stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
08390f0ca48c6d108d666de361fc2180a834ce54
git.stella-ops.org/docs/features/checked/binaryindex/patchdiffengine.md
master 5bca406787 save checkpoint: save features
2026-02-12 10:27:23 +02:00

2.6 KiB
Raw Blame History

PatchDiffEngine (Binary Pre/Post Patch Comparison for Fix Verification)

Module

BinaryIndex

Status

IMPLEMENTED

Description

Compares pre-patch and post-patch binaries at multiple levels (BasicBlock, CFG, StringRefs, Semantic/KSG fingerprints) to determine if a vulnerability has been remediated. Produces structured verification results with confidence scores based on match depth. Core verification logic for the Golden Set Diff Layer.

Implementation Details

  • Modules: src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/, src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/
  • Key Classes:
    • PatchDiffEngine (src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/PatchDiffEngine.cs) - core engine comparing pre/post binaries using ISignatureMatcher, IFunctionFingerprintExtractor, and IFunctionDiffer; produces PatchDiffResult with confidence scores
    • PatchDiffEngine (builders) (src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/PatchDiffEngine.cs) - builder-level diff engine
    • FunctionDiffer (src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/FunctionDiffer.cs) - function-level comparison with semantic analysis, call-graph edge diffing, and string reference comparison
    • FunctionRenameDetector (src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/FunctionRenameDetector.cs) - detects renamed functions between versions
    • VerdictCalculator (src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/VerdictCalculator.cs) - computes fix verification verdict from diff results
  • Models: PatchDiffResult, PatchDiffModels, DiffEvidenceModels, DiffOptions (src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/Models/)
  • Storage: IDiffResultStore, InMemoryDiffResultStore (src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/Storage/)
  • Source: SPRINT_20260110_012_004_BINDEX_golden_set_diff_verify.md

E2E Test Plan

  • Submit pre-patch and post-patch binaries for a known CVE fix and verify the diff result shows patch applied
  • Verify multi-level comparison: BasicBlock, CFG, StringRefs, and semantic fingerprints all contribute to confidence
  • Verify FunctionDiffer with IncludeSemanticAnalysis=true computes semantic similarity
  • Verify FunctionRenameDetector handles renamed functions between versions
  • Verify VerdictCalculator produces correct verdict (Fixed, Vulnerable, Unknown) based on diff evidence
  • Verify NoPatchDetected result is returned when binaries are identical
  • Verify diff results are persistable via IDiffResultStore with content-addressed IDs