Locate the change
Inspect changed, added, removed, moved or renamed function candidates where the available matching evidence supports them.
Delta Intelligence
Understand a release through the changes that matter.
A firmware update can change a component, its dependencies and the evidence behind an earlier security decision. FDIE connects release comparisons, component history and function evidence so the next review starts with context.
Component lineage
Follow identified components across analysed releases.
FunctionDiff
Inspect changes within supported binaries.
Triage carry-forward
Review an earlier decision before applying it again.
The history behind a package
See the component in its release context.
Start with two analysed images from the same product lineage. Compare added, removed and changed components, then inspect the identification evidence and analysis coverage on both sides.
A changed version can explain a vulnerability difference, but it is not the only explanation. Identification may have improved, the vulnerability feed may have changed, or part of one image may not have been recovered. Keeping that context beside the comparison helps the engineer choose the right follow-up.
Release A
The component is identified
The analyst records the observed version, an applicable advisory and the reason for the initial disposition.
Release B
The component changes
The comparison highlights the new identity or version and presents the earlier review context.
Review
The decision is verified
The owner investigates the relevant code or supplier evidence before confirming remediation or reusing the disposition.
Example workflow, not a live device timeline or an automatic fix verdict.
Dependency impact
Find the recorded consumers of a changed component.
A shared library can appear in several images or support multiple binaries. FDIE uses the relationships recovered during analysis to help trace the component through the firmware library. Inspect recorded aliases, imports and dependencies before deciding which release owners need to act.
| Question | Evidence to inspect | Result of the review |
|---|---|---|
| Where was the component identified? | Product, image, recovered path and component identity | A list of analysed releases that need investigation |
| Which binaries use it? | Available linking and dependency relationships | Known consumers, with unresolved relationships kept separate |
| What changed in this release? | Version, licence, binary and advisory differences | A scoped set of changes for engineering review |
| Does the change affect deployed devices? | The firmware evidence plus your deployment inventory | A customer-owned assessment of field exposure |
The firmware library describes analysed artifacts. It does not automatically discover every physical device in the field. Combine the result with your product and deployment records when planning an update.
FunctionDiff
Look inside the binary when a version string is not enough.
Vendor backports, custom builds and rebuilds can make package labels an incomplete explanation of a patch. FunctionDiff compares available function evidence between releases and brings changed candidates into focus for a closer investigation.
Earlier binary
Available function identity, symbols and analysis evidence
Candidate binary
Changed or matched function candidates and comparison quality
Analyst verification
Relate the changed function to the affected path, supplier explanation or reproducing test. Record whether the evidence establishes the intended correction.
Review workflow. A candidate match or binary change is not an automatic remediation verdict.
Read the comparison quality
Symbols and decompilation are not always available on both sides. One-sided or unconfirmed comparisons remain provisional.
Validate the patch
Connect the changed function to the vulnerability, vendor explanation or an appropriate test. Changed bytes alone do not confirm a fix.
Triage carry-forward
Preserve the reasoning. Review its continued applicability.
When a matching vulnerability appears in a later analysed release, an earlier status and note can be offered to the analyst. That saves the work of finding the old investigation and makes the original assumptions visible.
The analyst decides whether to accept or revise the suggestion. A changed component, dependency, code path or advisory can invalidate the old reason. The new release should retain the decision that was actually reviewed, rather than silently inheriting one.
Read the earlier reason
Check the original release, component identity and evidence that supported the prior disposition.
Compare the relevant assumptions
Inspect what changed in the component, affected path and intelligence. Identify where fresh validation is needed.
Record the current decision
Accept or revise the suggestion and preserve the rationale with the new release's evidence and exports.
A repeatable release review
Compare more than the vulnerability total.
Use a related release pair, check both analysis records and investigate the material changes. Keep engine and feed context in view so a change in analysis is distinguishable from a change in firmware.
Release-comparison guideDoes an absent finding mean the patch worked?
Not by itself. Component removal, identification changes, coverage differences or updated intelligence can all change a match. Use vulnerability-specific evidence to confirm the outcome.
Are previous dispositions automatically reapplied?
No. Carry-forward offers an earlier record for an analyst to review. The decision must be assessed against the current release.
Does comparison consume another new-image analysis?
Comparisons of already analysed releases do not use a new-image analysis under the published FDIE self-service catalogue. Each newly uploaded image has its own allowance treatment.
FDIE · next step
Bring the release you ship and the release you plan to ship.
Use Delta Intelligence to identify the component changes, inspect patch candidates and retain the decisions that belong to the next release.
Paid at checkout. 14-day money-back guarantee on the first payment if three or fewer new images have been analysed.