Here’s the #Ghidriff output for CLFS.sys 10.0.20348.3328 vs. 10.0.20348.3453, likely corresponding to the CVE-2025-29824 use-after-free LPE:

gist.github.com ->


Original->

Here are the results of #ghidriff's VersionTrackingDiff ran on the latest patch of afd.sys (likely as the result of CVE-2025-21418):


gist.github.com ->

The change seems to affect a single but significant API (AfdAccept()), my initial
1/2

difficult to judge quality, so the next step is to come up with some metrics that can be checked automatically.

#bindiff #ghidriff
2/2

Original->

You diff binaries and immediately find the single change that adds the overflow check.

I diff mpengine.dll and break all reversing tools out there.

We are not the same.


gist.github.com ->

#bindiff #ghidriff


Original->

GitHub - clearbluejar/ghidriff: Python Command-Line Ghidra Binary Diffing Engine Python Command-Line Ghidra Binary Diffing Engine. Contribute to clearbluejar/ghidriff development by creating an account on GitHub.

Introducing #ghidriff: a Python Command-Line Ghidra Binary Diffing Engine

#ghidra #patchdiffing #python

github.com/clearbluejar...