RE Toolkit (5/5): malware triage and patch diffing — capa, FLOSS, YARA-X, BinDiff, ghidriff

Two questions come up constantly in security work: "What can this unknown file do?" and "What did the patch that just shipped fix?". Answering them by reading every function in Ghidra takes days. The final part of the RE Toolkit series covers repos that automate both: capa, FLOSS and YARA for fast triage, BinDiff, Diaphora and ghidriff for patch diffing, plus three learning repos to keep going.

GitHub: https://github.com/mandiant/capa · about 6.3k stars · Python · Apache-2.0

Part 1: fast triage

capa: capabilities instead of signatures

capa takes a PE, ELF, .NET module, shellcode or sandbox report and matches it against the community rule set (the capa-rules repo) to list capabilities mapped to MITRE ATT&CK. Results like "send HTTP request", "create service" or "execute shell command" tell you which functions to open first.

capa sample.exe          # ATT&CK table + capability list
capa -v sample.exe       # verbose: where each capability lives

Results can be explored visually in capa Explorer Web or loaded into IDA/Ghidra to jump to the relevant functions.

FLOSS and YARA

FLOSS emulates decoding routines to recover hidden strings, often revealing C2 URLs, mutex names and registry keys. YARA turns those findings into rules to scan thousands of other files:

floss sample.exe

rule Suspicious_Downloader {
  strings:
    $api = "URLDownloadToFileA" ascii
    $cmd = "cmd.exe /c" ascii nocase
  condition:
    uint16(0) == 0x5A4D and all of them
}

yr scan rules.yar ./samples/     # YARA-X

Part 2: patch diffing

When a vendor ships a security fix without details, diffing the binary before and after shows exactly which functions changed. Defenders use it to judge urgency and write detections; developers use it to check that a third-party library's patch really matches its changelog.

ghidriff: a patch diff in one command

ghidriff uses free Ghidra to find added, deleted and modified functions, plus "meta diffs" of strings and callers/callees. Per its README, once Ghidra analysis is done it can diff the entire Windows kernel in under a minute.

pip install ghidriff        # requires an installed Ghidra
ghidriff old/driver.sys new/driver.sys
# or with Docker:
docker run -it --rm -v $(pwd)/ghidriffs:/ghidriffs \
  ghcr.io/clearbluejar/ghidriff:latest ghidriffs/old.sys ghidriffs/new.sys

The Markdown output can be pasted straight into a gist, internal wiki or ticket, so the whole team can review it.

Part 3: repos to keep learning

• mytechnotalent/Reverse-Engineering (~15.1k stars): free course covering x86, x64, 32/64-bit ARM, 8-bit AVR and RISC-V.
• guyinatuxedo/nightmare (~3.3k stars): binary exploitation and reversing course built on real CTF challenges.
• wtsxDev/reverse-engineering (~10.8k stars): an "awesome" resource list; last updated in 2023, so some links are stale.

Caveats

• capa and YARA are only as good as their rules; new or heavily obfuscated samples may match nothing.
• FLOSS emulates the sample's code rather than running it natively, but still use it inside an analysis VM.
• Diffing builds from different compilers or optimisation levels yields lots of noise; compare adjacent versions.

How to apply it

• Dev / SOC: Wrap capa + floss + yr scan into one triage script that runs on every suspicious file before anyone opens Ghidra.
• Tech Lead: When a critical native library ships a security fix, run ghidriff between the two versions and attach the report to the upgrade ticket.
• PM: Automated triage decides within minutes which files need an expert, instead of queueing everything for manual analysis.