[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F9XFEER4AEMEMWXCY5GYPC":3,"skill-same:01M6F9XFEER4AEMEMWXCY5GYPC":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":27,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":59,"install":60,"resources":73},"01M6F9XFEER4AEMEMWXCY5GYPC","patch-diff-exploit",null,"Locate vulnerability fixes in vendor patches, diff binaries across versions, and build N-day PoCs. Attack-side complement to binary-diff for authorized research.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-patch-diff-exploit\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"diff","exploit","patch","patch diff exploit","main","2026","blob","fixes","for","reverse","locate","offensive","binary","across","github","community","build","vendor","vulnerability","https","license","research","2026-11-10 10:12:30",false,"---\nname: patch-diff-exploit\ndescription: \"Locate vulnerability fixes in vendor patches, diff binaries across versions, and build N-day PoCs. Attack-side complement to binary-diff for authorized research.\"\nrisk: offensive\nsource: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\"\nsource_repo: \"zhaoxuya520\u002Freverse-skill\"\nsource_type: community\ndate_added: \"2026-08-25\"\nlicense: \"MIT\"\nlicense_source: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE\"\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## When to Use\n\n- Turning a vendor security advisory into a concrete vulnerable-function location.\n- Building a proof-of-concept for a patched vulnerability in authorized research.\n\n## 适用范围\n\n当任务属于以下场景时使用本 skill：\n\n1. **已知 CVE 但无公开 PoC** — 厂商公告写了\"修复了 XX 组件的越界写\"但没放 PoC，需要从补丁反推\n2. **SRC \u002F 红队打 N-day** — 目标资产未及时更新，需要把刚发布的补丁差成可用的 1-day 利用\n3. **Patch Tuesday 跟进** — 每月第二个周二微软放补丁，需要快速锁定高价值漏洞（Kernel \u002F Win32k \u002F AFD \u002F CLFS）\n4. **Linux LTS 补丁分析** — 主线 fix 已合并，但旁支或某发行版 backport 不全，找未修补面\n5. **驱动 \u002F 服务的安全补丁还原** — 显卡驱动、AV 引擎、虚拟化组件等闭源软件的补丁分析\n\n### 与其他 skill 的分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 有旧版符号，迁移到新版本帮助分析 | `binary-diff\u002F` |\n| **从补丁找漏洞、写 PoC 打补丁前版本** | **本 skill** |\n| 写出完整利用链（堆喷、ROP、提权） | `pwn-chain\u002F` |\n| 把 1-day 武器化部署到目标网络 | `pentest-tools\u002Fnetwork-attack-defense\u002F` |\n| 从零逆向一个二进制 | `ida-reverse\u002F` \u002F `radare2\u002F` |\n\n差别的关键：`binary-diff` 的目标是**让新版可分析**（把旧符号搬过来），本 skill 的目标是**找出补丁修了什么 bug 然后打补丁前的版本**。前者服务防御侧 \u002F 研究侧分析，后者服务攻击侧武器化。\n\n## 研究与执行边界\n\n默认在授权离线样本上静态分析。记录补丁前后来源\u002F签名\u002FSHA256、精确构建\u002F架构\u002F组件和符号 GUID\u002Fage；N-1 不自动等于易受攻击，backport 和功能开关须验证。匹配分数是排序线索，不是正确性\u002F漏洞置信度；已匹配\u002F未匹配\u002F高相似函数都可能包含关键修复。\n\n动态崩溃\u002F竞争\u002F提权测试只在可销毁隔离 VM，设置次数\u002F时长\u002F资源限制与快照恢复，禁止生产网络武器化\u002F持久化\u002FC2 或扩大目标。patched 不崩与 unpatched 崩只能支持有限差异，需要同条件重复、sanitizer\u002Fdebugger根因和对照才能归因。缺失工具、脚本、RULES\u002Ftool-index 不得假装已提供；不自动安装或启动服务。公开 PoC\u002F外发二进制是另一个需授权的操作。