| name | nday |
| description | N-day / patch-diff workflow - given a CVE/advisory or a suspicious patch, diff pre- vs post-patch to locate the fixed bug, build a PoC for the unpatched version, and run variant analysis for a fresh bug. Triggers - "n-day", "patch diff", "diff the patch", "bindiff". |
N-day / Patch Diffing
Turn a patched vulnerability into a working PoC, or surface a silently-patched bug. Read [[nday-patch-diffing]] first.
Procedure
- Acquire both versions - vulnerable + fixed: git tags, release assets, distro packages, or vendor binaries.
- Diff:
- source:
git log <fixtag>~5..<fixtag> then git diff <vulntag> <fixtag> over the suspect path; read the changed function.
- binary: BinDiff / Diaphora / [[ghidra]] Version Tracking; open functions flagged changed (not just recompiled).
- Root-cause from the diff - what the patch adds (bounds/auth/sanitization check) reveals what was missing; trace the now-checked value back to attacker input.
- Build the trigger - craft input that reaches the pre-patch unchecked path; reproduce on the vulnerable build; confirm reachability in a realistic config.
- Variant analysis - grep / [[codeql]] for the same flawed pattern the patch did not touch -> potential new CVE (then hand off to the
disclosure skill).
Output
- PoC/trigger in
raw/research/<project>/poc/ and the bug recorded in findings.md (mark n-day CVE-xxxx or candidate if a new variant).
- Note affected/fixed versions and the exact patch commit.
Wiki feedback
Reusable diffing trick or a found variant pattern -> update [[nday-patch-diffing]] (or the matching technique page via research-ingest).
Report: target patch, located bug, PoC status, any variant found.
