N-day / Patch Diffing

Turn a patched vulnerability into a working PoC, or surface a silently-patched bug. Read [[nday-patch-diffing]] first.

Procedure

1. Acquire both versions - vulnerable + fixed: git tags, release assets, distro packages, or vendor binaries.
2. Diff:
   • source: git log <fixtag>~5..<fixtag> then git diff <vulntag> <fixtag> over the suspect path; read the changed function.
   • binary: BinDiff / Diaphora / [[ghidra]] Version Tracking; open functions flagged changed (not just recompiled).
3. Root-cause from the diff - what the patch adds (bounds/auth/sanitization check) reveals what was missing; trace the now-checked value back to attacker input.
4. Build the trigger - craft input that reaches the pre-patch unchecked path; reproduce on the vulnerable build; confirm reachability in a realistic config.
5. Variant analysis - grep / [[codeql]] for the same flawed pattern the patch did not touch -> potential new CVE (then hand off to the disclosure skill).

Output

• PoC/trigger in raw/research/<project>/poc/ and the bug recorded in findings.md (mark n-day CVE-xxxx or candidate if a new variant).
• Note affected/fixed versions and the exact patch commit.

Wiki feedback

Reusable diffing trick or a found variant pattern -> update [[nday-patch-diffing]] (or the matching technique page via research-ingest).

Report: target patch, located bug, PoC status, any variant found.