Every update is a new binary nobody read.

Two builds compared, package to binary to function. Every tab side by side, only what changed.

Diff two versionsSee this diff
The diff · airportd · two Apple builds98% shared · changes only
PackageMembers and components added, removed or bumped. Each change opens its binary.
BinaryBehaviours side by side with the call site and its arguments.
FunctionThe body of each modified function compared as readable code.

Notes say what was meant.
Binaries say what changed.

An update replaces one compiled program with another. The release note describes the intent. The binary carries the result.

openbinary compares the two versions, package to binary to function, and shows every difference on both sides. A vendor update is approved on what changed, not on what the note promised.

Six tabs. Both sides, only what changed.

airportd, two Apple builds. Every number below is from that diff.

Behaviour11Categories with ATT&CK, each row with its sites. The new crypto is three green rows.
  • 3 crypto behaviours
  • 8 rows changed
Vulnerabilities27Findings by CWE on both sides. A new site with no auth on the path is the row to open.
  • a site with no auth on the path
  • 26 findings moved
Components1The libraries inside, by name and version. A bump is one amber row, a drop is red.
  • one version bump
Code20Functions and imports matched across both builds, so a renamed stub is one pair of rows.
  • 4 functions
  • 5 functions
  • 4 bodies changed
Structure32Segments and sections with size and entropy. Growth shows before you read a function.
  • 32 sections resized
IdentityHashes, arch, size, signatures. The facts that say whether this is even the same build.
  • both Apple-signed
  • arm64 → x86_64, arm64

Three depths. Package, binary, function. Each one zoom closer.

A changed member opens its binary. A changed function opens its body. The review sits on the diff.

01PackageTwo images or archives, member by member. Members and binaries counted on each side, each changed member opens its binary.
02BinaryEvery tab of the report side by side, A on the left, B on the right. Changes only, or everything.
03FunctionThe body of a changed function as readable code, both versions, line by line.
04ReviewThe diff lands in the team inbox with state, priority, owner and labels. Approval is on record, beside the change.

Built for. The people who sign off an update.

Security teamsApprove the vendor update on the functions that changed, not on the note.
Device makersSign off each release against the one before it, before it ships.
Red teamsStart the patch read at the modified functions, not at the entry point.
370Kbinaries analysed
48architectures decompiled
134formats unpacked
69agent tools, diff included

Questions. Binary diffing, asked plainly.

Short answers. Docs has the long ones.

Read the docs
  1. 01

    How do two versions get in?

    Upload both, pick two from the corpus, or install the GitHub App and each release asset is diffed when it is published. Each version is unpacked and read on its own, then members, binaries and functions are matched.

  2. 02

    How is this different from BinDiff or Diaphora?

    BinDiff, Diaphora and Ghidra Version Tracking diff function bodies for one analyst. openbinary adds the behaviour and package depths above that, and a team inbox around the result.

  3. 03

    Does it diff firmware images and packages?

    Yes. Two images or archives are unpacked and compared member by member, with components added, removed or bumped. A changed member opens its binary diff.

  4. 04

    Can my team review an update in it?

    Yes. Every diff lands in the team inbox with state, priority, assignee, labels, notes and an activity log.

  5. 05

    Can my agent run the diff?

    Yes. The diff is one of the agent tools. One command installs them into Claude Code, Codex, Cursor, Gemini CLI, VS Code and OpenCode.

  6. 06

    What if one side cannot be read?

    A member that cannot be read on one side is marked unsupported or encrypted there, with the reason. Anything not read from the two binaries themselves is labelled enrichment, not fact.

  7. 07

    Which plan has it?

    Binary diff is in Pro, $100 a user a month. Package diff is in Advanced, $200 a user a month.

Drop a binary.

Mach-O, ELF, PE, DEX, WASM, firmware, container and archive images. Up to 2 GB. The report is public unless you sign in.

Choose a fileSet up an agent