WinDiff skill
A skill that diffs two Windows builds by symbols, types and syscalls and writes a report for EDR, anti-cheat and bug hunting
- 397 ★ on the repository
- Last commit
- GPL-3.0
Extended access
Why this level
- The agent runs cargo run and Python scripts from the repository clone
- Generation downloads PE and PDB files from Winbindex and Microsoft, requiring disk space and network access
- Databases and reports are written to the local directory inside the clone
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/windiffDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent runs cargo run and Python scripts from the repository clone
- Generation downloads PE and PDB files from Winbindex and Microsoft, requiring disk space and network access
- Databases and reports are written to the local directory inside the clone
This is third-party code. Review the repository files before installing.
What it does
WinDiff builds databases of symbols, types and syscalls for Windows binaries and compares them across OS versions. The project has a Rust CLI that generates compressed JSON databases and a Next.js web frontend. The windiff-version-diff-analysis skill lives in the same repository and runs the whole process for the agent. You name two Windows versions as version, update and architecture, for example 21H2 BASE amd64, plus the binaries to compare. The skill builds a minimal config, runs windiff_cli, which downloads PE files from Winbindex and PDBs from Microsoft's symbol server, and computes the delta with the windiff_diff.py script. The script folds changes inside anonymous bitfield structs back to their named parent, so new mitigation flags such as _EPROCESS::MitigationFlags2Values do not drown in noise. The agent then interprets the result with Windows-internals knowledge and writes a report for three readers: anti-malware and EDR developers, anti-cheat developers and vulnerability researchers. The report covers new syscalls, mitigation flags, ETW telemetry and kernel callbacks, code-integrity changes and new components.
Who it is for. For Windows security researchers and EDR or anti-cheat developers who need to see quickly what Microsoft changed in the kernel and system libraries between builds.
Good fit when
- You want to compare ntoskrnl.exe between 21H2 and 24H2 and see what is new
- You are hunting for new syscalls or process mitigation flags in a Windows update
- You need to know what changed in win32k.sys or ci.dll and how it affects an EDR or an anti-cheat
- You want a markdown report where every finding explains what it is for and who should care
- The databases already sit in windiff_frontend/public and you only need the diff of one binary from the script, with no agent
Not a fit when
- You need function bodies analysed: WinDiff compares symbols, types and syscalls, and disassembly stays with you
- The Windows build you need is missing from Winbindex or its files have no unique download links
- You need to build new databases offline: downloading PE and PDB files needs external services, though existing databases can be compared locally
- Your target is not Windows: the tool works only with Microsoft PEs and PDBs
Example request
Diff ntoskrnl.exe between 25H2 and 26H1, tell me what is new and write the report into a markdown file.Limitations
Database generation requires Rust 1.85 or later and access to Winbindex and Microsoft’s symbol server; the comparison helper needs Python 3. Node.js 20.9 is only required for the web frontend. Cloning alone neither installs the CLI nor downloads the requested build databases.
The website keeps recent KB and Insider Preview databases; older versions can be built locally. Some PE files lack direct download links, leaving gaps. Compare matching architectures and distinguish base builds from cumulative updates.
The helper reports symbol and type changes, while the agent writes the interpretation. A new field does not prove changed program behavior or a vulnerability. Check the report against other evidence. The license is GPL-3.0.
How to disable. The skill loads when the repository is open in Claude Code or Codex, through aliases in .claude/skills and .agents/skills. Open another folder or delete the clone: generated databases sit in its local directory and go with it.
FAQ
How do I install the WinDiff skill in Claude Code?
Clone ergrelet/windiff and open it in Claude Code or Codex. The canonical skill sits in skills/windiff-version-diff-analysis, and aliases in .claude/skills and .agents/skills expose it to both agents without duplicate copies.
Which Windows versions can I compare?
A version is a triple: OS version, update and architecture, for example 21H2, BASE, amd64 or 11-24H2, KB5074105, amd64. BASE is the original image, a KB number is a cumulative update. Valid spellings are listed in ci/db_configuration.json.
Can I compute the diff without an agent?
Yes. The windiff_diff.py script has no third-party dependencies: with --list it shows the versions and binaries in a database directory, and given a binary name and two suffixes it prints a summary to stderr and JSON to stdout.
Why is data missing for some binaries?
Winbindex does not give a unique download link for every indexed file. Once the file shows up on VirusTotal the link becomes available and WinDiff picks it up automatically.
Which binaries should I compare if I do not know where to start?
By default the skill takes the security core: ntoskrnl.exe, ntdll.dll, win32k.sys, win32kbase.sys, win32kfull.sys, ci.dll and cng.sys. The reference in references/windows-components.md explains what each one governs.
Discussion
No questions or reviews yet.
Related
SkillsA scanner for skill directories: rules find obvious signs and an AI analyst in a read-only filesystem catches disguised chains.
A skill that finds Brotli decoder copies hit by CVE-2026-111497 in projects and container images and says what to update.
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
REx@Skill
REx-skill
Claude Code skill that finds and proves defects in compiled binaries using seven subagents and a pinned toolchain.
A plugin with 88 Microsoft security skills: Defender, Sentinel, Entra, Purview and Intune for Copilot, Claude Code and Cursor.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| WinDiff (this card) | no | 397 | ||
| GhidraMCP | no | not required | 11,907 | the agent decompiles and annotates a single binary in Ghidra and does not compare Windows versions |
| ida-mcp-rs | no | not required | 904 | headless IDA Pro for one file at a time, with no per-OS-version symbol database |
README in short
The comparison helper can be used independently of the website: it writes JSON to stdout and a short summary to stderr. Save the structured result and then pass it to an agent for interpretation.
README badge
Original SKILL.md
--- name: windiff-version-diff-analysis description: >- Generate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases. Use when comparing Windows builds or binaries such as ntoskrnl.exe, ntdll.dll, win32k*.sys, ci.dll, or cng.sys to find changed syscalls, symbols, types, mitigation flags, callbacks, ETW/EtwTi telemetry, code-integrity behavior, drivers, or attack surface. Explain likely intent and security relevance with Windows-internals knowledge, and frame findings for anti-malware/EDR, anti-cheat, and vulnerability-research audiences rather than returning an uninterpreted symbol list. --- # WinDiff Version Diff Analysis Compare two Windows builds and turn the raw symbol/type/syscall delta into a security-research report: what was added, what it probably *does*, and why it matters for attack surface, exploitation, or defense. Run this skill from a **WinDiff** repository checkout. It uses `windiff_cli` to generate the per-binary JSON databases, then diffs and interprets them. The interpretation is the point: explain intent from Windows internals conventions instead of merely listing symbols. ## Locate bundled resources Resolve all `scripts/` and `references/` paths relative to this `SKILL.md`, not relative to the current working directory and not through a harness-specific directory such as `.claude/` or `.agents/`. Before running a bundled script, set `SKILL_DIR` to the absolute directory containing this file. The examples below assume that has been done: ```bash SKILL_DIR="<absolute directory containing this SKILL.md>" ``` If separate shell-tool calls do not share environment, substitute that absolute path for `$SKILL_DIR` in each command instead of relying on prior shell state. Also identify the repository root (the directory containing `windiff_cli/`, `windiff_frontend/`, and `ci/`) and run repository commands from there. Keep generated configs, databases, and analysis artifacts under its git-ignored `local/` directory. ## Workflow ### 1. Pin down scope Establish, asking the user only if genuinely ambiguous: