Semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability tracing, and scoring
-
Updated
Feb 26, 2026 - Python
Semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability tracing, and scoring
match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
A firmware map for your AI agent, served over MCP: every dangerous call it recognizes, what it couldn’t determine, and the functions a patch changed between two versions.
Fast, open binary diff for ELF/PE — reports structural changes and, for x86-64, which functions were added, removed, or modified. Rust CLI + library.
CVE patch-diff root-cause analyzer for iOS, Linux, and Windows workflows with RE backends, LLM routing, confidence scoring, and export packs.
BinExport for Ghidra 12.x (12.1.2). Patched build of google/binexport that fixes the NoSuchFieldError LabelString$LabelType.CODE_LABEL crash (issue #166) blocking BinExport + BinDiff on Ghidra 12.0+. Prebuilt Ghidra extension + headless export. Ghidra → BinExport → BinDiff pipeline restored.
Clean-room Rust binary analysis: loaders, decompilation, patch diffing, patch preview, and MCP-driven reverse-engineering workflows.
Firmware security research on public targets: patch-diff case studies of router command injection (DrayTek and D-Link n-days), a reusable triage, diff and report toolchain, and a MAVLink security test harness for PX4/ArduPilot SITL.
iOS Messages JPEG XL delivery-surface probe and patch-diff notes for CVE-2026-28956.
C++ port of Diaphora, the binary diffing tool by joxeankoret, for IDA Free/Pro 9.4+ (no IDAPython required). SQLite export, Diaphora's SQL heuristics and result choosers, assembly and graph diffs, and import of matched names, prototypes and comments. Assembly only in IDA Free.
Java port of Diaphora, the binary diffing tool by joxeankoret, for Ghidra 12.1.4+. SQLite export with pseudo-code from Ghidra's decompiler, Diaphora's 50 SQL heuristics, a results window with assembly, pseudo-code and graph diffs, and import of names, prototypes, comments and types.
To associate your repository with the patch-diffing topic, visit your repo's landing page and select "manage topics."