# How reverse‑skill Performs Patch Diff Analysis for Vulnerability Discovery

> Discover how reverse-skill automates patch diff analysis for vulnerability discovery. Explore its eight-stage workflow for efficient security prompt routing and proof-of-concept generation.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-25

---

**reverse‑skill automates patch diff analysis through an eight-stage workflow that routes security prompts to dedicated skills, acquires patched and unpatched binaries, executes binary diff engines, and generates proof-of-concept code to confirm vulnerabilities.**

The `zhaoxuya520/reverse-skill` repository implements patch diff analysis as a declarative skill system orchestrated entirely through markdown specifications. This approach transforms a researcher’s patch comparison hint into a complete vulnerability discovery pipeline without embedding executable logic directly in the repository.

## Routing and Intent Detection

The workflow begins in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), where keyword detection triggers the *patch‑diff‑exploit* skill. When inputs contain terms like *N‑day*, *patch diff*, *patch Tuesday*, or *binary diff*, the router dispatches the request to the specialized handler【/skills/routing.md#L111-L113】. This declarative routing ensures that patch diff analysis requests are immediately paired with the appropriate tooling and methodology.

## Binary Acquisition and Symbol Resolution

Following [`skills/patch-diff-exploit/references/patch-tuesday-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/references/patch-tuesday-workflow.md), the skill coordinates the download of **patched** (after) and **unpatched** (before) binaries from the Microsoft Update Catalog or Linux package repositories. The workflow handles Windows MSU file expansion and Linux package extraction through standard command-line tools.

```powershell

# Download Patch Tuesday metadata and specific KB

Invoke-RestMethod https://api.msrc.microsoft.com/sug/v2.0/patches `
  | ConvertTo-Json -Depth 10 > C:\patches\msrc-2023-03.json

python msu-downloader.py --kb KB5031350 --arch x64 --out C:\patches\
expand.exe C:\patches\Windows-KB5031350-x64.msu -F:* C:\patches\out\

```

Symbol extraction utilizes `symchk` for Windows binaries or DWARF utilities for Linux. If debug symbols are unavailable, the skill invokes the *binary‑diff* helper to migrate symbols from nearby versions, ensuring accurate function mapping before comparison.

```powershell

# Extract PDB symbols for both binary versions

symchk /v /r C:\patches\unpatched\ntoskrnl.exe /s SRV*C:\sym*https://msdl.microsoft.com/download/symbols
symchk /v /r C:\patches\patched\ntoskrnl.exe   /s SRV*C:\sym*https://msdl.microsoft.com/download/symbols

```

## Binary Diff Engine Selection and Execution

According to [`skills/patch-diff-exploit/references/diff-tools-comparison.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/references/diff-tools-comparison.md), the skill selects the optimal diff engine based on availability and target architecture. Supported tools include **BinDiff**, **Diaphora**, and **radiff2**, each invoked through automated command-line generation.

```bash

# BinDiff workflow: export from IDA then compare

ida -B -o old.BinExport C:\patches\unpatched\ntoskrnl.exe
ida -B -o new.BinExport C:\patches\patched\ntoskrnl.exe
bindiff old.BinExport new.BinExport -o diff-report

```

For open-source alternatives or quick analysis, the skill supports radiff2:

```bash
radiff2 -C C:\patches\unpatched\ntoskrnl.exe C:\patches\patched\ntoskrnl.exe > diff.txt

```

## Parsing Diff Reports and Identifying Security Fixes

As documented in [`skills/patch-diff-exploit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/SKILL.md) (lines 45‑59), the parsing stage analyzes diff output to locate changed functions, newly added guard checks, removed unsafe calls, and altered control-flow constructs. The skill specifically highlights *only‑in‑patched blocks* (potential fixes) and *only‑in‑unpatched blocks* (vulnerable code paths) as primary investigation targets.

```python
import re, pathlib

diff = pathlib.Path('diff.txt').read_text()

# Identify new guard checks added in the patched version

guards = re.findall(r'if\s*\(.*\)\s*goto\s*error', diff)
print('Potential new guards:', guards)

```

## Vulnerability Classification and Root Cause Analysis

Using [`skills/patch-diff-exploit/references/root-cause-and-poc.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/references/root-cause-and-poc.md), the skill maps observed code changes to specific vulnerability classes. The reference documentation provides pattern tables that associate diff observations—such as new bounds checks or integer overflow guards—with bug types like **out‑of‑bounds read/write**, **race conditions**, or **buffer overflows**. Each pattern includes a checklist of indicators, enabling systematic classification of the security issue.

## Proof-of-Concept Generation and Verification

The final stage generates PoC templates compiled against the **unpatched** binary to confirm the vulnerability. The skill fills C, PowerShell, or Python templates with concrete values derived from the diff analysis.

```c
// PoC template targeting integer overflow from diff analysis
#include <stdio.h>
#include <limits.h>

int main() {
    unsigned int a = 0xFFFFFFFF;   // Large value identified in diff
    unsigned int b = 0x10;         // Overflow trigger
    unsigned int sum;
    __builtin_add_overflow(a, b, &sum);
    // Call vulnerable function with overflowed sum
    vulnerable_func(sum);
    return 0;
}

```

Verification requires executing the PoC against both binary versions: the unpatched binary should crash or exhibit the vulnerability, while the patched binary should handle the input safely. This confirmation step is documented in [`skills/patch-diff-exploit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/SKILL.md) (lines 106‑113) as the final validation before weaponization or reporting.

## Summary

- **reverse‑skill** implements patch diff analysis as a declarative workflow defined entirely in markdown files, specifically within `skills/patch-diff-exploit/` and its reference documents.
- The router in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) automatically dispatches patch-related queries to the appropriate skill based on keyword detection.
- Binary acquisition follows the Patch Tuesday workflow to obtain paired patched and unpatched versions, with fallback symbol migration when debug symbols are missing.
- The skill supports multiple diff engines including BinDiff, Diaphora, and radiff2, selecting the appropriate tool based on the comparison matrix in [`diff-tools-comparison.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/diff-tools-comparison.md).
- Vulnerability inference relies on pattern matching against [`root-cause-and-poc.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/root-cause-and-poc.md), mapping code changes to specific bug classes and generating executable PoC templates for verification.

## Frequently Asked Questions

### What triggers the patch diff analysis skill in reverse‑skill?

The router monitors for keywords like *N‑day*, *patch diff*, *patch Tuesday*, and *binary diff* in user inputs. When detected, [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) automatically directs the session to the `patch-diff-exploit` skill【/skills/routing.md#L166】, activating the full eight-stage workflow without manual intervention.

### Which binary diff tools does reverse‑skill support?

According to [`skills/patch-diff-exploit/references/diff-tools-comparison.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/references/diff-tools-comparison.md), the skill supports **BinDiff**, **Diaphora**, and **radiff2** among others. The selection depends on tool availability, target platform, and whether the analysis requires graphical IDA integration versus command-line automation.

### How does reverse‑skill handle missing debug symbols?

If `symchk` or Linux equivalent tools fail to retrieve symbols, the skill invokes the *binary‑diff* helper to migrate symbols from a nearby version of the binary. This symbol migration step ensures accurate function matching even when official debug symbols are unavailable for the exact build being analyzed.

### What vulnerability classes can the skill identify from patch diffs?

The [`root-cause-and-poc.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/root-cause-and-poc.md) reference file maps diff patterns to classes including **integer overflows**, **out‑of‑bounds read/write**, **race conditions**, **use‑after‑free**, and **buffer overflows**. Each class includes specific indicators—such as new guard checks or arithmetic validation—that the skill searches for in the diff output.