\n\n## 核心原理\n\n```text\npatched 二进制 (after)         unpatched 二进制 (before)\n        ↓                                  ↓\n    导入 IDA\u002FGhidra              导入 IDA\u002FGhidra\n        ↓                                  ↓\n        └──────── BinDiff \u002F ghidriff ──────┘\n                        ↓\n        函数级 diff（matched \u002F unmatched \u002F changed）\n                        ↓\n        聚焦 match score 中等的函数（0.5 - 0.9）\n                        ↓\n        看新增了什么：边界检查 \u002F 锁 \u002F 字段清零 \u002F 整数溢出检查\n                        ↓\n        反推 bug class：OOB \u002F Race \u002F Info Leak \u002F UAF \u002F Integer Overflow\n                        ↓\n        在 unpatched 版本上写 PoC 触发\n                        ↓\n        验证：unpatched 崩 \u002F patched 不崩 → 漏洞确认\n```\n\n补丁修复模式 → 漏洞类型反查：\n\n| 新增内容 | 大概率的 bug class |\n|---------|------------------|\n| `if (a + b \u003C a)` \u002F `__builtin_add_overflow` | 整数溢出 |\n| `KeAcquireSpinLock` \u002F `mutex_lock` | 竞争条件 (TOCTOU \u002F double-free) |\n| `if (idx >= MAX)` \u002F `if (len > buf_size)` | 越界读 \u002F 越界写 |\n| `RtlZeroMemory` \u002F `memset(struct, 0, ...)` | 未初始化内存信息泄漏 |\n| `InterlockedDecrement` + refcount 检查 | UAF \u002F 引用计数错误 |\n| `ProbeForRead` \u002F `ProbeForWrite` | 用户态指针未校验 |\n| `SeAccessCheck` \u002F capability 校验 | 权限校验缺失 |\n| 删除 \u002F 收紧 `IOCTL` code | 暴露面收敛（看老接口怎么打） |\n\n## 工作流\n\n### 5 步完整流程\n\n```text\nStep 1: 拿 before \u002F after 二进制\n  - Windows: Microsoft Update Catalog 下 MSU\u002FMSP，用 expand.exe \u002F dism 解包\n  - Linux: 从发行版 USN\u002FRHSA 拉 .deb\u002F.rpm，用 dpkg-deb \u002F rpm2cpio 解包\n  - 第三方软件: 官网取 N-1 和 N 版本安装包\n\nStep 2: 对齐符号\n  - 有 PDB 直接吃，没 PDB 时用 binary-diff skill 把 N-1 版本的符号搬到 N 版本\n  - Linux 内核取对应版本的 vmlinux + System.map \u002F debuginfo\n\nStep 3: 二进制 diff\n  - BinDiff: 直接给两个 IDB，看函数级匹配结果\n  - ghidriff: pip 一键安装，CLI 输出 markdown 报告\n  - Diaphora: IDA 内插件，老牌但需要 IDA Pro\n\nStep 4: 定位变更\n  - 过滤 match score 0.5-0.95 的函数（完全相同的不看，完全不同的多半是新加 \u002F 重命名）\n  - 重点看：新增的 if \u002F 新增的循环边界 \u002F 删除的代码块（删了什么也是线索）\n  - 用 LLM 看 before\u002Fafter 伪代码反推 bug class（见 references\u002Froot-cause-and-poc.md）\n\nStep 5: 写 PoC\n  - 整数溢出：构造边界值（INT_MAX-1、0xFFFFFFFF）\n  - 竞争：多线程 hammer，open\u002Fclose + ioctl 高频并发\n  - UAF：spray → free → reuse pattern\n  - OOB：精确控制 len \u002F index 越过边界\n  - 验证 patched 版本不再崩，unpatched 版本稳定崩 → bug 复现成功\n```\n\n### 工具调用顺序\n\n```text\n下补丁 → 解包 → 加载到 IDA\u002FGhidra → BinDiff\u002Fghidriff → 看 unmatched\u002Flow-match 函数\n       → LLM 反推 bug class → 写 PoC → 在 unpatched 跑 → 崩 → 收工\n```\n\n## 典型场景示例\n\n### 场景 1：Windows Patch Tuesday — 假设性分析示例\n\n下面 CVE\u002FKB\u002Fbuild\u002F函数\u002F崩溃时间未在此审查中核实，不是实际漏洞定位或复现结果；按厂商证据替换后使用。\n\n```text\n背景：2025 年 11 月 Patch Tuesday，MSRC 公告 CVE-2025-62215\n      Windows Kernel race condition 导致 double free，CVSS 7.0，本地提权\n      微软只放了补丁，没放细节，没有公开 PoC\n\n目标：复现 PoC，验证未打补丁的 Windows 11 22H2 \u002F 23H2 可提权\n\n步骤：\n1. Microsoft Update Catalog 搜 \"2025-11\" + KB 号，下两个版本：\n   - 22H2 build 22621.xxxx (unpatched)\n   - 22H2 build 22621.yyyy (patched 后)\n   命令:\n     expand.exe Windows-KB5052000-x64.msu -F:* C:\\out\\patched\\\n     expand.exe C:\\out\\patched\\Windows-KB5052000-x64.cab -F:* C:\\out\\patched\\\n   提取 ntoskrnl.exe \u002F win32k.sys \u002F win32kfull.sys \u002F afd.sys\n\n2. 