# How to Create Cross-Version Binary Diff Workflows Using the binary-diff Skill

> Learn how to create cross-version binary diff workflows with the binary-diff skill. Leverage an LLM-driven pipeline to migrate symbols from legacy to newer binaries.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-09

---

**The binary-diff skill orchestrates an LLM-driven pipeline that migrates symbols from debug-rich legacy binaries to newer stripped versions through an incremental three-layer architecture combining IDA Pro exports, structured prompting, and automated IDAPython application.**

Modern reverse engineering frequently encounters scenarios where a newer binary release lacks debug symbols while an older version retains full PDB information. The **binary-diff** skill within the `zhaoxuya520/reverse-skill` repository addresses this challenge by automating cross-version binary diff workflows that transfer semantic knowledge between binary versions without manual comparison.

## Understanding the Three-Layer Architecture

The skill implements a lightweight pipeline organized into three logical layers that process functions incrementally to maintain LLM context limits and minimize API costs.

### Data Collection Layer

This layer exports disassembly and decompiled pseudo-code from IDA Pro for "anchor" functions existing in both binary versions. The export commands utilize the `idapro_*` helper functions defined by the `ida-reverse` skill, as illustrated in the routing diagram within [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md). The system selectively targets functions based on a reliability hierarchy to ensure high-confidence matches.

### LLM Comparison Layer

The exported text feeds into a fixed prompt template located at [`skills/binary-diff/references/prompt-template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/references/prompt-template.md). This prompt instructs the LLM to locate references to supplied symbols and return structured YAML mappings. The skill defaults to the inexpensive **DeepSeek** model for standard functions and automatically falls back to **GPT-4o** or **Claude** when token limits exceed DeepSeek's context window.

### Application Layer

The final layer parses YAML responses and programmatically modifies the new binary using IDAPython helpers including `idapro_rename` and `idapro_set_comments`. The system applies mappings in batches and iteratively promotes newly matched functions to anchor status until achieving desired coverage.

## Implementing the Workflow

The following Python skeleton from [`skills/binary-diff/references/prompt-template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/references/prompt-template.md) demonstrates the core LLM comparison logic:

```python
import yaml, httpx
from pathlib import Path

PROMPT_TEMPLATE = Path("prompt-template.txt").read_text()

def migrate_function(ref_disasm, ref_proc, tgt_disasm, tgt_proc, symbols,
                    api_url, api_key, model="deepseek-chat"):
    prompt = PROMPT_TEMPLATE.format(
        disasm_for_reference=ref_disasm,
        procedure_for_reference=ref_proc,
        disasm_code=tgt_disasm,
        procedure=tgt_proc,
        symbol_name_list=", ".join(symbols)
    )
    resp = httpx.post(api_url,
                      json={"model": model,
                            "messages": [{"role": "user",
                                          "content": prompt}],
                            "temperature": 0},
                      headers={"Authorization": f"Bearer {api_key}"})
    content = resp.json()["choices"][0]["message"]["content"]
    yaml_str = (content.split("```yaml")[1].split("```")[0]
                if "```yaml" in content else content)
    return yaml.safe_load(yaml_str)

```

The `apply_results` function transforms parsed YAML into concrete IDA actions:

```python
def apply_results(results):
    """Transform parsed YAML into IDAPython rename / comment actions."""
    renames, comments = [], []
    for item in results.get("found_call", []):
        renames.append({"addr": item["insn_va"], "name": item["func_name"],
                       "type": "call_target"})
    for item in results.get("found_vcall", []):
        comments.append({"addr": item["insn_va"],
                         "comment": f"vcall: {item['func_name']} @ +{item['vfunc_offset']}"})
    # … handle other sections similarly …

    return {"renames": renames, "comments": comments}

```

A typical workflow executes in three stages:

1. Export disassembly and pseudocode from both the old (reference) and new (target) binaries using IDA Pro.
2. Invoke `migrate_function` with the exported data and desired symbol list to generate a YAML mapping.
3. Process the YAML through `apply_results` and apply changes via `idapro_rename` and `idapro_set_comments`.

## Anchor Selection Strategy

The workflow relies on **anchor functions**—symbols existing in both binary versions that serve as comparison points. According to [`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md), the skill selects anchors following a strict reliability hierarchy:

- **Exported functions** (highest confidence)
- **String references**
- **Constants**
- **Code patterns** (lowest confidence)

This hierarchy ensures mismatched anchors are caught early before propagating errors through the workflow. The system caches results to avoid duplicate LLM calls for identical functions.

## Skill Registration and Configuration

The binary-diff skill integrates into the broader reverse-skill ecosystem through explicit routing definitions:

- **[`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md)** contains the complete skill definition, workflow steps, and anchor strategy documentation.
- **[`skills/binary-diff/references/prompt-template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/references/prompt-template.md)** houses the LLM prompt template and Python integration skeleton.
- **[`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md)** provides the high-level diagram showing the skill's relationship to `ida-reverse/` and other components.
- **[`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)** maps the "binary-diff" trigger keywords to this skill implementation.
- **[`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md)** registers the skill under the "R15" category in the global routing matrix.

## Summary

- The **binary-diff** skill automates cross-version symbol migration using a three-layer architecture of data collection, LLM comparison, and IDAPython application.
- The workflow processes functions incrementally to manage LLM context limits, caching results to minimize API costs.
- **DeepSeek** serves as the default model with automatic fallback to **GPT-4o** or **Claude** for high-token inputs.
- Anchor selection follows a strict reliability hierarchy (exported functions → strings → constants → patterns) to ensure accurate matching.
- Configuration resides in [`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md) with routing defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) and [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md).

## Frequently Asked Questions

### What is the primary purpose of the binary-diff skill?

The binary-diff skill provides an automated pipeline for migrating debugging symbols and semantic information from older binaries with full PDB information to newer stripped versions. It eliminates manual binary diffing by orchestrating IDA Pro exports, LLM analysis, and programmatic IDA database modifications.

### Which LLM models does the binary-diff skill support?

The skill primarily utilizes the **DeepSeek** model for cost-effective processing of standard functions. It automatically falls back to **GPT-4o** or **Claude** when encountering functions that exceed DeepSeek's token limits, ensuring reliable processing of complex disassembly.

### How does the skill handle large functions that exceed token limits?

When the exported disassembly and pseudo-code exceed the primary model's context window, the skill automatically switches to higher-capacity models like GPT-4o or Claude. This fallback mechanism is transparent to the user and maintains the workflow's incremental, one-function-at-a-time processing approach.

### Where is the binary-diff skill registered in the routing system?

According to [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md), the skill is registered under the "R15" category, while [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) maps the specific "binary-diff" trigger keywords to the skill implementation located in `skills/binary-diff/`.