Skip to main content

31. Binary Diffing: A Fast Routine for Finding Vulnerabilities in Patches

When a patch is released, the fastest vulnerability-analysis routine is binary diffing. Knowing only “which function changed” can reveal the attack point.

Basic Flow​

  • Load the old and new binaries side by side
  • Match functions by graph similarity
  • Focus only on the changed functions

Change Patterns Commonly Seen in Practice​

  • Added length check: a new len >= comparison
  • Stronger conditional branching: more branches lead to the failure routine
  • Modified decryption routine: changed key or round constants
  • Unified error messages: error codes are consolidated into one

Tool Stack​

  • Diaphora (IDA) or a Ghidra diff plugin
  • Check string references first in the changed function
  • Trace backward through the call graph to infer the “input point”

The key is to “focus only on what changed.” The patch is a clue, and the diff is a map. Mastering this routine dramatically speeds up 0day analysis.