两个版本都吃 PDB (微软符号服务器):\n     symchk \u002Fv \u002Fr ntoskrnl.exe \u002Fs SRV*C:\\sym*https:\u002F\u002Fmsdl.microsoft.com\u002Fdownload\u002Fsymbols\n\n3. 跑 BinDiff:\n     bindiff old.BinExport new.BinExport\n   或 ghidriff:\n     ghidriff ntoskrnl_old.exe ntoskrnl_new.exe -o diff_out\u002F\n\n4. 看报告，过滤 similarity 0.6-0.95 的函数。\n   假设定位到 NtXxxIoctl 类函数新增了一段:\n     KeAcquireSpinLockRaiseToDpc(&obj->Lock);\n     if (obj->RefCount == 0) { ... goto cleanup; }\n   → 新增了锁 + 引用计数检查 → race + double free，符合公告描述\n\n5. 写 PoC：用户态多线程同时调 NtClose + 触发同一对象的 IOCTL，\n   制造 close 释放与 IOCTL 还在用之间的竞争窗口\n   崩在 ntoskrnl 的 ObfDereferenceObject 后续 free 路径上\n\n6. 验证：\n   - unpatched 22621.xxxx 上跑 PoC，~30 秒内 BSOD (BAD_POOL_HEADER 或 DOUBLE_FREE)\n   - patched 22621.yyyy 上跑同 PoC，无任何异常\n   → 复现成功\n```\n\n### 场景 2：Linux 内核 LTS 分支补丁找未修的旁支\n\n```text\n背景：主线 6.x 已修某 net subsystem 的 OOB 写\n      Ubuntu 22.04 (5.15 LTS) 的 USN 已发布更新\n      但某些 OEM kernel \u002F Azure kernel 的 backport 节奏更慢\n      想确认未更新的旁支是否仍可打\n\n目标：取 patched\u002Funpatched 内核，差出 fix commit 对应的二进制变更，\n      在 unpatched 旁支上重写 PoC\n\n步骤：\n1. 拉 patched 与 unpatched 包:\n     apt download linux-image-5.15.0-101-generic   # patched\n     apt download linux-image-5.15.0-100-generic   # unpatched\n     dpkg-deb -x linux-image-5.15.0-101-generic_*.deb .\u002Fpatched\u002F\n     dpkg-deb -x linux-image-5.15.0-100-generic_*.deb .\u002Funpatched\u002F\n   提取 boot\u002Fvmlinuz → 用 extract-vmlinux 还原 ELF\n\n2. 同步取 dbgsym:\n     apt download linux-image-unsigned-5.15.0-101-generic-dbgsym\n\n3. 用 ghidriff (Linux 友好):\n     ghidriff vmlinux_5.15.0-100 vmlinux_5.15.0-101 \\\n              -o \u002Ftmp\u002Fkdiff\u002F --max-section-funcs-analyze 8000\n\n4. 报告里搜 net\u002Fipv4\u002F net\u002Fipv6\u002F net\u002Fsched\u002F 等子系统的 changed 函数\n   找到补丁前 skb_copy_bits 调用前缺少 skb->len 上限校验\n   → OOB read，可能配合可触发的 sysctl 升级到 OOB write\n\n5. 在 unpatched 旁支（例如 Azure 5.15.0-1080 backport 落后的版本）\n   交叉验证：同一函数 fix 是否已 backport\n   如果没 backport → 旁支仍可打 → 写 PoC 重放\n\n6. 写 PoC：syzkaller harness 改造 \u002F 直接 C PoC 触发对应 syscall\n   验证旁支 panic \u002F KASAN 报 OOB\n```\n\n## 注意事项\n\n- **法律边界** — 武器化 N-day 必须在授权范围内（SRC \u002F Bug Bounty \u002F 自有靶机 \u002F CTF）。对生产环境直接打 1-day 等同入侵\n- **补丁可能只是\"减小爆炸半径\"** — 看到 patch 不一定就是完整修复，有可能只是补一个利用路径，原始 bug 仍可从别的路径触发（一鱼多吃）\n- **变量名\u002F类型不要被欺骗** — Windows 补丁经常顺手做 cleanup \u002F rename，看似变更很大但实际无关。