From Fix to Flaw: Understanding and Revealing Incomplete Patches for Link Following Vulnerabilities

This is the artifact of the paper accepted at CCS 2026 Cycle 1 - From Fix to Flaw: Understanding and Revealing Incomplete Patches for Link Following Vulnerabilities. Requirements Prerequisites - Python 3.13+ - IDA 9.1+ - BinDiff - Graphviz Installation 1) Clone the repository. 2) Install Python dependencies: pip install -r ./requirements.txt 3) Configure paths in src/config.json: "bindiff_path": "C: path to bindiff bin", "ida_path": "C: path to ida.exe", "ida_dir": "C: path to ida directory", "log_path": "C: path to LinkDiff logs" 4) Install the patched ida-pro-mcp (includes the new BinDiff APIs in api_analysis.py): cd third_party/ida-pro-mcp pip uninstall ida-pro-mcp pip install build python -m build pip install ./dist/ida_pro_mcp-2.0.0-py3-none-any.whl ida-pro-mcp --install Usage Build the modified call chain: python src/LinkDiff.py -o <origin_binary> -p <patch_binary> [-c <cve_id>] Arguments: - -o, --origin : path to the original (vulnerable) binary - -p, --patch : path to the patched binary - -c, --cve : optional CVE ID for organizing output files Patch analysis using Agent: 1) Open the patched binary in IDA. 2) Start the ida-pro-mcp plugin in IDA(Ctrl+Alt+M by default). 3) From your MCP client (e.g., Cursor), use analysis-prompt.md to guide the agent. Make sure the path to the result generated in the previous step is included in the prompt. 4) Use classify-prompt.md to classify incomplete-patch types, again providing the results path. Example Here is an example analysis of CVE-2024-43551: This vulnerability exists in the Windows Storage service, and the service DLL is storsvc.dll. According to the MSRC update guide, you can download both the patched and unpatched binaries from winbindex and place them under the directory C:-2024-43551. Run LinkDiff.py to perform automated analysis: python src/LinkDiff.py -o C:-2024-43551-unpatch.dll -p C:-2024-43551-patched.dll -c CVE-2024-43551 After the analysis completes, you can find the results in the directory C:-2024-43551, including the modified call chain and bindiff database. In the modified call chain graph, you can clearly observe that multiple file-operation API call paths include the function StorageCleanup::TriggerStorageCleanup, which has been modified. This strongly suggests that this function is the one patched by Microsoft. At this point, you can open storsvc-patched.dll in IDA for further analysis. You will find that the function adds a Windows Internal Library (WIL) feature flag to remove the call to RunSilentCleanup. You may also use the agent to assist the analysis. Simply open the ida-pro-mcp plugin within IDA, and then add the path C:-2024-43551 to analysis-prompt.md so the agent knows where the analysis results are stored. The agent will then automatically analyze the data and generate a report.