23. Finding N-day Vulnerabilities Through Patch Diffing

Immediately after a patch is released, the diff is the best clue. The key is comparing binaries or source code before and after the update to narrow the candidates down to the changed locations. In CTFs, "the patched function is the road to the flag" is often true as well.

Workflow

• Extract a list of changed files and functions (git diff, bindiff, Diaphora)
• Check whether input validation or authorization checks were added
• If new error handling or bounds checks appeared, target the previous version

Practical tips

• Even when the function signature is unchanged, focus on places where conditional branches increased
• Added strings such as error messages provide clues about the vulnerability context
• In network and parser code, a small added length check can be critical

Patch diffing is the technique of "turning a published fix inside out." Use it only for research and testing within a lawful scope.