要看控制流和数据流，不要看 token 级 diff\n- **微软的补丁可能加了 mitigation 而不是 fix** — 看到 `_guard_xfg_dispatch_icall_fptr` 这种 CFG 强化不要当成 fix，那是 mitigation\n- **匿名化** — writeup \u002F PoC 公开时脱敏目标机器名、内网 IP、用户名（写 `{target_ip}` `{username}` 占位）\n- **patched 版本上要能跑通无害化测试** — 别只在 unpatched 上跑，否则可能是环境因素导致的崩溃，不是漏洞\n- **二进制 diff 不万能** — 编译器升级 \u002F 优化等级变化也会让函数 layout 大变，先用 N 版本和 N-1 版本（同一编译器）对比，不要跨大版本\n\n---\n\n## 按需自举（On-Demand Bootstrap）\n\n### 工具依赖\n\n| 工具 | 用途 | 可自动安装 |\n|------|------|-----------|\n| BinDiff (Google, 5.x+) | 函数级二进制 diff，IDA\u002FGhidra 插件 | ✓ (有官方 .deb \u002F .msi) |\n| Diaphora | IDA 老牌 diff 插件，需要 IDA Pro | ✓ (git clone) |\n| ghidriff | Ghidra headless CLI diff，输出 markdown | ✓ (pip install ghidriff) |\n| DeepDiff (商业) | 新一代 diff 工具，准确度更高 | ✗ (商业授权) |\n| Ghidra | ghidriff 的运行底座 | ✓ |\n| IDA Pro | BinDiff \u002F Diaphora 的运行底座 | ✗ (商业) |\n| Microsoft Update Catalog | 下 MSU\u002FMSP 补丁包 | 在线服务 |\n| wsuspect-proxy | 透明拦截 Windows Update 流量取补丁 | ✓ (git clone) |\n| expand.exe \u002F dism | 解 MSU \u002F cab | ✓ (Windows 自带) |\n| rpm2cpio \u002F dpkg-deb | 解 Linux 发行版包 | ✓ |\n| symchk | 从微软符号服务器拉 PDB | ✓ (Windows SDK) |\n\n### 自举命令\n\n```powershell\n# bootstrap-reverse.ps1 is not bundled. Stop this path; prepare a separately reviewed pinned installation if requested.\n```\n\n详细工具对比与命令见 `references\u002Fdiff-tools-comparison.md`。\n详细 Patch Tuesday 工作流见 `references\u002Fpatch-tuesday-workflow.md`。\n根因反推与 PoC 模板见 `references\u002Froot-cause-and-poc.md`。\n\n---\n\n## 路由上下文\n\n**上游入口**: `skills\u002FSKILL.md`（总控）、`routing.md`\n\n**上游 skill**:\n- `reverse-engineering\u002F` — 在做 diff 之前可能要先理解目标二进制的整体结构\n- `binary-diff\u002F` — 如果补丁后版本无符号、补丁前有符号，先用 binary-diff 搬符号过来\n\n**下游 skill**:\n- `pwn-chain\u002F` — 反推出 bug class 后，需要写完整利用（堆喷、ROP、SMEP\u002FSMAP 绕过、提权 payload）\n- `pentest-tools\u002Fnetwork-attack-defense\u002F` — 把 N-day 武器化部署到目标网络（包装成可投递载荷、对接 C2）\n- `attack-chain\u002F` — 把这一个 N-day 串到完整攻击链里（初始访问 → 提权 → 横向）\n\n**触发条件**: 任务包含\"N-day\"、\"补丁\"、\"CVE 复现\"、\"找补丁修了什么\"、\"打未更新主机\" 等意图\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否只执行了授权阶段，并把静态\u002F未执行\u002F未完成\u002F失败结果准确区分？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- PoC development only for vulnerabilities you are authorized to research.\n- Patch diffing fails when vendors rebuild extensively between releases.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## When to Use\n\n- Turning a vendor security advisory into a concrete vulnerable-function location.\n- Building a proof-of-concept for a patched vulnerability in authorized research.\n\n## 适用范围\n\n当任务属于以下场景时使用本 skill：\n\n1. **已知 CVE 但无公开 PoC** — 厂商公告写了\"修复了 XX 组件的越界写\"但没放 PoC，需要从补丁反推\n2. **SRC \u002F 红队打 N-day** — 目标资产未及时更新，需要把刚发布的补丁差成可用的 1-day 利用\n3. **Patch Tuesday 跟进** — 每月第二个周二微软放补丁，需要快速锁定高价值漏洞（Kernel \u002F Win32k \u002F AFD \u002F CLFS）\n4. **Linux LTS 补丁分析** — 主线 fix 已合并，但旁支或某发行版 backport 不全，找未修补面\n5. **驱动 \u002F 服务的安全补丁还原** — 显卡驱动、AV 引擎、虚拟化组件等闭源软件的补丁分析\n\n### 与其他 skill 的分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 有旧版符号，迁移到新版本帮助分析 | `binary-diff\u002F` |\n| **从补丁找漏洞、写 PoC 打补丁前版本** | **本 skill** |\n| 写出完整利用链（堆喷、ROP、提权） | `pwn-chain\u002F` |\n| 把 1-day 武器化部署到目标网络 | `pentest-tools\u002Fnetwork-attack-defense\u002F` |\n| 从零逆向一个二进制 | `ida-reverse\u002F` \u002F `radare2\u002F` |\n\n差别的关键：`binary-diff` 的目标是**让新版可分析**（把旧符号搬过来），本 skill 的目标是**找出补丁修了什么 bug 然后打补丁前的版本**。