# 1-Day CVE Reproduction with Patch Diff Integration: A Complete Workflow Guide > Master 1-day CVE reproduction with patch diff integration. This guide details a workflow for acquiring patches, generating binary diffs with Ghidra/Diaphora, and validating exploits in sandboxes. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-15 --- **The `zhaoxuya520/reverse-skill` repository provides a modular workflow that automates 1-day CVE reproduction by acquiring security patches, generating binary diffs via Ghidra or Diaphora, and validating exploits in sandboxed environments.** The `zhaoxuya520/reverse-skill` repository defines a structured approach to **1-day CVE reproduction with patch diff integration**, combining automated patch acquisition, binary differential analysis, and sandboxed validation. This workflow leverages specialized skills documented in dedicated markdown files and orchestrated through a central routing configuration to transform freshly disclosed vulnerabilities into reproducible proof-of-concepts. ## Overview of the Patch-Diff Workflow The workflow is designed to handle immediate-day (1-day) vulnerabilities by reverse-engineering the fix to understand the bug. It consists of six modular stages managed through distinct skill domains. According to the routing matrix in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), the pipeline is categorized under **"N-day / patch diff / CVE reproduction"** and routes execution through the `binary-diff` skill. ## Step-by-Step 1-Day CVE Reproduction ### Locate the CVE and Acquire the Patch The process begins by identifying a target CVE from public advisories (OSV, NVD) and retrieving the official patch. The **patch-diff-exploit** skill provides the documentation and automation scripts for this acquisition. - Identify the vulnerable component and commit hash from the security advisory. - Retrieve the patch diff from the vendor's repository. - Store the patch metadata in the workspace for downstream processing. The documentation for this stage resides in [`skills/patch-diff-exploit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/SKILL.md). ### Generate Binary Diffs with Specialized Tools Once the source patch is secured, the workflow computes a binary diff to isolate the vulnerable functions. The **binary-diff** skill supports multiple reverse-engineering frameworks. - **Ghidra**: Used for decompilation and structural comparison. - **Diaphora**: Generates semantic diffs between binary versions. - **DeepDiff**: Provides deep structural analysis for configuration or data files. Execute the diff generation against both the patched and unpatched binaries to highlight added or modified functions. The guidelines for this step are documented in [`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md). ### Create a Reproduction Harness Extract the changed code regions identified in the diff to construct a minimal Proof-of-Concept (PoC). This harness targets the specific vulnerable routine identified by the differential analysis. - Parse the diff output to identify function names and offset changes. - Build a trigger script that invokes the vulnerable code path. - Instrument the binary with debugging utilities if necessary. The routing configuration in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) explicitly maps this "N-day / patch diff / CVE reproduction" step to the binary-diff skill for automated orchestration. ### Validate Exploits in the CTF Sandbox Execute the PoC in an isolated environment to confirm vulnerability trigger and patch efficacy. The **CTF-Sandbox-Orchestrator** module provides the sandboxed execution environment. - Run the PoC against the **unpatched** binary to verify crash or anomalous behavior. - Re-run against the **patched** binary to confirm mitigation. - Capture execution logs and crash dumps for analysis. Automation scripts for this stage are documented in [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md). ### Integrate Findings into the Knowledge Base Document the reproduction steps, diff artifacts, and mitigation verification results. Update the central routing configuration to enable automatic recall for future queries. - Append CVE details and reproduction steps to the corresponding skill markdown. - Modify [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to map the CVE identifier to the patch-diff workflow. - Store binary diff outputs and PoC scripts in the designated cache directory. ### Automate Continuous Monitoring The **supply-chain-security** skill monitors CVE feeds and triggers the patch-diff pipeline automatically when new disclosures match configured criteria. - Poll OSV and NVD feeds for high-severity CVEs. - Trigger the `patch-diff-exploit` skill upon detection of relevant 1-day disclosures. - Initiate the binary diff and validation workflow without manual intervention. Configuration for this automation is found in [`skills/supply-chain-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/supply-chain-security/SKILL.md). ## Automation Scripts and Commands The repository provides PowerShell and Bash scripts to automate the diff extraction and validation process. Automate patch extraction for a specific CVE using the patch-diff skill script: ```powershell powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/patch-diff.ps1 ` -CveId "CVE-2023-XYZ" ` -RepoUrl "https://github.com/example/vulnerable-project" ` -PatchBranch "fix-CVE-2023-XYZ" ``` Generate the binary diff using Diaphora to identify the vulnerable function: ```bash ./diaphora -old old_binary -new new_binary -output diff.json jq '.functions[] | select(.name=="vuln_func")' diff.json ``` Execute the PoC in the sandboxed environment to validate the exploit: ```powershell powershell -NoProfile -ExecutionPolicy Bypass -File ctf-sandbox-orchestrator/run-poc.ps1 ` -Binary "./unpatched.bin" ` -PoC "./exploit.ps1" ``` ## Summary - **1-day CVE reproduction with patch diff integration** relies on acquiring the official fix, computing binary diffs, and validating against unpatched binaries. - Key files include [`skills/patch-diff-exploit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/SKILL.md) for patch handling and [`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md) for diff generation. - The workflow is orchestrated through [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) and [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). - Sandboxed validation uses the [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md) module. - Continuous monitoring is handled by [`skills/supply-chain-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/supply-chain-security/SKILL.md) to automate pipeline triggers. ## Frequently Asked Questions ### What is patch-diff integration in CVE reproduction? Patch-diff integration is the process of analyzing a vendor's security patch to extract the exact code changes that fix a vulnerability. By comparing the patched and unpatched binaries using tools like Ghidra or Diaphora, researchers can identify the vulnerable function and develop a proof-of-concept that demonstrates the security flaw. ### How does the reverse-skill repository automate 1-day CVE analysis? The repository uses a routing system defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) and [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to automatically direct CVE-related queries through the patch-diff workflow. The `supply-chain-security` skill monitors public CVE feeds and triggers the `patch-diff-exploit` skill, which then orchestrates binary diff generation and sandboxed validation. ### Which tools are supported for binary diff generation? According to [`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md), the workflow supports **Ghidra** for decompilation and structural diffing, **Diaphora** for binary comparison and export, and **DeepDiff** for analyzing structural changes in data or configuration files. ### How is the vulnerable function identified in the diff? After generating the binary diff with Diaphora or Ghidra, the output is parsed using JSON queries (e.g., `jq`) to select functions marked as modified or added in the patched version. These functions represent the fix location, and their logic is reverse-engineered to determine the original vulnerability trigger.