Patch Diff Exploit

---
name: patch-diff-exploit
description: |
  N-day patch diff to exploit. Reverse-engineer vulnerability points from vendor-published patches, write PoC, create usable attack modules.
  Applicable scenarios: known CVE number but only patch no PoC, SRC/red team needs to strike assets not updated in time, N-day weaponization, Patch Tuesday tracking.
  Core method: get before/after binaries → align symbols → binary diff → look at new security checks to reverse-engineer bug class → write PoC to trigger vulnerability.
  Trigger keywords: N-day, Nday, patch diff, patch tuesday, 1day, binary diff vulnerability, bindiff exploit, ghidriff, Diaphora, patch analysis, CVE reproduction, vulnerability restoration, patch reverse engineering, N-day weaponization.
---

## ACTION REQUIRED (execute immediately after reading)

2. `NOW`: Confirm the current task matches this skill's scope
4. `NEXT`: When tools are missing, call bootstrap — do not guess paths
5. `ACT`: Enter the first step of the "Workflow" and execute — do not stop at confirmation state

# N-day Patch Diff to Exploit (Patch Diff Exploit)

## Scope

Use this skill when the task falls into these scenarios:

1. **Known CVE but no public PoC** — vendor advisory says "fixed XX component's out-of-bounds write" but no PoC released, need to reverse-engineer from patch
2. **SRC / red team striking N-day** — target assets not updated in time, need to turn just-released patch into usable 1-day exploit
3. **Patch Tuesday tracking** — Microsoft releases patches on second Tuesday each month, need to quickly lock onto high-value vulnerabilities (Kernel / Win32k / AFD / CLFS)
4. **Linux LTS patch analysis** — mainline fix merged, but branch or distro backport is incomplete, find unpatched surface
5. **Driver / service security patch restoration** — graphics driver, AV engine, virtualization component and other closed-source software patch analysis

### Division of labor with other skills

| Scenario | Use which |
|----------|-----------|
| Have old version symbols, migrate to new version for analysis | `binary-diff/` |
| **Find vulnerability from patch, write PoC to strike pre-patch version** | **This skill** |
| Write complete exploit chain (heap spray, ROP, privesc) | `pwn-chain/` |
| Deploy 1-day weaponization to target network | `pentest-tools/network-attack-defense/` |
| Reverse engineer a binary from scratch | `ida-reverse/` / `radare2/` |

Key distinction: `binary-diff`'s goal is to **make new version analyzable** (migrate old symbols), this skill's goal is to **find what bug the patch fixed then exploit the pre-patch version**. The former serves defense-side/research-side analysis, the latter serves offense-side weaponization.

## Core principle

```text
patched binary (after)         unpatched binary (before)
        ↓                              ↓
    Import to IDA/Ghidra          Import to IDA/Ghidra
        ↓                              ↓
        └──────── BinDiff / ghidriff ──┘
                        ↓
        Function-level diff (matched / unmatched / changed)
                        ↓
        Focus on functions with medium match score (0.5 - 0.9)
                        ↓
        Look at what was added: bounds check / lock / field zeroing / integer overflow check
                        ↓
        Reverse-engineer bug class: OOB / Race / Info Leak / UAF / Integer Overflow
                        ↓
        Write PoC on unpatched version to trigger
                        ↓
        Verify: unpatched crashes / patched doesn't crash → vulnerability confirmed
```

Patch fix pattern → vulnerability type reverse lookup:

| Added content | Most likely bug class |
|---------------|----------------------|
| `if (a + b < a)` / `__builtin_add_overflow` | Integer overflow |
| `KeAcquireSpinLock` / `mutex_lock` | Race condition (TOCTOU / double-free) |
| `if (idx >= MAX)` / `if (len > buf_size)` | Out-of-bounds read / write |
| `RtlZeroMemory` / `memset(struct, 0, ...)` | Uninitialized memory info leak |
| `InterlockedDecrement` + refcount check | UAF / reference count error |
| `ProbeForRead` / `ProbeForWrite` | User-mode pointer not validated |
| `SeAccessCheck` / capability check | Missing permission check |
| Removed / tightened `IOCTL` code | Attack surface reduction (look at old interface) |

