Patched binary (after)         Unpatched binary (before)
        ↓                                  ↓
    Import into IDA/Ghidra              Import into IDA/Ghidra
        ↓                                  ↓
        └──────── BinDiff / ghidriff ──────┘
                        ↓
        Function-level diff (matched / unmatched / changed)
                        ↓
        Focus on functions with medium match scores (0.5 - 0.9)
                        ↓
        Check what's added: boundary checks / locks / field zeroing / integer overflow checks
                        ↓
        Reverse-engineer bug class: OOB / Race / Info Leak / UAF / Integer Overflow
                        ↓
        Write PoC to trigger on unpatched version
                        ↓
        Verification: unpatched crashes / patched does not crash → vulnerability confirmed

Step 1: Obtain before / after binaries
  - Windows: Download MSU/MSP from Microsoft Update Catalog, unpack with expand.exe / dism
  - Linux: Pull .deb/.rpm from distribution USN/RHSA, unpack with dpkg-deb / rpm2cpio
  - Third-party software: Get N-1 and N version installers from official website

Step 2: Align symbols
  - Use PDB directly if available; if no PDB, use binary-diff skill to migrate symbols from N-1 version to N version
  - Linux kernel: Get corresponding version's vmlinux + System.map / debuginfo

Step 3: Binary diff
  - BinDiff: Feed two IDBs directly, check function-level matching results
  - ghidriff: One-click installation via pip, output markdown report via CLI
  - Diaphora: In-IDA plugin, established but requires IDA Pro

Step 4: Locate changes
  - Filter functions with match score 0.5-0.95 (ignore completely identical ones, completely different ones are mostly new/renamed)
  - Focus on: newly added if statements / new loop boundaries / deleted code blocks (what's deleted is also a clue)
  - Use LLM to reverse-engineer bug class from before/after pseudocode (see references/root-cause-and-poc.md)

Step 5: Write PoC
  - Integer Overflow: Construct boundary values (INT_MAX-1, 0xFFFFFFFF)
  - Race Condition: Multi-thread hammering, high-frequency concurrency of open/close + ioctl
  - UAF: spray → free → reuse pattern
  - OOB: Precisely control len / index to cross boundaries
  - Verification: Patched version no longer crashes, unpatched version stably crashes → bug reproduction successful

Download patch → unpack → load into IDA/Ghidra → BinDiff/ghidriff → check unmatched/low-match functions
       → LLM reverse-engineer bug class → write PoC → run on unpatched → crash → complete

Background: November 2025 Patch Tuesday, MSRC announces CVE-2025-62215
      Windows Kernel race condition leads to double free, CVSS 7.0, local privilege escalation
      Microsoft only released patches, no details, no public PoC

Goal: Reproduce PoC, verify that unpatched Windows 11 22H2 / 23H2 can be escalated

Steps:
1. Search "2025-11" + KB number in Microsoft Update Catalog, download two versions:
   - 22H2 build 22621.xxxx (unpatched)
   - 22H2 build 22621.yyyy (patched)
   Commands:
     expand.exe Windows-KB5052000-x64.msu -F:* C:\out\patched\
     expand.exe C:\out\patched\Windows-KB5052000-x64.cab -F:* C:\out\patched\
   Extract ntoskrnl.exe / win32k.sys / win32kfull.sys / afd.sys

2. Load PDBs for both versions (Microsoft Symbol Server):
     symchk /v /r ntoskrnl.exe /s SRV*C:\sym*https://msdl.microsoft.com/download/symbols

3. Run BinDiff:
     bindiff old.BinExport new.BinExport
   Or ghidriff:
     ghidriff ntoskrnl_old.exe ntoskrnl_new.exe -o diff_out/

4. Check report, filter functions with similarity 0.6-0.95.
   Assume a NtXxxIoctl-like function is located with added code:
     KeAcquireSpinLockRaiseToDpc(&obj->Lock);
     if (obj->RefCount == 0) { ... goto cleanup; }
   → Added lock + reference count check → race + double free, matching announcement description

5. Write PoC: User-mode multi-threads simultaneously call NtClose + trigger IOCTL on the same object,
   create a race window between close release and IOCTL still in use
   Crash occurs in ntoskrnl's ObfDereferenceObject subsequent free path

6. Verification:
   - Run PoC on unpatched 22621.xxxx, BSOD (BAD_POOL_HEADER or DOUBLE_FREE) within ~30 seconds
   - Run same PoC on patched 22621.yyyy, no exceptions
   → Reproduction successful

Background: Mainline 6.x has fixed an OOB write in a net subsystem
      Ubuntu 22.04 (5.15 LTS) USN has released updates
      But some OEM kernels / Azure kernels have slower backport节奏
      Want to confirm if unpatched branches are still exploitable

Goal: Obtain patched/unpatched kernels, identify binary changes corresponding to fix commits,
      rewrite PoC on unpatched branches

Steps:
1. Pull patched and unpatched packages:
     apt download linux-image-5.15.0-101-generic   # patched
     apt download linux-image-5.15.0-100-generic   # unpatched
     dpkg-deb -x linux-image-5.15.0-101-generic_*.deb ./patched/
     dpkg-deb -x linux-image-5.15.0-100-generic_*.deb ./unpatched/
   Extract boot/vmlinuz → restore ELF with extract-vmlinux

2. Synchronously get dbgsym:
     apt download linux-image-unsigned-5.15.0-101-generic-dbgsym

3. Use ghidriff (Linux-friendly):
     ghidriff vmlinux_5.15.0-100 vmlinux_5.15.0-101 \
              -o /tmp/kdiff/ --max-section-funcs-analyze 8000

4. Search changed functions in subsystems like net/ipv4/ net/ipv6/ net/sched/ in the report
   Found that skb->len upper limit check was missing before skb_copy_bits call in pre-patch version
   → OOB read, may be upgraded to OOB write with triggerable sysctl

5. Cross-verify on unpatched branches (e.g., Azure 5.15.0-1080 with delayed backport)
   Check if the same function fix has been backported
   If not backported → branch is still exploitable → rewrite and replay PoC

6. Write PoC: Modify syzkaller harness / directly write C PoC to trigger corresponding syscall
   Verify branch panic / KASAN reports OOB

powershell -NoProfile -ExecutionPolicy Bypass -File "<SKILL_ROOT>\skills\scripts\bootstrap-reverse.ps1" -Capability @('bindiff','ghidriff','ghidra','wsuspect-proxy') -StartServices