Nday

---
name: nday
description: N-day / patch-diff workflow - given a CVE/advisory or a suspicious patch, diff pre- vs post-patch to locate the fixed bug, build a PoC for the unpatched version, and run variant analysis for a fresh bug. Triggers - "n-day", "patch diff", "diff the patch", "bindiff".
---

# N-day / Patch Diffing

Turn a patched vulnerability into a working PoC, or surface a silently-patched bug. Read [[nday-patch-diffing]] first.

## Procedure
1. **Acquire both versions** - vulnerable + fixed: git tags, release assets, distro packages, or vendor binaries.
2. **Diff:**
   - source: `git log <fixtag>~5..<fixtag>` then `git diff <vulntag> <fixtag>` over the suspect path; read the changed function.
   - binary: BinDiff / Diaphora / [[ghidra]] Version Tracking; open functions flagged changed (not just recompiled).
3. **Root-cause from the diff** - what the patch *adds* (bounds/auth/sanitization check) reveals what was missing; trace the now-checked value back to attacker input.
4. **Build the trigger** - craft input that reaches the pre-patch unchecked path; reproduce on the vulnerable build; confirm **reachability** in a realistic config.
5. **Variant analysis** - grep / [[codeql]] for the same flawed pattern the patch did not touch -> potential **new** CVE (then hand off to the `disclosure` skill).

## Output
- PoC/trigger in `raw/research/<project>/poc/` and the bug recorded in `findings.md` (mark `n-day CVE-xxxx` or `candidate` if a new variant).
- Note affected/fixed versions and the exact patch commit.

## Wiki feedback
Reusable diffing trick or a found variant pattern -> update [[nday-patch-diffing]] (or the matching technique page via `research-ingest`).

Report: target patch, located bug, PoC status, any variant found.