skills.rest
dbx0
dbx0COMMUNITY
Explore all skills by this author →
WebsiteGitHub

patch-diff-exploit

Infer vulnerability root causes from vendor patch diffs and write working PoCs.

7|4|Updated Jun 22, 2026
Search Tags:#exploit development#vulnerability research#patch diffing#bindiff#n-day#binary diff#cve reproduction
One-click install
npx skills add https://github.com/dbx0/skills --skill patch-diff-exploit-dbx0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: patch-diff-exploit
Source: https://github.com/dbx0/skills/tree/main/skills/binary-re-pwn/exploitation/patch-diff-exploit
Command: npx skills add https://github.com/dbx0/skills --skill patch-diff-exploit-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ghidriff, and includes references (resource) components.

What problem does it solve? When a vendor ships a security patch but releases no public PoC or technical details, this Skill lets you work backward from the patched and unpatched binaries to identify what bug was fixed, infer its vulnerability class, and build a proof-of-concept that triggers it on unpatched systems. ## Core Features & Use Cases - Binary Diff Workflow: Step-by-step process for obtaining before/after binaries (MSU/CAB on Windows, deb/rpm on Linux), aligning symbols, and diffing with BinDiff, Diaphora, or ghidriff. - Root Cause Inference Patterns: A lookup table mapping newly added patch code (bounds checks, locks, refcounting, ProbeForRead, zeroing) to bug classes like OOB write, race condition, UAF, integer overflow, and info leak. - PoC Templates and Verification: Concrete trigger strategies per bug class (boundary values, multi-threaded racing, spray-free-reuse) plus the rule that unpatched must crash while patched stays clean. - Use Case: After Patch Tuesday, download the KB for a Windows kernel CVE, diff ntoskrnl.exe across versions, spot a newly added spinlock and refcount check, then write a multi-threaded PoC that wins the race and triggers a double free on the unpatched build. ## Quick Start Ask the agent to diff the patched and unpatched versions of a target binary with ghidriff and infer the vulnerability class from the changed functions.

Frequently Asked Questions about patch-diff-exploit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the vulnerability a patch fixes without a public PoC?▼

Obtain the patched and unpatched binaries, align symbols, then diff them with BinDiff or ghidriff. Focus on functions with similarity scores between 0.5 and 0.95, and infer the bug class from newly added checks like bounds validation, locks, or refcounting.

BinDiff vs Diaphora vs ghidriff for patch diffing?▼

BinDiff is the industry benchmark with the most reliable function matching but works best with IDA Pro. Diaphora is a mature IDA plugin with pseudocode diff and SQLite storage. ghidriff is free, CLI-driven, CI-friendly, and outputs markdown reports using Ghidra headless.

How do I get patched and unpatched Windows binaries for diffing?▼

Download the current and previous month's MSU packages from the Microsoft Update Catalog, unpack them with expand.exe or dism, and extract target files like ntoskrnl.exe or afd.sys. Pull matching PDBs from the Microsoft symbol server with symchk.

Why does my binary diff show a low match ratio?▼

A matched ratio below 90% usually means alignment failed, often because the two builds used different compiler versions, optimization levels, or PGO settings. Diff version N against N-1 from the same toolchain rather than across major versions.

Can patch diffing work on the Linux kernel?▼

Yes. Download patched and unpatched kernel packages with apt or dnf, unpack them with dpkg-deb or rpm2cpio, recover vmlinux using the kernel's extract-vmlinux script, then diff with ghidriff. Debuginfo packages provide the needed symbols.

What are the legal limits of N-day exploit development?▼

Weaponizing N-days must stay within authorized scope such as bug bounty programs, SRC engagements, your own lab machines, or CTFs. Deploying a 1-day against production systems without authorization constitutes intrusion and is illegal.

Related Skills

Explore More Software Engineering Skills→
MDSIXONEMDSIXONE

binary-diff

Migrate symbols across binary versions using LLM-based disassembly comparison.

Community
Advanced
yaklangyaklang
2.0k

kernel-exploitation

Exploits Linux kernel vulnerabilities for privilege escalation using ROP chains and heap techniques.

Official
Advanced
nolanvenholanolanvenhola
3

reverse-engineering

Automate disassembly, decompilation, and deobfuscation of binaries with Ghidra, IDA Pro, radare2, and angr.

Community
Advanced
braydos-hbraydos-h
4

performing-fuzzing-with-aflplusplus

Runs coverage-guided AFL++ fuzzing campaigns on compiled binaries and triages discovered crashes.

Community
Intermediate