WinDiff Version Diff Analysis

A community Agent Skill by Erwan Grelet (ergrelet) from WinDiff, his open-source tool for browsing and comparing symbol, type and syscall information in Microsoft Windows binaries across versions. The skill compares two Windows builds or patch levels and turns the raw delta into a security-research report: what was added, what it probably does, and why it matters for attack surface, exploitation or defense. What you can do with it - Compare two Windows versions or KB updates for binaries such as ntoskrnl.exe, ntdll.dll, win32k*.sys, ci.dll and cng.sys - Find new or changed syscalls, symbols, types, mitigation flags, callbacks and ETW telemetry - Spot changes to code-integrity behavior, drivers and attack surface - Get findings explained with Windows-internals context and framed for anti-malware and EDR, anti-cheat, or vulnerability-research readers How it works - Run it from a WinDiff repository checkout. It writes a minimal config for the two builds and the binaries you pick, then runs windiff_cli to build the databases. - Its diff script computes the changes per binary, so nothing is counted by hand, and the agent writes the interpretation. - If you already have WinDiff databases, it skips generation and diffs those. Good to know - Generating databases downloads binaries via Winbindex and symbols from Microsoft's symbol server, so it needs network access and takes minutes per binary. - It needs Rust (for windiff_cli) and Python for the helper scripts. - Built for defensive and vulnerability research on public Windows builds.