前者服务防御侧 \u002F 研究侧分析，后者服务攻击侧武器化。\n\n## 研究与执行边界\n\n默认在授权离线样本上静态分析。记录补丁前后来源\u002F签名\u002FSHA256、精确构建\u002F架构\u002F组件和符号 GUID\u002Fage；N-1 不自动等于易受攻击，backport 和功能开关须验证。匹配分数是排序线索，不是正确性\u002F漏洞置信度；已匹配\u002F未匹配\u002F高相似函数都可能包含关键修复。\n\n动态崩溃\u002F竞争\u002F提权测试只在可销毁隔离 VM，设置次数\u002F时长\u002F资源限制与快照恢复，禁止生产网络武器化\u002F持久化\u002FC2 或扩大目标。patched 不崩与 unpatched 崩只能支持有限差异，需要同条件重复、sanitizer\u002Fdebugger根因和对照才能归因。缺失工具、脚本、RULES\u002Ftool-index 不得假装已提供；不自动安装或启动服务。公开 PoC\u002F外发二进制是另一个需授权的操作。\n\n## 核心原理\n\n```text\npatched 二进制 (after)         unpatched 二进制 (before)\n        ↓                                  ↓\n    导入 IDA\u002FGhidra              导入 IDA\u002FGhidra\n        ↓                                  ↓\n        └──────── BinDiff \u002F ghidriff ──────┘\n                        ↓\n        函数级 diff（matched \u002F unmatched \u002F changed）\n                        ↓\n        聚焦 match score 中等的函数（0.5 - 0.9）\n                        ↓\n        看新增了什么：边界检查 \u002F 锁 \u002F 字段清零 \u002F 整数溢出检查\n                        ↓\n        反推 bug class：OOB \u002F Race \u002F Info Leak \u002F UAF \u002F Integer Overflow\n                        ↓\n        在 unpatched 版本上写 PoC 触发\n                        ↓\n        验证：unpatched 崩 \u002F patched 不崩 → 漏洞确认\n```\n\n补丁修复模式 → 漏洞类型反查：\n\n| 新增内容 | 大概率的 bug class |\n|---------|------------------|\n| `if (a + b \u003C a)` \u002F `__builtin_add_overflow` | 整数溢出 |\n| `KeAcquireSpinLock` \u002F `mutex_lock` | 竞争条件 (TOCTOU \u002F double-free) |\n| `if (idx >= MAX)` \u002F `if (len > buf_size)` | 越界读 \u002F 越界写 |\n| `RtlZeroMemory` \u002F `memset(struct, 0, ...)` | 未初始化内存信息泄漏 |\n| `InterlockedDecrement` + refcount 检查 | UAF \u002F 引用计数错误 |\n| `ProbeForRead` \u002F `ProbeForWrite` | 用户态指针未校验 |\n| `SeAccessCheck` \u002F capability 校验 | 权限校验缺失 |\n| 删除 \u002F 收紧 `IOCTL` code | 暴露面收敛（看老接口怎么打） |\n\n## 工作流\n\n### 5 步完整流程\n\n```text\nStep 1: 拿 before \u002F after 二进制\n  - Windows: Microsoft Update Catalog 下 MSU\u002FMSP，用 expand.exe \u002F dism 解包\n  - Linux: 从发行版 USN\u002FRHSA 拉 .deb\u002F.rpm，用 dpkg-deb \u002F rpm2cpio 解包\n  - 第三方软件: 官网取 N-1 和 N 版本安装包\n\nStep 2: 对齐符号\n  - 有 PDB 直接吃，没 PDB 时用 binary-diff skill 把 N-1 版本的符号搬到 N 版本\n  - Linux 内核取对应版本的 vmlinux + System.map \u002F debuginfo\n\nStep 3: 二进制 diff\n  - BinDiff: 直接给两个 IDB，看函数级匹配结果\n  - ghidriff: pip 一键安装，CLI 输出 markdown 报告\n  - Diaphora: IDA 内插件，老牌但需要 IDA Pro\n\nStep 4: 定位变更\n  - 过滤 match score 0.5-0.95 的函数（完全相同的不看，完全不同的多半是新加 \u002F 重命名）\n  - 重点看：新增的 if \u002F 新增的循环边界 \u002F 删除的代码块（删了什么也是线索）\n  - 用 LLM 看 before\u002Fafter 伪代码反推 bug class（见 references\u002Froot-cause-and-poc.md）\n\nStep 5: 写 PoC\n  - 整数溢出：构造边界值（INT_MAX-1、0xFFFFFFFF）\n  - 竞争：多线程 hammer，open\u002Fclose + ioctl 高频并发\n  - UAF：spray → free → reuse pattern\n  - OOB：精确控制 len \u002F index 越过边界\n  - 验证 patched 版本不再崩，unpatched 版本稳定崩 → bug 复现成功\n```\n\n### 工具调用顺序\n\n```text\n下补丁 → 解包 → 加载到 IDA\u002FGhidra → BinDiff\u002Fghidriff → 看 unmatched\u002Flow-match 函数\n       → LLM 反推 bug class → 写 PoC → 在 unpatched 跑 → 崩 → 收工\n```\n\n## 典型场景示例\n\n### 场景 1：Windows Patch Tuesday — 假设性分析示例\n\n下面 CVE\u002FKB\u002Fbuild\u002F函数\u002F崩溃时间未在此审查中核实，不是实际漏洞定位或复现结果；按厂商证据替换后使用。