if you have the diff file, and the original file being compared, you can use the diff file to produce the second file. For this reason, when someone wants to send someone else a small change to a text file, especially for source code, a diff file is often sent. When someone posts a vulnerability to a mailing list regarding a piece of open-source software, it’s not uncommon for the poster to include diff output that will patch the source to fix the output. The program that patches files by using diff output is called patch.

The diff program, depending on which version you have, can also produce other scripts as its difference output, such as for edor RCS (Revision Control System). It can accept regular expressions for some of its processing, under- stands C program files to a degree, and can produce as part of its output which function the changes appear in.

A Windows version of diff (as well as many other UNIX programs) is avail- able from the Cygwin project. The Cygwin project is a porting project that is intended to bring a number of the GNU (Gnu’s Not UNIX, yes it’s a recursive acronym) and other UNIX-based tools to the Windows platform. All GNU soft- ware is covered under some form of the GNU Public License (GPL), making the tools free. Their work (including a package containing the Windows version of diff) can be found at:

http://sourceware.cygnus.com/cygwin

Microsoft also includes a utility called Windiff in the Windows NT and Windows 98 resource kits. It’s a graphical version of a diff style utility that dis- plays changes in different colors, and has a graph representation of where things have been inserted or deleted.

In document Hack Proofing Your Network pdf (Page 161-163)