The workshop will cover the following topics:

1. Introduction (10 minutes)
   • Explain what patch diffing is and why it is useful for vulnerability research
   • Give an overview of both CVE vulnerabilities and their impact
   • Introduce the tools and data sets that will be used in the workshop (Ghidra, patched and unpatched binaries, updates files, etc.)
   • Exercise:
     • Check participants can run required tools and have access to provided resources
2. Patch Analysis (20 minutes)
   • Learn the different methods to obtain the binaries needed for patch diffing across Windows and Android
   • Demonstrate how to use Ghidra to compare the patched and unpatched binaries and identify the changes
   • Explain how to interpret the diff results and locate the vulnerable function
   • Exercise:
     • Have participants import and analyze binaries, and perform patch diff
3. Vulnerability Analysis (20 minutes)
   • Teach a method to determine how to reach the identified vulnerable function
   • Explain how the vulnerabilities can be triggered by sending a specially crafted input
   • Show how to use a debugger (WinDbg / adb) to attach to a process and set breakpoints on the vulnerable function
   • Demonstrate how to craft a malicious input to trigger the CVE
   • Exercise:
     • Have participants try to identify the vulnerable function and provide guidance.
     • Have participants step through the vulnerable function
4. Conclusion (10 minutes)
   • Summarize the main points and learning outcomes of the workshop
   • Provide some tips and resources for further learning and practice on patch diffing and vulnerability analysis
   • Answer any questions from the participants and collect feedback

Requirements for the Workshop:

• Laptop with Ghidra installed or ability to run workshop VM
• Internet access to download workshop resources