\n\n```text\n背景：2025 年 11 月 Patch Tuesday，MSRC 公告 CVE-2025-62215\n      Windows Kernel race condition 导致 double free，CVSS 7.0，本地提权\n      微软只放了补丁，没放细节，没有公开 PoC\n\n目标：复现 PoC，验证未打补丁的 Windows 11 22H2 \u002F 23H2 可提权\n\n步骤：\n1. Microsoft Update Catalog 搜 \"2025-11\" + KB 号，下两个版本：\n   - 22H2 build 22621.xxxx (unpatched)\n   - 22H2 build 22621.yyyy (patched 后)\n   命令:\n     expand.exe Windows-KB5052000-x64.msu -F:* C:\\out\\patched\\\n     expand.exe C:\\out\\patched\\Windows-KB5052000-x64.cab -F:* C:\\out\\patched\\\n   提取 ntoskrnl.exe \u002F win32k.sys \u002F win32kfull.sys \u002F afd.sys\n\n2. 两个版本都吃 PDB (微软符号服务器):\n     symchk \u002Fv \u002Fr ntoskrnl.exe \u002Fs SRV*C:\\sym*https:\u002F\u002Fmsdl.microsoft.com\u002Fdownload\u002Fsymbols\n\n3. 跑 BinDiff:\n     bindiff old.BinExport new.BinExport\n   或 ghidriff:\n     ghidriff ntoskrnl_old.exe ntoskrnl_new.exe -o diff_out\u002F\n\n4. 看报告，过滤 similarity 0.6-0.95 的函数。\n   假设定位到 NtXxxIoctl 类函数新增了一段:\n     KeAcquireSpinLockRaiseToDpc(&obj->Lock);\n     if (obj->RefCount == 0) { ... goto cleanup; }\n   → 新增了锁 + 引用计数检查 → race + double free，符合公告描述\n\n5. 写 PoC：用户态多线程同时调 NtClose + 触发同一对象的 IOCTL，\n   制造 close 释放与 IOCTL 还在用之间的竞争窗口\n   崩在 ntoskrnl 的 ObfDereferenceObject 后续 free 路径上\n\n6. 验证：\n   - unpatched 22621.xxxx 上跑 PoC，~30 秒内 BSOD (BAD_POOL_HEADER 或 DOUBLE_FREE)\n   - patched 22621.yyyy 上跑同 PoC，无任何异常\n   → 复现成功\n```\n\n### 场景 2：Linux 内核 LTS 分支补丁找未修的旁支\n\n```text\n背景：主线 6.x 已修某 net subsystem 的 OOB 写\n      Ubuntu 22.04 (5.15 LTS) 的 USN 已发布更新\n      但某些 OEM kernel \u002F Azure kernel 的 backport 节奏更慢\n      想确认未更新的旁支是否仍可打\n\n目标：取 patched\u002Funpatched 内核，差出 fix commit 对应的二进制变更，\n      在 unpatched 旁支上重写 PoC\n\n步骤：\n1. 拉 patched 与 unpatched 包:\n     apt download linux-image-5.15.0-101-generic   # patched\n     apt download linux-image-5.15.0-100-generic   # unpatched\n     dpkg-deb -x linux-image-5.15.0-101-generic_*.deb .\u002Fpatched\u002F\n     dpkg-deb -x linux-image-5.15.0-100-generic_*.deb .\u002Funpatched\u002F\n   提取 boot\u002Fvmlinuz → 用 extract-vmlinux 还原 ELF\n\n2. 同步取 dbgsym:\n     apt download linux-image-unsigned-5.15.0-101-generic-dbgsym\n\n3. 用 ghidriff (Linux 友好):\n     ghidriff vmlinux_5.15.0-100 vmlinux_5.15.0-101 \\\n              -o \u002Ftmp\u002Fkdiff\u002F --max-section-funcs-analyze 8000\n\n4. 报告里搜 net\u002Fipv4\u002F net\u002Fipv6\u002F net\u002Fsched\u002F 等子系统的 changed 函数\n   找到补丁前 skb_copy_bits 调用前缺少 skb->len 上限校验\n   → OOB read，可能配合可触发的 sysctl 升级到 OOB write\n\n5. 在 unpatched 旁支（例如 Azure 5.15.0-1080 backport 落后的版本）\n   交叉验证：同一函数 fix 是否已 backport\n   如果没 backport → 旁支仍可打 → 写 PoC 重放\n\n6. 写 PoC：syzkaller harness 改造 \u002F 直接 C PoC 触发对应 syscall\n   验证旁支 panic \u002F KASAN 报 OOB\n```\n\n## 注意事项\n\n- **法律边界** — 武器化 N-day 必须在授权范围内（SRC \u002F Bug Bounty \u002F 自有靶机 \u002F CTF）。