## Workflow

### 5-step complete flow

```text
Step 1: Get before / after binaries
  - Windows: Microsoft Update Catalog download MSU/MSP, use expand.exe / dism to unpack
  - Linux: Pull .deb/.rpm from distro USN/RHSA, use dpkg-deb / rpm2cpio to unpack
  - Third-party software: Get N-1 and N version installers from official site

Step 2: Align symbols
  - With PDB just consume, without PDB use binary-diff skill to migrate N-1 version symbols to N version
  - Linux kernel get corresponding version vmlinux + System.map / debuginfo

Step 3: Binary diff
  - BinDiff: give two IDBs directly, see function-level match results
  - ghidriff: pip one-click install, CLI outputs markdown report
  - Diaphora: IDA plugin, established but requires IDA Pro

Step 4: Locate changes
  - Filter functions with match score 0.5-0.95 (completely identical don't look, completely different are likely new/renamed)
  - Focus on: newly added if / new loop bounds / deleted code blocks (deletions are also clues)
  - Use LLM to look at before/after pseudocode to reverse-engineer bug class (see references/root-cause-and-poc.md)

Step 5: Write PoC
  - Integer overflow: construct boundary values (INT_MAX-1, 0xFFFFFFFF)
  - Race: multi-thread hammer, open/close + ioctl high-frequency concurrent
  - UAF: spray → free → reuse pattern
  - OOB: precisely control len / index to cross boundary
  - Verify patched version no longer crashes, unpatched version stably crashes → bug reproduced
```

### Tool invocation order

```text
Download patch → unpack → load to IDA/Ghidra → BinDiff/ghidriff → look at unmatched/low-match functions
       → LLM reverse-engineer bug class → write PoC → run on unpatched → crash → done
```

## Typical scenario examples

### Scenario 1: Windows Patch Tuesday — Kernel CVE reproduction

```text
Background: November 2025 Patch Tuesday, MSRC advisory CVE-2025-62215
      Windows Kernel race condition causing double free, CVSS 7.0, local privilege escalation
      Microsoft only released patch, no details, no public PoC

Goal: Reproduce PoC, verify unpatched Windows 11 22H2 / 23H2 can be privilege-escalated

Steps:
1. Microsoft Update Catalog search "2025-11" + KB number, download two versions:
   - 22H2 build 22621.xxxx (unpatched)
   - 22H2 build 22621.yyyy (after patch)
   Commands:
     expand.exe Windows-KB5052000-x64.msu -F:* C:\out\patched\
     expand.exe C:\out\patched\Windows-KB5052000-x64.cab -F:* C:\out\patched\
   Extract ntoskrnl.exe / win32k.sys / win32kfull.sys / afd.sys

2. Both versions load PDB (Microsoft symbol server):
     symchk /v /r ntoskrnl.exe /s SRV*C:\sym*https://msdl.microsoft.com/download/symbols

3. Run BinDiff:
     bindiff old.BinExport new.BinExport
   Or ghidriff:
     ghidriff ntoskrnl_old.exe ntoskrnl_new.exe -o diff_out/

4. Review report, filter functions with similarity 0.6-0.95.
   Suppose locate NtXxxIoctl-type function with newly added section:
     KeAcquireSpinLockRaiseToDpc(&obj->Lock);
     if (obj->RefCount == 0) { ... goto cleanup; }
   → Added lock + refcount check → race + double free, matches advisory description

5. Write PoC: user-mode multi-thread simultaneously calling NtClose + triggering same object IOCTL,
   create race window between close release and IOCTL still using
   Crashes in ntoskrnl ObfDereferenceObject subsequent free path

6. Verify:
   - Run PoC on unpatched 22621.xxxx, BSOD within ~30s (BAD_POOL_HEADER or DOUBLE_FREE)
   - Run same PoC on patched 22621.yyyy, no anomaly
   → Reproduction successful
```

### Scenario 2: Linux kernel LTS branch patch finding unpatched branches

```text
Background: Mainline 6.x fixed a net subsystem OOB write
      Ubuntu 22.04 (5.15 LTS) USN has released update
      But some OEM kernel / Azure kernel backport pace is slower
      Want to confirm if unupdated branches can still be exploited

Goal: Get patched/unpatched kernels, diff out binary changes corresponding to fix commit,
      rewrite PoC on unpatched branch

Steps:
1. Pull patched and unpatched packages:
     apt download linux-image-5.15.0-101-generic   # patched
     apt download linux-image-5.15.0-100-generic   # unpatched
     dpkg-deb -x linux-image-5.15.0-101-generic_*.deb ./patched/
     dpkg-deb -x linux-image-5.15.0-100-generic_*.deb ./unpatched/
   Extract boot/vmlinuz → use extract-vmlinux to restore ELF

2. Sync get dbgsym:
     apt download linux-image-unsigned-5.15.0-101-generic-dbgsym

3. Use ghidriff (Linux friendly):
     ghidriff vmlinux_5.15.0-100 vmlinux_5.15.0-101 \
              -o /tmp/kdiff/ --max-section-funcs-analyze 8000

4. Search report for net/ipv4/ net/ipv6/ net/sched/ etc subsystem changed functions
   Find pre-patch skb_copy_bits call missing skb->len upper bound check
   → OOB read, may be combined with triggerable sysctl to escalate to OOB write

5. On unpatched branch (e.g. Azure 5.15.0-1080 backport lagging version)
   Cross-verify: has same function fix been backported
   If not backported → branch still exploitable → write PoC replay

6. Write PoC: syzkaller harness modification / direct C PoC triggering corresponding syscall
   Verify branch panic / KASAN reports OOB
```

