home.social

#ghidriff — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #ghidriff, aggregated by home.social.

  1. clearbluejar @[email protected] ·

    New #ghidriff release! v0.9.0

    - Set custom analysis options
    - Set custom base address (bootloaders, etc)

    github.com/clearbluejar/ghidri

    #ghidriff
  2. buherator @[email protected] ·

    Here’s the #Ghidriff output for CLFS.sys 10.0.20348.3328 vs. 10.0.20348.3453, likely corresponding to the CVE-2025-29824 use-after-free LPE:

    https://gist.github.com/v-p-b/8c43fb8e0d72814dcd03764d478622ce

    #ghidriff
  3. buherator @[email protected] ·
    Here are the results of #ghidriff's VersionTrackingDiff ran on the latest patch of afd.sys (likely as the result of CVE-2025-21418):

    https://gist.github.com/v-p-b/458475d0c7f8aaf6496b5168c04ea262

    The change seems to affect a single but significant API (AfdAccept()), my initial guess is this was a locking issue.

    #ExploitWednesday
    #exploitwednesday #ghidriff
  4. clearbluejar @[email protected] ·

    Just released #ghidriff v0.8.0 - Ghidra 11.3 Support + PyGhidra 🔥👀

    This release uses the latest PyGhidra now officially supported by Ghidra 🤓💪

    github.com/clearbluejar/ghidri

    🔋 included!

    #ghidriff
  5. clearbluejar @[email protected] ·

    CVE-2024-43625 - 2024-Nov - Microsoft Windows VMSwitch Elevation of Privilege - Use After Free - CVSS 8.1

    #ghidriff vmwsitch diff
    gist.github.com/clearbluejar/b
    👀🔥

    Side-by-side view: diffpreview.github.io/?b5c1261 🧐

    A patch diffing 🧵...

    #ghidriff
  6. clearbluejar @[email protected] ·

    CVE-2025-21325 - 2025-Jan - ARM64 - Windows Secure Kernel Mode Elevation of Privilege

    #ghidriff full diff 👀 gist.github.com/clearbluejar/3

    Incorrect permission assignment? 🧐 gist.github.com/clearbluejar/3

    #ghidriff
  7. buherator @[email protected] ·
    ghidriff - mpengine.dll - VersionTrackingDiff - 1.1.24030.4 vs 1.1.24060.5

    https://gist.github.com/v-p-b/f9aa39263e125c8e3b04c4d22fd4d78d#strings

    This one executed much faster than SimpleDiff (with the O(n^2) FuncName:Param algorithm)!

    Unfortunately the diff is so big it's difficult to judge quality, so the next step is to come up with some metrics that can be checked automatically.

    #bindiff #ghidriff
    #bindiff #ghidriff
  8. buherator @[email protected] ·
    You diff binaries and immediately find the single change that adds the overflow check.

    I diff mpengine.dll and break all reversing tools out there.

    We are not the same.

    https://gist.github.com/v-p-b/513a8f70a32c62f3ab7bf0d6a90e0941

    #bindiff #ghidriff
    #bindiff #ghidriff
  9. clearbluejar @[email protected] ·

    Exciting! My talk recording just dropped from #OBTS v7! 🗣️✨ Learn how to patch diff on Apple with #Ghidra, #ghidriff, and #ipsw: "Patch Different on *OS": youtube.com/watch?v=Ellb76t7nr

    #obts #ghidra #ghidriff #ipsw
  10. clearbluejar @[email protected] ·

    latest #ghidriff now running with Ghidra 11.2 👀 🔥 github.com/clearbluejar/ghidri

    #ghidriff
  11. clearbluejar @[email protected] ·

    #ghidriff v0.7.2 - Ghidra 11.1 Support 🔥👀

    github.com/clearbluejar/ghidri

    #ghidriff
  12. clearbluejar @[email protected] ·

    Root Cause Your Own CVEs #patchdiffinthedark #ghidriff #blackalps

    youtu.be/A2IrcwG6e84?si=oKl6Df

    #patchdiffinthedark #ghidriff #blackalps
  13. clearbluejar @[email protected] ·

    Hot of the #ghidriff #patchdiffing press for April 2024 we have CVE-2024-26219 in HTTP.sys 🔥

    MSRC just started publishing CWE info! For this CVE we have a "CWE-476: NULL Pointer Dereference" 👀

    See if you can find it 🧐

    Hint: "UxLastMdlChunkNullFix"

    gist.github.com/clearbluejar/a

    #ghidriff #patchdiffing
  14. clearbluejar @[email protected] ·

    starting to take a look at 🍎....

    #ghidriff is slowly learning how to diff *OS 🤓

    Some sample diffs incoming...

    github.com/clearbluejar/ghidri

    #ghidriff
  15. clearbluejar @[email protected] ·

    hello 2024!

    Hot off the #ghidriff #patchdiffing press we have the January 9, 2024—KB5034122 Windows 10 22H2 x64 kernel update ...
    gist.github.com/clearbluejar/0 🔥

    Side by side view is here: diffpreview.github.io/?0e52d80 👀

    This month the kernel fixes include CVE-2024-20698 ... as there are not too many changes, perhaps we find the root cause?