对生产环境直接打 1-day 等同入侵\n- **补丁可能只是\"减小爆炸半径\"** — 看到 patch 不一定就是完整修复，有可能只是补一个利用路径，原始 bug 仍可从别的路径触发（一鱼多吃）\n- **变量名\u002F类型不要被欺骗** — Windows 补丁经常顺手做 cleanup \u002F rename，看似变更很大但实际无关。要看控制流和数据流，不要看 token 级 diff\n- **微软的补丁可能加了 mitigation 而不是 fix** — 看到 `_guard_xfg_dispatch_icall_fptr` 这种 CFG 强化不要当成 fix，那是 mitigation\n- **匿名化** — writeup \u002F PoC 公开时脱敏目标机器名、内网 IP、用户名（写 `{target_ip}` `{username}` 占位）\n- **patched 版本上要能跑通无害化测试** — 别只在 unpatched 上跑，否则可能是环境因素导致的崩溃，不是漏洞\n- **二进制 diff 不万能** — 编译器升级 \u002F 优化等级变化也会让函数 layout 大变，先用 N 版本和 N-1 版本（同一编译器）对比，不要跨大版本\n\n---\n\n## 按需自举（On-Demand Bootstrap）\n\n### 工具依赖\n\n| 工具 | 用途 | 可自动安装 |\n|------|------|-----------|\n| BinDiff (Google, 5.x+) | 函数级二进制 diff，IDA\u002FGhidra 插件 | ✓ (有官方 .deb \u002F .msi) |\n| Diaphora | IDA 老牌 diff 插件，需要 IDA Pro | ✓ (git clone) |\n| ghidriff | Ghidra headless CLI diff，输出 markdown | ✓ (pip install ghidriff) |\n| DeepDiff (商业) | 新一代 diff 工具，准确度更高 | ✗ (商业授权) |\n| Ghidra | ghidriff 的运行底座 | ✓ |\n| IDA Pro | BinDiff \u002F Diaphora 的运行底座 | ✗ (商业) |\n| Microsoft Update Catalog | 下 MSU\u002FMSP 补丁包 | 在线服务 |\n| wsuspect-proxy | 透明拦截 Windows Update 流量取补丁 | ✓ (git clone) |\n| expand.exe \u002F dism | 解 MSU \u002F cab | ✓ (Windows 自带) |\n| rpm2cpio \u002F dpkg-deb | 解 Linux 发行版包 | ✓ |\n| symchk | 从微软符号服务器拉 PDB | ✓ (Windows SDK) |\n\n### 自举命令\n\n```powershell\n# bootstrap-reverse.ps1 is not bundled. Stop this path; prepare a separately reviewed pinned installation if requested.\n```\n\n详细工具对比与命令见 `references\u002Fdiff-tools-comparison.md`。\n详细 Patch Tuesday 工作流见 `references\u002Fpatch-tuesday-workflow.md`。\n根因反推与 PoC 模板见 `references\u002Froot-cause-and-poc.md`。\n\n---\n\n## 路由上下文\n\n**上游入口**: `skills\u002FSKILL.md`（总控）、`routing.md`\n\n**上游 skill**:\n- `reverse-engineering\u002F` — 在做 diff 之前可能要先理解目标二进制的整体结构\n- `binary-diff\u002F` — 如果补丁后版本无符号、补丁前有符号，先用 binary-diff 搬符号过来\n\n**下游 skill**:\n- `pwn-chain\u002F` — 反推出 bug class 后，需要写完整利用（堆喷、ROP、SMEP\u002FSMAP 绕过、提权 payload）\n- `pentest-tools\u002Fnetwork-attack-defense\u002F` — 把 N-day 武器化部署到目标网络（包装成可投递载荷、对接 C2）\n- `attack-chain\u002F` — 把这一个 N-day 串到完整攻击链里（初始访问 → 提权 → 横向）\n\n**触发条件**: 任务包含\"N-day\"、\"补丁\"、\"CVE 复现\"、\"找补丁修了什么\"、\"打未更新主机\" 等意图\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否只执行了授权阶段，并把静态\u002F未执行\u002F未完成\u002F失败结果准确区分？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- PoC development only for vulnerabilities you are authorized to research.\n- Patch diffing fails when vendors rebuild extensively between releases.