AUTOPIFF

Summary from the TLDR InfoSec newsletter

AutoPiff is a semantic analysis engine that automates the detection of security-relevant changes in Windows kernel driver patches using 58 YAML-based rules across 22 vulnerability categories, including use-after-free fixes, bounds check additions, and IOCTL input validation. The framework runs as a Karton microservice pipeline integrating Ghidra decompilation, function matching, call-graph reachability analysis, and exploitability scoring to reduce manual driver pair analysis from 4-12 hours to under 5 minutes. Designed for silent patch detection and 1-day vulnerability research, it tracks 50+ dangerous API sinks and alerts on high-scoring findings via Telegram.