N-day patch diffing to exploit

When it applies

A vendor shipped a fix but no details: a CVE advisory says "out-of-bounds write in component X" with no PoC, a Patch Tuesday drop needs triage, or a Linux distro backport may be incomplete on some branch. The goal is to recover what the patch fixed and prove the bug against the unpatched build. Weaponizing an N-day is only legitimate against in-scope, authorized targets (a program that accepts it, an engagement, your own lab) — confirm with tradecraft-scope-roe and record it in scope.txt.

Why it works

A security patch is a confession. The added bounds check, lock, zeroing, or refcount tells you exactly which invariant the old code violated — and the unpatched binary still violates it. Diff the two builds, filter to functions that changed moderately (identical = untouched, completely different = new feature), and the fix pattern maps almost one-to-one onto a bug class you can then trigger.