## Notes

- **Legal boundary** — weaponizing N-day must be within authorized scope (SRC / Bug Bounty / own lab / CTF). Striking production environment directly with 1-day is equivalent to intrusion
- **Patch may only "reduce blast radius"** — seeing a patch doesn't necessarily mean complete fix, it may only patch one exploitation path, original bug may still be triggerable via other paths (multiple exploitation from one bug)
- **Don't be fooled by variable names/types** — Windows patches often do cleanup/rename alongside, looks like big change but actually irrelevant. Look at control flow and data flow, not token-level diff
- **Microsoft patches may add mitigation not fix** — seeing `_guard_xfg_dispatch_icall_fptr` type CFG hardening don't treat as fix, that's mitigation
- **Anonymization** — when publishing writeup/PoC, redact target machine names, internal IPs, usernames (use `{target_ip}` `{username}` placeholders)
- **Patched version must pass harmless test** — don't only run on unpatched, otherwise crash may be environment factor, not vulnerability
- **Binary diff is not omnipotent** — compiler upgrade / optimization level changes also cause function layout to change significantly, first compare N version with N-1 version (same compiler), don't cross major versions

---

## On-Demand Bootstrap

### Tool dependencies

| Tool | Purpose | Auto-installable |
|------|---------|:-:|
| BinDiff (Google, 5.x+) | Function-level binary diff, IDA/Ghidra plugin | Yes (official .deb / .msi) |
| Diaphora | IDA established diff plugin, requires IDA Pro | Yes (git clone) |
| ghidriff | Ghidra headless CLI diff, outputs markdown | Yes (pip install ghidriff) |
| DeepDiff (commercial) | Next-gen diff tool, higher accuracy | No (commercial license) |
| Ghidra | ghidriff runtime base | Yes |
| IDA Pro | BinDiff / Diaphora runtime base | No (commercial) |
| Microsoft Update Catalog | Download MSU/MSP patch packages | Online service |
| wsuspect-proxy | Transparent intercept Windows Update traffic to get patches | Yes (git clone) |
| expand.exe / dism | Unpack MSU / cab | Yes (Windows built-in) |
| rpm2cpio / dpkg-deb | Unpack Linux distro packages | Yes |
| symchk | Pull PDB from Microsoft symbol server | Yes (Windows SDK) |

### Bootstrap command

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File "<SKILL_ROOT>\skills\scripts\bootstrap-reverse.ps1" -Capability @('bindiff','ghidriff','ghidra','wsuspect-proxy') -StartServices
```

Detailed tool comparison and commands see `references/diff-tools-comparison.md`.
Detailed Patch Tuesday workflow see `references/patch-tuesday-workflow.md`.
Root cause reverse engineering and PoC template see `references/root-cause-and-poc.md`.

---

## Routing context

**Upstream entry**: `skills/SKILL.md` (master control), `routing.md`

**Upstream skills:**
- `reverse-engineering/` — may need to understand target binary's overall structure before diffing
- `binary-diff/` — if post-patch version has no symbols, pre-patch has symbols, use binary-diff to migrate symbols first

**Downstream skills:**
- `pwn-chain/` — after reverse-engineering bug class, need to write complete exploit (heap spray, ROP, SMEB/SMAP bypass, privesc payload)
- `pentest-tools/network-attack-defense/` — deploy N-day weaponization to target network (package as deliverable payload, connect to C2)
- `attack-chain/` — chain this N-day into complete attack chain (initial access → privesc → lateral)

**Trigger condition**: task contains "N-day", "patch", "CVE reproduction", "find what patch fixed", "strike unupdated host" etc intent

## Task completion self-check (MUST pass before claiming done)

- [ ] Did I execute every step in the workflow (not just read)?
- [ ] Did I use real tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/scripts/screenshots/report)?
- [ ] Did I complete and write back the Checklist items required by RULES?