⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
When to Use
- Turning a vendor security advisory into a concrete vulnerable-function location.
- Building a proof-of-concept for a patched vulnerability in authorized research.
Scope of application
Use this skill when the task falls into the following scenarios:
- Known CVE but no public PoC — the vendor advisory says "fixed an out-of-bounds write in the XX component" but no PoC is provided, so it needs to be inferred from the patch
- SRC / red team N-day — the target asset has not been updated in time, so a just-released patch needs to be diffed into a usable 1-day exploit
- Patch Tuesday follow-up — Microsoft releases patches on the second Tuesday of each month, so high-value vulnerabilities (Kernel / Win32k / AFD / CLFS) need to be quickly identified
- Linux LTS patch analysis — the mainline fix has been merged, but side branches or some distribution's backport is incomplete, so find the unpatched surface
- Security patch recovery for drivers / services — patch analysis of closed-source software such as graphics drivers, AV engines, and virtualization components
Division of labor with other skills
| Scenario | What to use |
|---|---|
| Have old-version symbols and migrate them to the new version to aid analysis | binary-diff/ |
| Find vulnerabilities from patches and write PoCs to hit pre-patch versions | This skill |
| Write a complete exploit chain (heap spray, ROP, privilege escalation) | pwn-chain/ |
| Weaponize a 1-day and deploy it to the target network | pentest-tools/network-attack-defense/ |
| Reverse engineer a binary from scratch | ida-reverse/ / radare2/ |
Key difference:binary-diff The goal ofmake the new version analyzable(bring the old symbols over); the goal of this skill is tofind out what bug the patch fixed and then hit the pre-patch version. The former serves defense-side / research-side analysis, while the latter serves attack-side weaponization.
Research and execution boundaries
By default, perform static analysis on authorized offline samples. Record the source/signature/SHA256, exact build/architecture/component, and symbol GUID/age before and after the patch; N-1 does not automatically mean vulnerable, and backports and feature switches must be verified. Match scores are ranking clues, not correctness/vulnerability confidence; matched/unmatched/highly similar functions may all contain critical fixes.
Dynamic crash/race/privilege-escalation testing is only performed in a disposable isolated VM, with count/duration/resource limits and snapshot recovery set; weaponization/persistence/C2 on production networks or expanding the target is prohibited. patched not crashing and unpatched crashing can only support a limited difference, and attribution requires repeated identical conditions, sanitizer/debugger root cause, and controls. Missing tools, scripts, RULES/tool-index must not be pretended to be provided; do not automatically install or start services. Public PoC/external binaries are a separate operation that requires authorization.
Core principles
patched 二进制 (after) unpatched 二进制 (before)
↓ ↓
导入 IDA/Ghidra 导入 IDA/Ghidra
↓ ↓
└──────── BinDiff / ghidriff ──────┘
↓
函数级 diff（matched / unmatched / changed）
↓
聚焦 match score 中等的函数（0.5 - 0.9）
↓
看新增了什么：边界检查 / 锁 / 字段清零 / 整数溢出检查
↓
反推 bug class：OOB / Race / Info Leak / UAF / Integer Overflow
↓
在 unpatched 版本上写 PoC 触发
↓
验证：unpatched 崩 / patched 不崩 → 漏洞确认
Patch fix pattern → reverse-infer vulnerability type:
| Newly added content | Likely bug class |
|---|---|
if (a + b < a) / __builtin_add_overflow |
Integer overflow |
KeAcquireSpinLock / mutex_lock |
Race condition (TOCTOU / double-free) |
if (idx >= MAX) / if (len > buf_size) |
Out-of-bounds read / out-of-bounds write |
RtlZeroMemory / memset(struct, 0, ...) |
Uninitialized memory information leak |
InterlockedDecrement + refcount check |
UAF / reference counting error |
ProbeForRead / ProbeForWrite |
User-mode pointer not validated |
SeAccessCheck / capability check |
Missing permission check |
Remove / tighten IOCTL code |
Attack surface reduction (see how the old interface can be attacked) |
Workflow
Complete 5-step process
Step 1: 拿 before / after 二进制
- Windows: Microsoft Update Catalog 下 MSU/MSP，用 expand.exe / dism 解包
- Linux: 从发行版 USN/RHSA 拉 .deb/.rpm，用 dpkg-deb / rpm2cpio 解包
- 第三方软件: 官网取 N-1 和 N 版本安装包
Step 2: 对齐符号
- 有 PDB 直接吃，没 PDB 时用 binary-diff skill 把 N-1 版本的符号搬到 N 版本
- Linux 内核取对应版本的 vmlinux + System.map / debuginfo
Step 3: 二进制 diff
- BinDiff: 直接给两个 IDB，看函数级匹配结果
- ghidriff: pip 一键安装，CLI 输出 markdown 报告
- Diaphora: IDA 内插件，老牌但需要 IDA Pro
Step 4: 定位变更
- 过滤 match score 0.5-0.95 的函数（完全相同的不看，完全不同的多半是新加 / 重命名）
- 重点看：新增的 if / 新增的循环边界 / 删除的代码块（删了什么也是线索）
- 用 LLM 看 before/after 伪代码反推 bug class（见 references/root-cause-and-poc.md）
Step 5: 写 PoC
- 整数溢出：构造边界值（INT_MAX-1、0xFFFFFFFF）
- 竞争：多线程 hammer，open/close + ioctl 高频并发
- UAF：spray → free → reuse pattern
- OOB：精确控制 len / index 越过边界
- 验证 patched 版本不再崩，unpatched 版本稳定崩 → bug 复现成功
Tool invocation order
下补丁 → 解包 → 加载到 IDA/Ghidra → BinDiff/ghidriff → 看 unmatched/low-match 函数
→ LLM 反推 bug class → 写 PoC → 在 unpatched 跑 → 崩 → 收工
Typical scenario examples
Scenario 1: Windows Patch Tuesday — hypothetical analysis example
The CVE/KB/build/function/crash times below have not been verified in this review and are not actual vulnerability localization or reproduction results; use them after replacing with vendor evidence.
