Notes/EByte

EByte Adds a Diff That Shows Which Fields a Firmware Update Changed

EByte 0.5.0 adds ebyte diff. It decodes two files through the same schema and lists every field that differs, in schema order, with its offset and length in each file. Integers show their old and new values, sizes and checksums the schema derives are marked as derived, and byte fields show only where they first differ, never their contents. It exits 0 when the files are the same and 5 when they differ, so a script can tell the two cases apart. A new fuzz target checks the main promise on arbitrary pairs of files: no changes exactly when the bytes are identical.

The case study compared two packet captures of a small network sensor, before and after a firmware update. With the generic pcap schema, every packet just differed from byte 17, the IP length. With the packet described field by field, the diff showed the cause: the firmware number went from 258 to 259, and every packet gained a battery reading. The lengths and checksums that follow from that were marked as noise you can filter out. The post is plain about the limit: packets are compared by position, so a dropped packet would shift everything after it. The schema library gained a pcap schema.

An independent review found nothing blocking. Its main finding was that Ctrl-C during a diff read from standard input reported a read failure instead of a cancellation; that and four small items were fixed before the release. Binaries for Linux, macOS and Windows are on the latest release, open source under Apache 2.0.