How reverse‑skill Performs Patch Diff Analysis for Vulnerability Discovery

reverse‑skill automates patch diff analysis through an eight-stage workflow that routes security prompts to dedicated skills, acquires patched and unpatched binaries, executes binary diff engines, and generates proof-of-concept code to confirm vulnerabilities.

The zhaoxuya520/reverse-skill repository implements patch diff analysis as a declarative skill system orchestrated entirely through markdown specifications. This approach transforms a researcher’s patch comparison hint into a complete vulnerability discovery pipeline without embedding executable logic directly in the repository.

Routing and Intent Detection

The workflow begins in skills/routing.md, where keyword detection triggers the patch‑diff‑exploit skill. When inputs contain terms like N‑day, patch diff, patch Tuesday, or binary diff, the router dispatches the request to the specialized handler【/skills/routing.md#L111-L113】. This declarative routing ensures that patch diff analysis requests are immediately paired with the appropriate tooling and methodology.

Binary Acquisition and Symbol Resolution

Following skills/patch-diff-exploit/references/patch-tuesday-workflow.md, the skill coordinates the download of patched (after) and unpatched (before) binaries from the Microsoft Update Catalog or Linux package repositories. The workflow handles Windows MSU file expansion and Linux package extraction through standard command-line tools.

# Download Patch Tuesday metadata and specific KB

Invoke-RestMethod https://api.msrc.microsoft.com/sug/v2.0/patches `
  | ConvertTo-Json -Depth 10 > C:\patches\msrc-2023-03.json

python msu-downloader.py --kb KB5031350 --arch x64 --out C:\patches\
expand.exe C:\patches\Windows-KB5031350-x64.msu -F:* C:\patches\out\

Symbol extraction utilizes symchk for Windows binaries or DWARF utilities for Linux. If debug symbols are unavailable, the skill invokes the binary‑diff helper to migrate symbols from nearby versions, ensuring accurate function mapping before comparison.

# Extract PDB symbols for both binary versions

symchk /v /r C:\patches\unpatched\ntoskrnl.exe /s SRV*C:\sym*https://msdl.microsoft.com/download/symbols
symchk /v /r C:\patches\patched\ntoskrnl.exe   /s SRV*C:\sym*https://msdl.microsoft.com/download/symbols

Binary Diff Engine Selection and Execution

According to skills/patch-diff-exploit/references/diff-tools-comparison.md, the skill selects the optimal diff engine based on availability and target architecture. Supported tools include BinDiff, Diaphora, and radiff2, each invoked through automated command-line generation.

# BinDiff workflow: export from IDA then compare

ida -B -o old.BinExport C:\patches\unpatched\ntoskrnl.exe
ida -B -o new.BinExport C:\patches\patched\ntoskrnl.exe
bindiff old.BinExport new.BinExport -o diff-report

For open-source alternatives or quick analysis, the skill supports radiff2:

radiff2 -C C:\patches\unpatched\ntoskrnl.exe C:\patches\patched\ntoskrnl.exe > diff.txt

Parsing Diff Reports and Identifying Security Fixes

As documented in skills/patch-diff-exploit/SKILL.md (lines 45‑59), the parsing stage analyzes diff output to locate changed functions, newly added guard checks, removed unsafe calls, and altered control-flow constructs. The skill specifically highlights only‑in‑patched blocks (potential fixes) and only‑in‑unpatched blocks (vulnerable code paths) as primary investigation targets.

import re, pathlib

diff = pathlib.Path('diff.txt').read_text()

# Identify new guard checks added in the patched version

guards = re.findall(r'if\s*\(.*\)\s*goto\s*error', diff)
print('Potential new guards:', guards)

Vulnerability Classification and Root Cause Analysis

Using skills/patch-diff-exploit/references/root-cause-and-poc.md, the skill maps observed code changes to specific vulnerability classes. The reference documentation provides pattern tables that associate diff observations—such as new bounds checks or integer overflow guards—with bug types like out‑of‑bounds read/write, race conditions, or buffer overflows. Each pattern includes a checklist of indicators, enabling systematic classification of the security issue.

Proof-of-Concept Generation and Verification

The final stage generates PoC templates compiled against the unpatched binary to confirm the vulnerability. The skill fills C, PowerShell, or Python templates with concrete values derived from the diff analysis.

// PoC template targeting integer overflow from diff analysis
#include <stdio.h>
#include <limits.h>

int main() {
    unsigned int a = 0xFFFFFFFF;   // Large value identified in diff
    unsigned int b = 0x10;         // Overflow trigger
    unsigned int sum;
    __builtin_add_overflow(a, b, &sum);
    // Call vulnerable function with overflowed sum
    vulnerable_func(sum);
    return 0;
}

Verification requires executing the PoC against both binary versions: the unpatched binary should crash or exhibit the vulnerability, while the patched binary should handle the input safely. This confirmation step is documented in skills/patch-diff-exploit/SKILL.md (lines 106‑113) as the final validation before weaponization or reporting.

Summary

• reverse‑skill implements patch diff analysis as a declarative workflow defined entirely in markdown files, specifically within skills/patch-diff-exploit/ and its reference documents.
• The router in skills/routing.md automatically dispatches patch-related queries to the appropriate skill based on keyword detection.
• Binary acquisition follows the Patch Tuesday workflow to obtain paired patched and unpatched versions, with fallback symbol migration when debug symbols are missing.
• The skill supports multiple diff engines including BinDiff, Diaphora, and radiff2, selecting the appropriate tool based on the comparison matrix in diff-tools-comparison.md.
• Vulnerability inference relies on pattern matching against root-cause-and-poc.md, mapping code changes to specific bug classes and generating executable PoC templates for verification.

Frequently Asked Questions

What triggers the patch diff analysis skill in reverse‑skill?

The router monitors for keywords like N‑day, patch diff, patch Tuesday, and binary diff in user inputs. When detected, skills/routing.md automatically directs the session to the patch-diff-exploit skill【/skills/routing.md#L166】, activating the full eight-stage workflow without manual intervention.

Which binary diff tools does reverse‑skill support?

According to skills/patch-diff-exploit/references/diff-tools-comparison.md, the skill supports BinDiff, Diaphora, and radiff2 among others. The selection depends on tool availability, target platform, and whether the analysis requires graphical IDA integration versus command-line automation.

How does reverse‑skill handle missing debug symbols?

If symchk or Linux equivalent tools fail to retrieve symbols, the skill invokes the binary‑diff helper to migrate symbols from a nearby version of the binary. This symbol migration step ensures accurate function matching even when official debug symbols are unavailable for the exact build being analyzed.

What vulnerability classes can the skill identify from patch diffs?

The root-cause-and-poc.md reference file maps diff patterns to classes including integer overflows, out‑of‑bounds read/write, race conditions, use‑after‑free, and buffer overflows. Each class includes specific indicators—such as new guard checks or arithmetic validation—that the skill searches for in the diff output.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}