背景：2025 年 11 月 Patch Tuesday，MSRC 公告 CVE-2025-62215
Windows Kernel race condition 导致 double free，CVSS 7.0，本地提权
微软只放了补丁，没放细节，没有公开 PoC
目标：复现 PoC，验证未打补丁的 Windows 11 22H2 / 23H2 可提权
步骤：
1. Microsoft Update Catalog 搜 "2025-11" + KB 号，下两个版本：
- 22H2 build 22621.xxxx (unpatched)
- 22H2 build 22621.yyyy (patched 后)
命令:
expand.exe Windows-KB5052000-x64.msu -F:* C:\out\patched\
expand.exe C:\out\patched\Windows-KB5052000-x64.cab -F:* C:\out\patched\
提取 ntoskrnl.exe / win32k.sys / win32kfull.sys / afd.sys
2. 两个版本都吃 PDB (微软符号服务器):
symchk /v /r ntoskrnl.exe /s SRV*C:\sym*https://msdl.microsoft.com/download/symbols
3. 跑 BinDiff:
bindiff old.BinExport new.BinExport
或 ghidriff:
ghidriff ntoskrnl_old.exe ntoskrnl_new.exe -o diff_out/
4. 看报告，过滤 similarity 0.6-0.95 的函数。
假设定位到 NtXxxIoctl 类函数新增了一段:
KeAcquireSpinLockRaiseToDpc(&obj->Lock);
if (obj->RefCount == 0) { ... goto cleanup; }
→ 新增了锁 + 引用计数检查 → race + double free，符合公告描述
5. 写 PoC：用户态多线程同时调 NtClose + 触发同一对象的 IOCTL，
制造 close 释放与 IOCTL 还在用之间的竞争窗口
崩在 ntoskrnl 的 ObfDereferenceObject 后续 free 路径上
6. 验证：
- unpatched 22621.xxxx 上跑 PoC，~30 秒内 BSOD (BAD_POOL_HEADER 或 DOUBLE_FREE)
- patched 22621.yyyy 上跑同 PoC，无任何异常
→ 复现成功
Scenario 2: Finding unfixed side branches in Linux kernel LTS branch patches
背景：主线 6.x 已修某 net subsystem 的 OOB 写
Ubuntu 22.04 (5.15 LTS) 的 USN 已发布更新
但某些 OEM kernel / Azure kernel 的 backport 节奏更慢
想确认未更新的旁支是否仍可打
目标：取 patched/unpatched 内核，差出 fix commit 对应的二进制变更，
在 unpatched 旁支上重写 PoC
步骤：
1. 拉 patched 与 unpatched 包:
apt download linux-image-5.15.0-101-generic # patched
apt download linux-image-5.15.0-100-generic # unpatched
dpkg-deb -x linux-image-5.15.0-101-generic_*.deb ./patched/
dpkg-deb -x linux-image-5.15.0-100-generic_*.deb ./unpatched/
提取 boot/vmlinuz → 用 extract-vmlinux 还原 ELF
2. 同步取 dbgsym:
apt download linux-image-unsigned-5.15.0-101-generic-dbgsym
3. 用 ghidriff (Linux 友好):
ghidriff vmlinux_5.15.0-100 vmlinux_5.15.0-101 \
-o /tmp/kdiff/ --max-section-funcs-analyze 8000
4. 报告里搜 net/ipv4/ net/ipv6/ net/sched/ 等子系统的 changed 函数
找到补丁前 skb_copy_bits 调用前缺少 skb->len 上限校验
→ OOB read，可能配合可触发的 sysctl 升级到 OOB write
5. 在 unpatched 旁支（例如 Azure 5.15.0-1080 backport 落后的版本）
交叉验证：同一函数 fix 是否已 backport
如果没 backport → 旁支仍可打 → 写 PoC 重放
6. 写 PoC：syzkaller harness 改造 / 直接 C PoC 触发对应 syscall
验证旁支 panic / KASAN 报 OOB
Notes
- Legal boundaries — Weaponizing N-day must be within an authorized scope (SRC / Bug Bounty / self-owned test machines / CTF). Directly attacking a production environment with a 1-day is equivalent to intrusion
- A patch may only "reduce the blast radius" — Seeing a patch does not necessarily mean it is a complete fix; it may only patch one exploitation path, and the original bug can still be triggered through other paths (one bug, many exploits)
- Do not be fooled by variable names/types — Windows patches often do cleanup / rename along the way; changes may look large but are actually irrelevant. Look at control flow and data flow, not token-level diffs
- Microsoft patches may add mitigation rather than a fix — Seeing
_guard_xfg_dispatch_icall_fptrthis kind of CFG hardening should not be treated as a fix; that is mitigation - Anonymization — When publishing writeups / PoCs, redact target machine names, internal IPs, and usernames (write
