skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

binary-diff

Migrates symbols across binary versions using LLM-based structured comparison of disassembly and pseudocode.

21|8|Updated Aug 3, 2026
Search Tags:#reverse engineering#disassembly#ida pro#llm comparison#binary diffing#symbol migration#pdb missing
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill binary-diff-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-diff
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/binary-diff
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill binary-diff-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, httpx, and includes references (resource) components.

What problem does it solve? When a program or kernel updates and symbols (PDBs, prior reverse-engineering results) are lost, analysts normally must re-reverse the binary from scratch or pay high token costs letting an agent compare everything. This Skill migrates existing symbols and function names from an old version to a new one using cheap, structured LLM comparisons. ## Core Features & Use Cases - Cross-Version Symbol Migration: Compares old (symbolized) and new (unsymbolized) disassembly and pseudocode function-by-function, outputting a YAML mapping of calls, virtual calls, function pointers, global variables, and struct offsets. - Fixed Prompt Template with Programmatic I/O: A deterministic prompt template and YAML output schema enable batch processing at very low cost (about 200 functions for ~1 RMB with DeepSeek). - Iterative Anchor Expansion: Migrated functions become new anchors, letting the analysis spread through the binary; results are applied back to IDA via rename/comment operations. - Use Case: Microsoft removes the PDB for a new ntoskrnl.exe build. Load both versions in IDA, anchor on an exported function, and let the LLM identify that sub_140822108 corresponds to PspSetCreateProcessNotifyRoutine, then batch-apply the rename. ## Quick Start Ask the agent to migrate the symbols from my old analyzed binary to the new updated version using the binary diff workflow.

Frequently Asked Questions about binary-diff

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate symbols to a new binary version after an update?▼

Export disassembly and pseudocode of the same anchor function from both old and new versions in IDA, fill the fixed prompt template, and call an LLM API. Parse the returned YAML mapping and batch-apply renames to the new IDB, then iterate using migrated functions as new anchors.

What should I do when ntoskrnl.exe PDB symbols are unavailable?▼

Use an older ntoskrnl.exe version that still has PDB symbols as the reference. Anchor on exported functions present in both builds, compare them with the LLM prompt, and map internal functions like PspSetCreateProcessNotifyRoutine to their new addresses.

How does LLM-based binary diffing compare to BinDiff or Diaphora?▼

BinDiff and Diaphora are free and fast but degrade when code structure changes significantly between versions. LLM comparison handles structural changes better at low cost (about 1 RMB per 200 functions with DeepSeek), though results need manual spot-checking.

Which LLM model should I use for function comparison?▼

Use DeepSeek for small to medium functions under 200 lines since it is cheap and fast. Fall back to GPT-4o or Claude for very large functions over 500 lines or when context limits or accuracy issues appear.

What are the limitations of LLM-based symbol migration?▼

Only one function should be compared per call to avoid context overflow, and functions over 1000 lines of disassembly need splitting. Anchor selection must be reliable since a wrong anchor invalidates downstream results, and key symbols require manual verification.

Related Skills

Explore More Software Engineering Skills→
AradotsoAradotso
7

ida-no-mcp-decompiler-exporter

Export IDA Pro decompiled functions, disassembly, and memory dumps to files.

Official
Intermediate
HLND2THLND2T
60

find-TraceFunc-AND-g_GameTraceManager

Locate TraceFunc and g_GameTraceManager in CS2 server binaries via IDA Pro MCP.

Official
Advanced
andymaiandymai
20

parity-benchmarking

Compare brepkit performance and functionality against the reference kernel.

Community
Advanced
xalgordxalgord
954

analyzing-supply-chain-malware-artifacts

Compare trojanized binaries against legitimate versions to identify injected supply chain malware.

Community
Intermediate