How to Create Cross-Version Binary Diff Workflows Using the binary-diff Skill

The binary-diff skill orchestrates an LLM-driven pipeline that migrates symbols from debug-rich legacy binaries to newer stripped versions through an incremental three-layer architecture combining IDA Pro exports, structured prompting, and automated IDAPython application.

Modern reverse engineering frequently encounters scenarios where a newer binary release lacks debug symbols while an older version retains full PDB information. The binary-diff skill within the zhaoxuya520/reverse-skill repository addresses this challenge by automating cross-version binary diff workflows that transfer semantic knowledge between binary versions without manual comparison.

Understanding the Three-Layer Architecture

The skill implements a lightweight pipeline organized into three logical layers that process functions incrementally to maintain LLM context limits and minimize API costs.

Data Collection Layer

This layer exports disassembly and decompiled pseudo-code from IDA Pro for "anchor" functions existing in both binary versions. The export commands utilize the idapro_* helper functions defined by the ida-reverse skill, as illustrated in the routing diagram within docs/ARCHITECTURE.md. The system selectively targets functions based on a reliability hierarchy to ensure high-confidence matches.

LLM Comparison Layer

The exported text feeds into a fixed prompt template located at skills/binary-diff/references/prompt-template.md. This prompt instructs the LLM to locate references to supplied symbols and return structured YAML mappings. The skill defaults to the inexpensive DeepSeek model for standard functions and automatically falls back to GPT-4o or Claude when token limits exceed DeepSeek's context window.

Application Layer

The final layer parses YAML responses and programmatically modifies the new binary using IDAPython helpers including idapro_rename and idapro_set_comments. The system applies mappings in batches and iteratively promotes newly matched functions to anchor status until achieving desired coverage.

Implementing the Workflow

The following Python skeleton from skills/binary-diff/references/prompt-template.md demonstrates the core LLM comparison logic:

import yaml, httpx
from pathlib import Path

PROMPT_TEMPLATE = Path("prompt-template.txt").read_text()

def migrate_function(ref_disasm, ref_proc, tgt_disasm, tgt_proc, symbols,
                    api_url, api_key, model="deepseek-chat"):
    prompt = PROMPT_TEMPLATE.format(
        disasm_for_reference=ref_disasm,
        procedure_for_reference=ref_proc,
        disasm_code=tgt_disasm,
        procedure=tgt_proc,
        symbol_name_list=", ".join(symbols)
    )
    resp = httpx.post(api_url,
                      json={"model": model,
                            "messages": [{"role": "user",
                                          "content": prompt}],
                            "temperature": 0},
                      headers={"Authorization": f"Bearer {api_key}"})
    content = resp.json()["choices"][0]["message"]["content"]
    yaml_str = (content.split("```yaml")[1].split("```")[0]
                if "```yaml" in content else content)
    return yaml.safe_load(yaml_str)

The apply_results function transforms parsed YAML into concrete IDA actions:

def apply_results(results):
    """Transform parsed YAML into IDAPython rename / comment actions."""
    renames, comments = [], []
    for item in results.get("found_call", []):
        renames.append({"addr": item["insn_va"], "name": item["func_name"],
                       "type": "call_target"})
    for item in results.get("found_vcall", []):
        comments.append({"addr": item["insn_va"],
                         "comment": f"vcall: {item['func_name']} @ +{item['vfunc_offset']}"})
    # … handle other sections similarly …

    return {"renames": renames, "comments": comments}

A typical workflow executes in three stages:

1. Export disassembly and pseudocode from both the old (reference) and new (target) binaries using IDA Pro.
2. Invoke migrate_function with the exported data and desired symbol list to generate a YAML mapping.
3. Process the YAML through apply_results and apply changes via idapro_rename and idapro_set_comments.

Anchor Selection Strategy

The workflow relies on anchor functions—symbols existing in both binary versions that serve as comparison points. According to skills/binary-diff/SKILL.md, the skill selects anchors following a strict reliability hierarchy:

• Exported functions (highest confidence)
• String references
• Constants
• Code patterns (lowest confidence)

This hierarchy ensures mismatched anchors are caught early before propagating errors through the workflow. The system caches results to avoid duplicate LLM calls for identical functions.

Skill Registration and Configuration

The binary-diff skill integrates into the broader reverse-skill ecosystem through explicit routing definitions:

• skills/binary-diff/SKILL.md contains the complete skill definition, workflow steps, and anchor strategy documentation.
• skills/binary-diff/references/prompt-template.md houses the LLM prompt template and Python integration skeleton.
• docs/ARCHITECTURE.md provides the high-level diagram showing the skill's relationship to ida-reverse/ and other components.
• skills/routing.md maps the "binary-diff" trigger keywords to this skill implementation.
• skills/MASTER-ROUTING.md registers the skill under the "R15" category in the global routing matrix.

Summary

• The binary-diff skill automates cross-version symbol migration using a three-layer architecture of data collection, LLM comparison, and IDAPython application.
• The workflow processes functions incrementally to manage LLM context limits, caching results to minimize API costs.
• DeepSeek serves as the default model with automatic fallback to GPT-4o or Claude for high-token inputs.
• Anchor selection follows a strict reliability hierarchy (exported functions → strings → constants → patterns) to ensure accurate matching.
• Configuration resides in skills/binary-diff/SKILL.md with routing defined in skills/routing.md and skills/MASTER-ROUTING.md.

Frequently Asked Questions

What is the primary purpose of the binary-diff skill?

The binary-diff skill provides an automated pipeline for migrating debugging symbols and semantic information from older binaries with full PDB information to newer stripped versions. It eliminates manual binary diffing by orchestrating IDA Pro exports, LLM analysis, and programmatic IDA database modifications.

Which LLM models does the binary-diff skill support?

The skill primarily utilizes the DeepSeek model for cost-effective processing of standard functions. It automatically falls back to GPT-4o or Claude when encountering functions that exceed DeepSeek's token limits, ensuring reliable processing of complex disassembly.

How does the skill handle large functions that exceed token limits?

When the exported disassembly and pseudo-code exceed the primary model's context window, the skill automatically switches to higher-capacity models like GPT-4o or Claude. This fallback mechanism is transparent to the user and maintains the workflow's incremental, one-function-at-a-time processing approach.

Where is the binary-diff skill registered in the routing system?

According to skills/MASTER-ROUTING.md, the skill is registered under the "R15" category, while skills/routing.md maps the specific "binary-diff" trigger keywords to the skill implementation located in skills/binary-diff/.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}