Skip to content

nday-patch-diffing.md

Latest commit

 

History

History
60 lines (43 loc) · 3.05 KB

nday-patch-diffing.md

File metadata and controls

60 lines (43 loc) · 3.05 KB
Raw
title N-day Analysis and Patch Diffing
type technique
tags
exploit-dev
nday
patch-diffing
bindiff
cve-research
reverse-engineering
phase exploitation
date_created 2026-06-16
date_updated 2026-06-16
sources

What it is

Turning a patched vulnerability into a working exploit by diffing the fix - the fast route to a PoC ("1-day"/"n-day") when an advisory or CVE exists but no public exploit does. Also finds silently patched bugs that never got an advisory. A common, high-yield path to a first CVE-adjacent result.

How it works

A security patch changes exactly the vulnerable code. Diffing the pre- and post-patch versions isolates that change; the fix (an added bounds check, sanitization, auth check, or length validation) tells you precisely what was wrong. You then build a trigger for the unpatched version.

Attack phases

Exploitation / research (exploit development, red-team capability, variant analysis).

Prerequisites

  • The pre-patch and post-patch artifacts: two source tags/releases, two vendor binaries, or two package versions. For binary diffing, a disassembler with a diff plugin.

Methodology

1. Acquire both versions

Git tags around the fix, GitHub release assets, distro package archives (.deb/.rpm), or vendor installers for vulnerable + fixed builds.

2. Source diff (if source is available)

git log --oneline <fixtag>~5..<fixtag>      # find the security commit (often vague messages)
git diff <vulntag> <fixtag> -- path/to/suspect/

Read the changed function: a new if (len > MAX), an added escape(), a new permission check = the bug it fixes.

3. Binary diff (no source)

  • BinDiff or Diaphora (with IDA), Ghidra Version Tracking / BSim, or diffoscope for packages.
  • Import the two binaries, match functions, and open the ones flagged changed but not just recompiled - the patched function is your target.

4. Root-cause from the diff

What the patch adds reveals what was missing. Trace the now-checked value back to attacker input.

5. Build the trigger + confirm

Craft an input that hits the pre-patch (unchecked) path; reproduce the crash/leak/bypass on the vulnerable build. Confirm reachability in a realistic configuration.

6. Variant analysis

The same flawed pattern often exists elsewhere the patch did not touch - grep / [[codeql]] for siblings (a route to a genuinely new CVE rather than just an n-day).

Bypasses and variants

  • Silent patches: vendor fixes without an advisory - diff consecutive releases to surface undisclosed security fixes.
  • Incomplete patches: the fix misses an edge case - bypass it for a fresh CVE.

Detection and defence

Ship patches promptly, write clear advisories, and harden the whole bug class (not just the reported instance) to deny variant analysis.

Tools

BinDiff, Diaphora, [[ghidra]] (Version Tracking), diffoscope, git. Drives PoC dev: [[binary-exploitation]], [[reverse-engineering]]; confirm reach with [[fuzzing]] / [[codeql]]. Driven by the nday skill; feeds the research skill.

Sources