Hexcompare and Finding New Tools

Last week while teaching at Black Hat, one of my students wanted to know how I find new tools. One of the ways I do that is to subscribe to FreshPorts, a site created by Dan Langille. FreshPorts tracks additions to the FreeBSD ports tree, so when someone makes it easy for me to run a new app on FreeBSD I find out. Every week I get an email of new additions to the tree, and I take a quick look to see if any catch my interest.

For example, last week I saw a new port called devel/hexcompare. I visited the Sourceforge project page and decided to try it. Since I was using an Ubuntu desktop I tried to install the new app using apt-get, but it wasn't available yet. I could have turned to a FreeBSD system, but instead I decided Hexcompare was probably simple enough to compile by hand. It turns out the app was really simple, and I got it running quickly.

The screen shot at the top shows the differences in a binary pcap file identified by Hexcompare. Basically I edited a few bytes in a single packet pcap. You can see the changes in red.