    Take at look this function... gist.github.com/clearbluejar/0 🧐

    Hint: It rhymes with "vintager afterglow".

    #ghidriff #patchdiffing
  16. clearbluejar @[email protected] ·

    Latest #ghidriff v0.6.0 now uses #Ghidra 11.0 and brand new #BSim correlation: 🔥👀

    github.com/clearbluejar/ghidri

    #ghidriff #ghidra #bsim
  17. clearbluejar @[email protected] ·

    stayed up way too late, but now #ghidriff has a PR with #ghidra #BSIM powers. so... worth it? 😅

    github.com/clearbluejar/ghidri

    Some #BSIM first impressions:
    - The BSIM correlator is great for matching. The overall improvement for #ghidriff is a net plus, but some custom #ghidriff correlators were already providing similar structural matching (not as good, but similar) 💪
    - Speculation: 🧐 BSIM is the reason why Ghidra Version Tracking was lacking structural matching heuristics. I didn't understand that before the arrival of BSIM, and it was the reason why I added my own structural function matching to #ghidriff. BSIM fills the gap and does it better.
    - Adding BSIM to #ghidriff slows it down a bit. This is because BSIM decompiles all functions to match based on data flow and call graphs, and #ghidriff similarly already does this to make matching decisions. Will need to optimize. 🤓
    - Adding the BSIM correlator for matching is just the beginning, stay tuned to see what else BSIM can do. 🔥🐲

    #ghidriff #ghidra #bsim
  18. clearbluejar @[email protected] ·

    Ghidra 11.0 integration with #ghidriff coming soon... 👀

    #ghidriff
  19. clearbluejar @[email protected] ·

    For those who don't want to read a long blog post, check out the #ghidriff talk from @alien8
    @44CON
    instead. Had an amazing time at the conference and definitely recommend it for 2024. Also, check out some photos from the con courtesy of
    @InfosecChlobo

    infosec.exchange/@44CON/111664

    #ghidriff
  20. Joxean Koret (@matalaz) @[email protected] ·

    Talk about #ghidriff in @44CON, by @clearbluejar
    youtube.com/watch?v=nOrDIv34Zc

    #ghidriff
  21. clearbluejar @[email protected] ·

    Deep dive into #ghidriff 🤿

    Ghidriff: Ghidra Binary Diffing Engine Blog Post:
    clearbluejar.github.io/posts/g

    #ghidriff
  22. clearbluejar @[email protected] ·

    #ghidriff v0.5.2 Release 🔥👀:
    - New Docker image
    - Ghidra Zip File Support, Calling Counts Feature, Bug Fixes

    github.com/clearbluejar/ghidri

    #ghidriff
  23. clearbluejar @[email protected] ·

    Hot off the #ghidriff #patchdiffing press, we have the December Windows 11 22H2 x64 kernel security update KB5033375: gist.github.com/clearbluejar/4 🧐

    Side-by-side view here: diffpreview.github.io/?4f0c979 👀

    #ghidriff #patchdiffing
  24. clearbluejar @[email protected] ·

    Hot off the #ghidriff #patchdiffing press we have November's Windows 11 22H2 x64 kernel update KB5032190:
    gist.github.com/clearbluejar/0 🧐

    Side by side view is here: diffpreview.github.io/?02fc449 👀

    #ghidriff #patchdiffing
  25. clearbluejar @[email protected] ·

    Want to give #ghidriff a go for CVE-2023-36713?

    1. pip install ghidriff
    pypi.org/project/ghidriff/ …

    2. download binaries
    gist.github.com/clearbluejar/0 …

    3. repeat command line
    gist.github.com/clearbluejar/0 …

    #ghidriff
  26. clearbluejar @[email protected] ·

    Patch diffing when you have no blog post, no Github poc, only binaries! #patchdiffinginthedark

    Let's try CVE-2023-36713 with #ghidriff:

    An information disclosure for CLFS.sys, not too many functions changed. 🤔
    gist.github.com/clearbluejar/0

    There seem to be some refcount changes to memset and memcpy...
    memset refcount++ 🧐
    gist.github.com/clearbluejar/0
    memcpy refcount++ 🧐
    gist.github.com/clearbluejar/0

    Looking at the modified function with new calls to memcpy and memset.
    gist.github.com/clearbluejar/0

    Seems to be an area that is now calling memset on some newly allocated memory (link with a side-by-side view): diffpreview.github.io/?0f9dc5d

    We patch diff in the dark to step into the light. 💪

    Kudos to
    @tacbliw
    , who is credited with CVE-2023-36713

    #patchdiffinginthedark #ghidriff
  27. clearbluejar @[email protected] ·

    Hot off the #ghidriff #patchdiffing press we have October's Windows 11 22H2 kernel Update KB5031354...

    gist.github.com/clearbluejar/5 👀

    #ghidriff #patchdiffing
  28. clearbluejar @[email protected] ·

    all binary diffing tools stand on the shoulders of giants...

    #ghidriff powered by #ghidra

    github.com/clearbluejar/ghidri

    #ghidriff #ghidra