{target_ip}{username}as placeholders) - Harmless tests must run on the patched version — Do not only run on unpatched; otherwise the crash may be caused by environmental factors, not the vulnerability
- Binary diff is not omnipotent — Compiler upgrades / optimization level changes can also drastically change function layout; first compare N version with N-1 version (same compiler), do not compare across major versions
On-Demand Bootstrap
Tool dependencies
| Tool | Purpose | Auto-installable |
|---|---|---|
| BinDiff (Google, 5.x+) | Function-level binary diff, IDA/Ghidra plugin | ✓ (official .deb / .msi available) |
| Diaphora | Long-standing IDA diff plugin, requires IDA Pro | ✓ (git clone) |
| ghidriff | Ghidra headless CLI diff, outputs markdown | ✓ (pip install ghidriff) |
| DeepDiff (commercial) | New-generation diff tool, higher accuracy | ✗ (commercial license) |
| Ghidra | The runtime base for ghidriff | ✓ |
| IDA Pro | The runtime base for BinDiff / Diaphora | ✗ (commercial) |
| Microsoft Update Catalog | Download MSU/MSP patch packages | Online service |
| wsuspect-proxy | Transparently intercept Windows Update traffic to obtain patches | ✓ (git clone) |
| expand.exe / dism | Extract MSU / cab | ✓ (built into Windows) |
| rpm2cpio / dpkg-deb | Extract Linux distribution packages | ✓ |
| symchk | Pull PDBs from the Microsoft symbol server | ✓ (Windows SDK) |
Bootstrap commands
# bootstrap-reverse.ps1 is not bundled. Stop this path; prepare a separately reviewed pinned installation if requested.
For detailed tool comparisons and commands, see references/diff-tools-comparison.md.
For the detailed Patch Tuesday workflow, see references/patch-tuesday-workflow.md.
For root-cause reverse engineering and PoC templates, see references/root-cause-and-poc.md。
Routing context
Upstream entry: skills/SKILL.md(master control),routing.md
Upstream skill:
reverse-engineering/— Before doing a diff, you may first need to understand the overall structure of the target binarybinary-diff/— If the patched version has no symbols and the pre-patch version has symbols, first use binary-diff to transfer symbols over
Downstream skill:
pwn-chain/— After reverse engineering the bug class, you need to write a complete exploit (heap spray, ROP, SMEP/SMAP bypass, privilege escalation payload)pentest-tools/network-attack-defense/— Deploy N-day weaponization to the target network (package it as a deliverable payload, connect to C2)attack-chain/— chain this one N-day into a full attack chain (initial access → privilege escalation → lateral movement)
Trigger conditions: The task contains intents such as "N-day", "patch", "CVE reproduction", "find out what the patch fixed", "attack unpatched hosts", etc.
Task completion self-check (MUST pass before claiming completion)
- Did I execute only the authorized phase, and accurately distinguish static/not executed/incomplete/failed results?
- Did I use a real tool path based on
tool-index? - Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
- Did I complete and write back the Checklist items required by RULES?
Limitations
- PoC development only for vulnerabilities you are authorized to research.
- Patch diffing fails when vendors rebuild extensively between releases.
Adapted from zhaoxuya520/reverse-skill (MIT).