John McIntosh (clearbluejar)@clearbluejar
#Patchdiffing with #ghidra can be more of an art than a science. Ideally, the correlators have done their work, and all the analyst has to do is review the identified changes, additions, and deletions.
014
Posts with #Patchdiffing
#Patchdiffing
Public posts on X that use #Patchdiffing.
Related hashtags
- John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press we have November's Windows 11 22H2 x64 kernel update KB5032190: 🧐 Side by side view is here: 👀
28539.6K 
clearseclabs@clearseclabsJoin @clearbluejar @1ns0mn1h4ck 2024 for "Patch Different on *OS". Check out this quick talk teaser video for a quick demo of some of the content! #INSO24 #Insomnihack #patchdiffing #apple005773- clearseclabs@clearseclabs🔍✨ #patchdiffinthedark to step into the light. Latest VR/RE course led by @clearbluejar at #BHUSA. Root cause the latest CVEs with Ghidra. 2 offerings Sat/Sun or Mon/Tue. Early bird rates end May 24. #patchdiffing @BlackHatEvents
0237.3K 
raptor@0xdeaVery well written #Windows #patchdiffing and #nday #exploitation walkthrough ✊ Dissecting and Exploiting TCP/IP RCE #Vulnerability EvilESP (CVE-2022-34718) // by Valentina Palmiotti
05918523K- John McIntosh (clearbluejar)@clearbluejarHot of the #ghidriff #patchdiffing press for May 2025 we have CVE-2025-32701 clfs.sys #exploitedinwild🔥 2 functions modified with relevant changes 🧐 A new flag restricting an IoCreateFileEx call, impacting object ref/deref behavior #UAF 🤔👀
114594.9K - John McIntosh (clearbluejar)@clearbluejarjumping on the CVE-2024-38063 tcpip.sys train...🚂can't resist.. just need to figure out the right packet... 🤓 #patchdiffing #CVE #RE #ghidriff
34415323.7K 
CVE-2022-34718 patch diffing, root cause analysis and exploit PoC Writeup by @chompie1337 #windows #patchdiffing #infosec #cybersecurity
24715816.7K- John McIntosh (clearbluejar)@clearbluejarhello 2024! Hot off the #ghidriff #patchdiffing press we have the January 9, 2024—KB5034122 Windows 10 22H2 x64 kernel update ... 🔥 Side by side view is here: 👀 This month the kernel fixes include CVE-2024-20698 ... as there are not too many changes, perhaps we find the root cause? Take at look this function... 🧐 Hint: It rhymes with "vintager afterglow". Also! This diff is testing out an upcoming ghidriff feature.. check out the new callgraph.
07183K - John McIntosh (clearbluejar)@clearbluejarHot of the #ghidriff #patchdiffing press for April 2024 we have CVE-2024-26219 in HTTP.sys 🔥 MSRC just started publishing CWE info! For this CVE we have a "CWE-476: NULL Pointer Dereference" 👀 See if you can find it 🧐 Hint: "UxLastMdlChunkNullFix"
314344.9K 
Thanks @jessefmoore for pointing this project out. Very cool stuff. Couldn’t find a handle for the authors, but well done @safebreach #PatchDiffing01342- John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press, we have the December Windows 11 22H2 x64 kernel security update KB5033375: 🧐 Side-by-side view here:
09344K - John McIntosh (clearbluejar)@clearbluejarHot off the #ghidriff #patchdiffing press we have October's Windows 11 22H2 kernel Update KB5031354... 👀
08254.6K - John McIntosh (clearbluejar)@clearbluejarghidriff v0.5.1 - usability updates, improved automated testing , and bug fixes 🪲 - github workflows now test a matrix of devcontainers across versions of python, Ghidra, and Java 🔥 #patchdiffing #ghidra #githubactions
05283.1K 
Nipun Jaswal@nipunjaswalDiffing patches for MS Windows 10, its sometimes hard to find downloads This should make it easy.. #patchdiffing #patchtuesday #exploitdev015
Join SANS Fellow @Steph3nSims in an hour for this amazing demo #PatchDiffingStephen Sims @Steph3nSimsThe next Off by One Security stream is tomorrow at 11AM Pacific Time. I'll be demonstrating the process of downloading, extracting, and prepping MS patches for diffing. We'll take a look at some patched code.011- The next Off by One Security stream is tomorrow at 11AM Pacific Time. I'll be demonstrating the process of downloading, extracting, and prepping MS patches for diffing. We'll take a look at some patched code.
02882 - John McIntosh (clearbluejar)@clearbluejarJust about finished with slides for my #patchdiffing workshop @reconmtl... Join me on Friday or Saturday to learn how to "Patch Diff In The Dark" #REcon2023
013318 
OnHexGroup@onhexgroupرشتو: در این برنامه قراره در خصوص تکنیک #PatchDiffing روی Patchهای #مایکروسافت صحبت و از دو ابزار #Bindiff و #Diaphora استفاده کنن. همچنین نشون میدن که چطوری #هوش_مصنوعی میتونه این فرایند رو ساده تر کنه. این برنامه ساعت 21:30 شروع میشه. #AI #PatchTuesdayStephen Sims @Steph3nSimsJoin me this Friday at 11AM on the next @offby1security stream where I will diff a Microsoft patch from this year and see how far we get. We'll use tools like BinDiff and Diaphora and look at the process of determining the vulnerability.101217- Join me this Friday at 11AM on the next @offby1security stream where I will diff a Microsoft patch from this year and see how far we get. We'll use tools like BinDiff and Diaphora and look at the process of determining the vulnerability.017946.4K
#Patchdiffing - “When we take the patched version and the unpatched version, and we run it through a tool that shows us the differences,” Zach Hanley. This is an attacker’s perspective, one that’s invaluable to understanding change and solving problems.012- Show more posts