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n",{"name":5,"risk":34,"source":50,"license":14,"date_added":51,"description":7,"source_repo":52,"source_type":38,"license_source":53},"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill","2026-08-25","zhaoxuya520\u002Freverse-skill","https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-patch-diff-exploit",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-13 14:20:47",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add boisenoise\u002Fskills-collections --skill patch-diff-exploit",{"tool":66,"command":67},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill patch-diff-exploit",{"tool":69,"command":70},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill patch-diff-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-patch-diff-exploit\u002FSKILL.md",true,[74,80,84],{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fdiff-tools-comparison.md","REFERENCE","参考文档",9153,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-patch-diff-exploit\u002Freferences\u002Fdiff-tools-comparison.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fpatch-tuesday-workflow.md",9107,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-patch-diff-exploit\u002Freferences\u002Fpatch-tuesday-workflow.md",{"path":85,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Froot-cause-and-poc.md",5863,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-patch-diff-exploit\u002Freferences\u002Froot-cause-and-poc.md",[89,118,141,165,184,206],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":94,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":45},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,28],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","only","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":122,"sourceHtmlUrl":123,"categories":124,"keywords":128,"publishedAt":45},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[125],{"categoryNo":126,"categoryName":127,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[120,129,130,37,101,102,43,106,131,132,133,134,135,136,137,113,138,139,140,29,28],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":145,"sourceHtmlUrl":146,"categories":147,"keywords":153,"publishedAt":45},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[148],{"categoryNo":149,"categoryName":150,"taxonomyType":151,"taxonomyTypeDesc":152},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[143,37,101,43,42,154,155,156,157,158,113,159,160,161,139,31,162,163,164,29,120,28],"email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":169,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":45},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[173,174,175,37,101,43,176,177,42,178,131,179,180,181,157,113,182,183,29,120,28],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":188,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":45},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[192,193,37,44,101,194,43,195,196,197,198,199,113,200,201,202,203,204,205,29],"make","make ugc","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":210,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":45},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[214,215,216,37,101,43,217,218,156,219,220,113,221,222,223,224,225,226,227,29],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]