Writing N-day Exploit PoCs from Vendor Patch Diff Analysis Using patch-diff-exploit

The reverse-skill repository provides a platform-agnostic routing framework that automates the workflow for converting vendor security patches into working proof-of-concept exploits through its patch-diff-exploit skill module.

Generating reliable proof-of-concept exploits for N-day vulnerabilities requires systematic analysis of vendor patch diffs to identify the exact vulnerability class and affected code paths. The zhaoxuya520/reverse-skill repository implements a structured routing architecture that guides security analysts through writing N-day exploit PoCs from vendor patch diff analysis using the patch-diff-exploit skill. This approach transforms manual binary diffing procedures into a reproducible, auditable workflow integrated with automated tool management.

Understanding the reverse-skill Routing Architecture

The foundation of the N-day exploit generation process relies on a centralized routing system defined in skills/config/routing.json. This JSON file serves as the single source of truth that maps task keywords to specific skill modules.

The routing hierarchy begins with skills/SKILL.md, which acts as the master entry point for all security workflows. When an analyst initiates a task, the system consults skills/routing.md to match keywords like "N-day" or "patch diff" against available capabilities. This matrix-based approach ensures that requests for patch diff analysis are automatically directed to the appropriate skill directory, as documented in docs/ARCHITECTURE.md.

How the patch-diff-exploit Skill Works

Located at skills/patch-diff-exploit/SKILL.md, this module defines a five-step methodology for transforming patch differences into exploitable code:

1. Acquire Target Binaries – Download before-and-after patch binaries (MSU/MSP packages for Windows, .deb or .rpm files for Linux distributions).

2. Symbol Alignment – Migrate debug symbols using PDB files or binary-diff techniques to establish accurate function mapping between versions.

3. Differential Analysis – Execute binary diffing tools such as BinDiff, ghidriff, or Diaphora to identify code changes.

4. Vulnerability Identification – Filter functions with similarity scores between 0.5 and 0.95, focusing on newly added security checks that indicate patched vulnerabilities.

5. PoC Development – Write targeted proof-of-concept code exploiting the identified bug class.

The skill documentation includes ready-made bootstrap commands for installing missing dependencies. For example, analysts can install ghidriff via pip when the tool is not present on the system.

Automating Tool Discovery and Bootstrap

Before executing the patch-diff-exploit workflow, the repository ensures all required utilities are available through automated detection scripts. The skills/scripts/refresh-tool-index.ps1 (Windows) and skills/scripts/refresh-tool-index.sh (Linux/macOS) scripts scan the environment and generate tool-index.md, cataloging available reverse engineering tools.

When dependencies are missing, skills/scripts/bootstrap-reverse.ps1 (or its Linux equivalent) references bootstrap-manifest.json to perform automatic installation. This bootstrap layer eliminates manual configuration errors and ensures consistent tool availability across different analysis environments.

Executing the N-day Exploit Workflow

To initiate the patch-diff-exploit process, analysts invoke the master routing script with contextual hints:

git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

# Refresh tool index

powershell -File skills/scripts/refresh-tool-index.ps1

# Linux alternative: bash skills/scripts/refresh-tool-index.sh

Once the environment is prepared, execute the primary route:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "N-day exploit from Windows patch"

The master-route.ps1 script parses skills/config/routing.json, matches the hint keywords against the routing matrix, and automatically navigates to the patch-diff-exploit skill directory. This automation reduces the cognitive overhead of manually locating the correct workflow documentation.

Downstream Exploit Development

After generating a working PoC through the patch-diff-exploit skill, the routing matrix documented in the skill's routing context section facilitates automatic hand-off to specialized downstream modules. The system forwards successful cases to pwn-chain for full exploit development and weaponization, or to pentest-tools/network-attack-defense for network-based attack scenarios.

This integration ensures that N-day analysis seamlessly transitions into comprehensive exploit chains without requiring manual reconfiguration of the analysis environment.

Summary

• The reverse-skill repository uses skills/config/routing.json as a centralized routing mechanism to direct N-day exploit tasks to the appropriate skill modules.
• The patch-diff-exploit skill at skills/patch-diff-exploit/SKILL.md provides a five-step framework for converting vendor patches into PoCs through binary diffing and vulnerability identification.
• Automated scripts like skills/scripts/refresh-tool-index.ps1 and skills/scripts/bootstrap-reverse.ps1 handle tool detection and installation without manual intervention.
• The skills/scripts/master-route.ps1 script initiates workflows by parsing keyword hints and navigating the routing matrix.
• Downstream skills such as pwn-chain automatically receive completed PoCs for further exploit development.

Frequently Asked Questions

What prerequisites are required for running the patch-diff-exploit skill?

Analysts need PowerShell or Bash execution capabilities, Git for repository cloning, and sufficient disk space for storing before-and-after binary patches. The bootstrap scripts automatically handle installation of specialized tools like BinDiff, Ghidra, or ghidriff when they are not detected in the system PATH.

Does the patch-diff-exploit workflow support both Windows and Linux targets?

Yes. The skill accommodates Windows patches (MSU/MSP files) and Linux packages (DEB/RPM formats). The routing system automatically adjusts tool recommendations based on the target platform identified in the analysis hint.

How does the routing system determine which skill to execute?

The skills/scripts/master-route.ps1 script parses the -Hint parameter and consults skills/config/routing.json to match keywords such as "N-day", "patch diff", or "exploit" against registered skill paths. This matrix-based approach ensures accurate workflow selection without manual directory navigation.

What is the difference between the patch-diff-exploit skill and 0-day research workflows?

The patch-diff-exploit skill specifically targets N-day vulnerabilities where vendor patches already exist, using binary diffing to identify the patched bug class. Zero-day research would typically begin with the fuzzing or vuln-research skills in the same repository, which focus on discovering previously unknown vulnerabilities rather than analyzing existing patches.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}