Patch Different on *OS

Patch diffing compares two builds of a binary to reveal what a security fix changed. John McIntosh explains why Apple platforms make this harder than Windows: updates ship as IPSW archives, system binaries are packed into the dyld shared cache, and iOS, macOS, watchOS and tvOS each receive their own updates. The opening section covers finding CVEs on Apple's security release pages and choosing a build to compare against the one before it.

The middle of the talk covers the workflow. The ipsw tool downloads two firmware versions, diffs them, and extracts the changed binaries, including those inside the shared cache. The binaries are then loaded into Ghidra and compared with Griff, an open-source diffing tool the speaker wrote, to list added, removed and modified functions. Case studies follow: a telephony use-after-free matched against a published write-up, a crypto library timing fix that introduced a safer decode routine, and a privacy-control issue where the fix was an entitlement change with no code difference, so dynamic testing was needed to confirm the path.

The closing point is that diffing shrinks thousands of functions to a handful worth reviewing, but tying them to a CVE still takes experience. Newcomers are advised to take one CVE end to end, using public research as a check on their own conclusions.