From patch-diff-analyzer
Decompiles and diffs compiled binaries (JARs, DLLs) to identify security fixes and version changes. Useful for reverse-engineering patch analysis.
How this skill is triggered — by the user, by Claude, or both
Slash command
/patch-diff-analyzer:patch-diff-analyzerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
**IMPORTANT**: Users may request analysis of security patches in compiled binaries (JARs, DLLs, etc.) to understand what vulnerabilities were fixed. This extension helps decompile binaries, generate diffs, and identify security-relevant changes.
IMPORTANT: Users may request analysis of security patches in compiled binaries (JARs, DLLs, etc.) to understand what vulnerabilities were fixed. This extension helps decompile binaries, generate diffs, and identify security-relevant changes.
The extension have these scripts:
<workspace-name>What it does:
decompiled/, output/What it does:
What it does:
What it does:
unpatched and patched tags (or uses HEAD~1 and HEAD)patch-analysis.diff filechanged-files.txt listWhen a user requests patch analysis:
Identifying Binaries: Do you need to determine which file is patched vs unpatched?
File Format: What type of binary are you analyzing?
Analysis Context: Does the user provide vulnerability information?
CRITICAL: Before decompilation, correctly identify which binary is the patched version.
Explicit Naming:
patched.jar / unpatched.jarvulnerable.jar / fixed.jarVersion Numbers:
app-1.2.3.jar vs app-1.2.4.jarFile Timestamps:
ls -lt *.jar
When Ambiguous:
Use the provided setup script.
CRITICAL: For WAR files or large applications, extract ONLY proprietary code before decompiling. This saves significant time and storage.
WAR file structure:
application.war
├── WEB-INF/
│ ├── classes/ ← Application code (DECOMPILE THIS)
│ │ └── com/
│ │ └── vendor/ ← Proprietary packages
│ └── lib/ ← Third-party JARs (SKIP THESE)
│ ├── jackson-*.jar
│ ├── spring-*.jar
│ └── hibernate-*.jar
└── META-INF/
# 1. List WAR contents to identify proprietary packages
unzip -l unpatched.war | grep "WEB-INF/classes" | grep "\.class$" | head -30
# Look for company-specific packages:
# WEB-INF/classes/com/acme/
# WEB-INF/classes/com/vendor/
# WEB-INF/classes/org/internal/
# 2. Extract ONLY proprietary classes
mkdir -p temp-unpatched
unzip unpatched.war "WEB-INF/classes/com/vendor/*" -d temp-unpatched/
unzip unpatched.war "WEB-INF/classes/com/acme/*" -d temp-unpatched/
# 3. Create JAR from extracted classes
cd temp-unpatched/WEB-INF/classes
jar cf ../../../vendor-unpatched.jar .
cd ../../..
# 4. Repeat for patched version
mkdir -p temp-patched
unzip patched.war "WEB-INF/classes/com/vendor/*" -d temp-patched/
unzip patched.war "WEB-INF/classes/com/acme/*" -d temp-patched/
cd temp-patched/WEB-INF/classes
jar cf ../../../vendor-patched.jar .
cd ../../..
# Now decompile ONLY proprietary code (much faster!)
cd <workspace>
git add -A
git commit -m "Unpatched version"
git tag unpatched
CRITICAL: The unpatched tag is used by the diff analysis script.
IMPORTANT: Clear the decompiled directory first to avoid mixing files.
rm -rf <workspace>/decompiled/*
cd <workspace>
git add -A
git commit -m "Patched version"
git tag patched
CRITICAL: The patched tag is used by the diff analysis script.
Follow the same git commit process as the JAR workflow:
<workspace> to generate patch-analysis.diff and changed-files.txt listMANDATORY: Read the generated diff file completely.
DO NOT use grep or pattern matching. The LLM must read and reason about the actual code changes.
CRITICAL: This is where you apply security expertise to understand the vulnerability fix.
MANDATORY FIRST STEP: Before analyzing changes, separate proprietary code from third-party libraries.
Why This Matters:
High-Priority Indicators:
MANDATORY: Use this structure for your analysis report:
# Patch Analysis Summary
## Overview
[Brief description of what was analyzed]
## Vulnerability Identified: [Type/CVE]
**Severity**: [Critical/High/Medium/Low]
## Detailed Analysis
### File: [path/to/file.java:line-range]
[Detailed analysis following the framework above]
## Completeness Assessment
[Is the fix complete? Any potential bypasses? Additional recommendations?]
## Confidence Level
Overall confidence: [HIGH/MEDIUM/LOW] ([percentage]%)
Solution: Install jadx (for JAR) or ilspycmd (for DLL)
Solution: Run setup-workspace.sh script first
Solution: Ensure both unpatched and patched versions were committed
Solution:
git log to see commitsnpx claudepluginhub hacktronai/skills --plugin patch-diff-analyzerCompares function disassembly between binary sessions: generates byte signatures to relocate functions after updates, disassembles, and reports changes. Useful for tracking patches.
Decompiles Android APK files to readable Java source using jadx. Useful for security analysis, vulnerability discovery, finding hardcoded credentials, and understanding app internals.
Performs depth-first reverse engineering on Ghidra binaries, answering questions like function behavior, crypto usage, or C2 addresses via iterative analysis and database improvements.