1-Day CVE Reproduction with Patch Diff Integration: A Complete Workflow Guide

The zhaoxuya520/reverse-skill repository provides a modular workflow that automates 1-day CVE reproduction by acquiring security patches, generating binary diffs via Ghidra or Diaphora, and validating exploits in sandboxed environments.

The zhaoxuya520/reverse-skill repository defines a structured approach to 1-day CVE reproduction with patch diff integration, combining automated patch acquisition, binary differential analysis, and sandboxed validation. This workflow leverages specialized skills documented in dedicated markdown files and orchestrated through a central routing configuration to transform freshly disclosed vulnerabilities into reproducible proof-of-concepts.

Overview of the Patch-Diff Workflow

The workflow is designed to handle immediate-day (1-day) vulnerabilities by reverse-engineering the fix to understand the bug. It consists of six modular stages managed through distinct skill domains. According to the routing matrix in skills/routing.md, the pipeline is categorized under "N-day / patch diff / CVE reproduction" and routes execution through the binary-diff skill.

Step-by-Step 1-Day CVE Reproduction

Locate the CVE and Acquire the Patch

The process begins by identifying a target CVE from public advisories (OSV, NVD) and retrieving the official patch. The patch-diff-exploit skill provides the documentation and automation scripts for this acquisition.

• Identify the vulnerable component and commit hash from the security advisory.
• Retrieve the patch diff from the vendor's repository.
• Store the patch metadata in the workspace for downstream processing.

The documentation for this stage resides in skills/patch-diff-exploit/SKILL.md.

Generate Binary Diffs with Specialized Tools

Once the source patch is secured, the workflow computes a binary diff to isolate the vulnerable functions. The binary-diff skill supports multiple reverse-engineering frameworks.

• Ghidra: Used for decompilation and structural comparison.
• Diaphora: Generates semantic diffs between binary versions.
• DeepDiff: Provides deep structural analysis for configuration or data files.

Execute the diff generation against both the patched and unpatched binaries to highlight added or modified functions. The guidelines for this step are documented in skills/binary-diff/SKILL.md.

Create a Reproduction Harness

Extract the changed code regions identified in the diff to construct a minimal Proof-of-Concept (PoC). This harness targets the specific vulnerable routine identified by the differential analysis.

• Parse the diff output to identify function names and offset changes.
• Build a trigger script that invokes the vulnerable code path.
• Instrument the binary with debugging utilities if necessary.

The routing configuration in skills/routing.md explicitly maps this "N-day / patch diff / CVE reproduction" step to the binary-diff skill for automated orchestration.

Validate Exploits in the CTF Sandbox

Execute the PoC in an isolated environment to confirm vulnerability trigger and patch efficacy. The CTF-Sandbox-Orchestrator module provides the sandboxed execution environment.

• Run the PoC against the unpatched binary to verify crash or anomalous behavior.
• Re-run against the patched binary to confirm mitigation.
• Capture execution logs and crash dumps for analysis.

Automation scripts for this stage are documented in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md.

Integrate Findings into the Knowledge Base

Document the reproduction steps, diff artifacts, and mitigation verification results. Update the central routing configuration to enable automatic recall for future queries.

• Append CVE details and reproduction steps to the corresponding skill markdown.
• Modify skills/config/routing.json to map the CVE identifier to the patch-diff workflow.
• Store binary diff outputs and PoC scripts in the designated cache directory.

Automate Continuous Monitoring

The supply-chain-security skill monitors CVE feeds and triggers the patch-diff pipeline automatically when new disclosures match configured criteria.

• Poll OSV and NVD feeds for high-severity CVEs.
• Trigger the patch-diff-exploit skill upon detection of relevant 1-day disclosures.
• Initiate the binary diff and validation workflow without manual intervention.

Configuration for this automation is found in skills/supply-chain-security/SKILL.md.

Automation Scripts and Commands

The repository provides PowerShell and Bash scripts to automate the diff extraction and validation process.

Automate patch extraction for a specific CVE using the patch-diff skill script:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/patch-diff.ps1 `
    -CveId "CVE-2023-XYZ" `
    -RepoUrl "https://github.com/example/vulnerable-project" `
    -PatchBranch "fix-CVE-2023-XYZ"

Generate the binary diff using Diaphora to identify the vulnerable function:

./diaphora -old old_binary -new new_binary -output diff.json
jq '.functions[] | select(.name=="vuln_func")' diff.json

Execute the PoC in the sandboxed environment to validate the exploit:

powershell -NoProfile -ExecutionPolicy Bypass -File ctf-sandbox-orchestrator/run-poc.ps1 `
    -Binary "./unpatched.bin" `
    -PoC "./exploit.ps1"

Summary

• 1-day CVE reproduction with patch diff integration relies on acquiring the official fix, computing binary diffs, and validating against unpatched binaries.
• Key files include skills/patch-diff-exploit/SKILL.md for patch handling and skills/binary-diff/SKILL.md for diff generation.
• The workflow is orchestrated through skills/routing.md and skills/config/routing.json.
• Sandboxed validation uses the CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md module.
• Continuous monitoring is handled by skills/supply-chain-security/SKILL.md to automate pipeline triggers.

Frequently Asked Questions

What is patch-diff integration in CVE reproduction?

Patch-diff integration is the process of analyzing a vendor's security patch to extract the exact code changes that fix a vulnerability. By comparing the patched and unpatched binaries using tools like Ghidra or Diaphora, researchers can identify the vulnerable function and develop a proof-of-concept that demonstrates the security flaw.

How does the reverse-skill repository automate 1-day CVE analysis?

The repository uses a routing system defined in skills/routing.md and skills/config/routing.json to automatically direct CVE-related queries through the patch-diff workflow. The supply-chain-security skill monitors public CVE feeds and triggers the patch-diff-exploit skill, which then orchestrates binary diff generation and sandboxed validation.

Which tools are supported for binary diff generation?

According to skills/binary-diff/SKILL.md, the workflow supports Ghidra for decompilation and structural diffing, Diaphora for binary comparison and export, and DeepDiff for analyzing structural changes in data or configuration files.

How is the vulnerable function identified in the diff?

After generating the binary diff with Diaphora or Ghidra, the output is parsed using JSON queries (e.g., jq) to select functions marked as modified or added in the patched version. These functions represent the fix location, and their logic is reverse-engineered to determine the original vulnerability trigger.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}