Tutorial Map

graph TD;

A1[ CVE Research] --> A[CVE-2020-1048];
A1 --> B[CVE-2020-1337];
A1 --> C[CVE-2020-17001];
A1 --> D[CVE-2010-2729];
A1 --> E[CVE-2020-1030];
A --> F[CVE Analysis + Patch Diffing];
B --> F;
C --> F;
D --> F;
E --> F;
F --> I[System Comprehension]
F --> G[Vulnerability Classification];
F --> H[Root Cause Identification];
G --> J[Develop Mitigation Requirements / Novel Understanding];
H --> J;
I --> J;
J --> K[Discover New and/or Related Vulnerabilities]

Table of Contents

• CVE-Research
  • Identify platform
  • Identify CVE(s)
  • Seeking Patterns
• CVE-analysis
  • The Ideal Process
  • Template-for-CVE-analysis
  • Example CVE Analysis
  • Seeking Patterns
• Security-Patches
  • Platform Security Updates
  • Finding the relevant patch
  • Finding the binaries to compare
• Environment-Setup-and-Tooling
  • Binary Diffing Tools
• Patch-Diffing
  • Benefits
  • Feasibility
  • Tools
• Ghidra-Patch-Diffing
  • Patch Diffing With Ghidra
  • Version Tracker Workflow
• Patch-Diffing-Applied
  • CVE-2020-1048
  • CVE-2020-1337
  • CVE-2020-17001
• Root-Cause-Analysis
  • Treating the Symptom Rather Than the Cause
  • Formal Process
  • Practical Example
• Conclusion
  • CVE Analysis in the Light
  • Patch Diff in the Dark
  • Discovery