Vendor releases 500 driver updates/year
├── 490 are feature/performance/cosmetic changes
├── 8 are minor bug fixes
└── 2 are silent security fixes (no CVE assigned)

Without automation: Manually review 500 to find 2
With AutoPiff:      Review 10 high-scorers to find 2

┌─────────────────────────────────────────────────────────────────┐
│  AUTOMATED by AutoPiff                                          │
│  ├── Find the needle: "This function changed near ExFreePool"   │
│  ├── Classify: "Looks like a use-after-free fix"                │
│  └── Rank: "Score 5.5 - worth investigating"                    │
├─────────────────────────────────────────────────────────────────┤
│  STILL MANUAL (Your expertise)                                  │
│  ├── Confirm exploitability: "Can I actually trigger this?"     │
│  ├── Root cause analysis: "Why was this vulnerable?"            │
│  ├── Exploit development: "How do I reach this sink?"           │
│  └── Impact assessment: "What's the real-world risk?"           │
└─────────────────────────────────────────────────────────────────┘

final_score = semantic_score + reachability_bonus + sink_bonus - penalties

git clone https://github.com/splintersfury/AutoPiff.git
cd AutoPiff
docker compose up -d

pip install pyyaml

from services.karton_patch_differ.rule_engine import SemanticRuleEngine

engine = SemanticRuleEngine('rules/semantic_rules.yaml', 'rules/sinks.yaml')
hits = engine.evaluate(func_name, old_code, new_code, diff_lines)

rules:
  - rule_id: my_custom_rule
    category: bounds_check
    confidence: 0.85
    required_signals:
      - sink_group: memory_copy
      - change_type: guard_added
      - guard_kind: length_check
    plain_english_summary: Added length validation before memory copy.

{
  "pairing": {
    "driver_new": {"sha256": "...", "version": "2.0.9.0"},
    "driver_old": {"sha256": "...", "version": "2.0.8.0"},
    "decision": "accept",
    "confidence": 0.95
  },
  "semantic_deltas": {
    "deltas": [
      {
        "function": "HandleIoctl",
        "rule_id": "null_after_free_added",
        "category": "lifetime_fix",
        "confidence": 0.88,
        "sinks": ["pool_free"],
        "final_score": 5.5,
        "why_matters": "Pointer is now set to NULL after freeing memory."
      }
    ],
    "summary": {
      "total_deltas": 1,
      "top_score": 5.5,
      "match_rate": 100.0
    }
  }
}

AutoPiff/
├── Docs/                          # डिज़ाइन दस्तावेज़ और विशिष्टताएँ
├── ghidra/scripts/                # Ghidra हेडलेस स्क्रिप्ट
│   └── autopiff_reachability.py   # पहुंच BFS + डीकंपाइलेशन निर्यात
├── rules/
│   ├── semantic_rules.yaml        # 58 पता लगाने के नियम
│   ├── sinks.yaml                 # 50+ खतरनाक API प्रतीक
│   └── scoring.yaml               # स्कोरिंग मॉडल कॉन्फ़िगरेशन
├── schemas/                       # प्रत्येक चरण के लिए JSON स्कीमा
├── services/
│   ├── karton-patch-differ/       # चरण 1-4: डिफिंग + सिमैंटिक विश्लेषण
│   ├── karton-reachability/       # चरण 5: कॉल-ग्राफ + डीकंपाइलेशन
│   ├── karton-ranking/            # चरण 6: स्कोरिंग
│   ├── karton-report/             # चरण 7: रिपोर्ट निर्माण
│   ├── karton-driver-triage/      # DriverAtlas हमले की सतह ट्रायेज
│   ├── autopiff-alerter/          # चरण 8: Telegram अलर्ट
│   ├── driver-monitor/            # चरण 0: संस्करण पोलिंग
│   └── dashboard/                 # वेब UI
├── tests/unit/                    # 137 यूनिट परीक्षण
├── docker-compose.yml
└── README.md

# In driver_analyzer/docker-compose.yml
karton-driver-patch-differ:
  build:
    context: ../AutoPiff
    dockerfile: services/karton-patch-differ/Dockerfile
  volumes:
    - ../AutoPiff/rules:/app/rules:ro