skills.rest
MDSIXONE
MDSIXONECOMMUNITY
Explore all skills by this author →
GitHub

binary-diff

Migrate symbols across binary versions using LLM-based disassembly comparison.

Updated Aug 14, 2026
Search Tags:#llm#reverse engineering#pdb#disassembly#ida pro#binary diffing#symbol migration
One-click install
npx skills add https://github.com/MDSIXONE/opencode-config --skill binary-diff-mdsixone
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-diff
Source: https://github.com/MDSIXONE/opencode-config/tree/main/skills/reverse-skill/skills/binary-diff
Command: npx skills add https://github.com/MDSIXONE/opencode-config --skill binary-diff-mdsixone

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, httpx, and includes references (resource) components.

What problem does it solve? When a binary is updated and its symbols or PDB files are unavailable, reverse engineers must redo hours of manual analysis. This Skill migrates existing reverse-engineering results (function names, global variables, struct offsets) from an old version to a new one by having an LLM compare disassembly and pseudocode pairs, at roughly 1 yuan per 200 functions. ## Core Features & Use Cases - Cross-Version Symbol Migration: Compares old (symbolized) and new (stripped) function disassembly and pseudocode, outputting a structured YAML mapping of calls, virtual calls, function pointers, globals, and struct offsets. - Fixed Prompt Template with Programmatic Parsing: Uses a deterministic prompt template and YAML output schema so results can be batch-applied to the new IDB via IDAPython rename/comment operations. - Iterative Anchor-Based Workflow: Starts from reliable anchors (exported functions, string references) and iterates inward, with model selection guidance (DeepSeek for small functions, GPT-4o/Claude for large ones). - Use Case: You have full symbols for ntoskrnl.exe build 10.0.26100.2000 but Microsoft pulled the PDB for build 10.0.26100.2605. Export the same anchor function from both versions, run the LLM comparison, and recover internal function addresses like PspSetCreateProcessNotifyRoutine in the new build. ## Quick Start Ask the AI to migrate symbols from the old version of a binary to the new one by comparing the disassembly and pseudocode of a shared anchor function and applying the resulting YAML symbol map in IDA.

Frequently Asked Questions about binary-diff

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate symbols to a new binary version without PDB files?▼

Export disassembly and pseudocode of a shared anchor function from both the old symbolized binary and the new stripped one, then have an LLM compare them and output a YAML symbol mapping. Apply the mapping to the new IDB with IDAPython rename and comment operations.

Binary diff vs BinDiff or Diaphora for symbol migration?▼

BinDiff and Diaphora use structural graph matching, which degrades when code structure changes significantly between versions. LLM-based comparison reads the actual code semantics, maintaining accuracy on structurally changed functions at roughly 1 yuan per 200 functions.

Which LLM should I use for binary function comparison?▼

Use DeepSeek for small to medium functions under 200 lines due to its low cost and speed. Switch to GPT-4o or Claude for very large functions over 500 lines or when DeepSeek results are inaccurate or exceed context limits.

What are the limitations of LLM-based binary diffing?▼

Results are not 100 percent accurate, so critical symbols require manual spot-checking. The approach also depends on reliable anchor functions; if anchors are mismatched between versions, all downstream migrations will be wrong.

How do I handle very large functions during symbol migration?▼

Compare only one function per LLM call to avoid context overflow. Functions exceeding 1000 lines of disassembly should be split into chunks or sent to a large-context model such as GPT-4o or Claude Opus.

Related Skills

Explore More Software Engineering Skills→
chengzongcaichengzongcai
21

binary-diff

Migrates symbols across binary versions using LLM-based structured comparison of disassembly and pseudocode.

Community
Intermediate
apexradiusapexradius

name-plan

Renames plan files and code symbols with git-aware safety checks.

Official
Advanced
ubie-ossubie-oss
16

investigate-deprecated-apis

Scan internal/lightdash/api for deprecated v1 patterns and cross-reference the OpenAPI spec.

Official
Intermediate
xalgordxalgord
954

analyzing-supply-chain-malware-artifacts

Compare trojanized binaries against legitimate versions to identify injected supply chain malware.

Community
Intermediate