ergrelet/windiff

Tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI and/or LLMs.

What it solves

WinDiff provides a way to track and compare changes in Microsoft Windows binaries across different OS versions. It simplifies the process of identifying new symbols, types, and syscalls that appear in Windows updates, which is otherwise a manual and tedious process for security researchers.

How it works

The project consists of a CLI tool written in Rust that downloads PE and PDB files via Winbindex and reconstructs types using resym to create compressed JSON databases. A Next.js web frontend then visualizes this data, allowing users to browse and compare binaries. Additionally, a Python-based diff helper script can be used to generate structured JSON reports of changes between versions.

Who it’s for

This tool is primarily designed for vulnerability researchers, anti-malware/EDR developers, and anti-cheat developers who need to understand internal Windows changes to maintain compatibility or find new attack vectors.

Highlights

  • Automated Updates: Uses GitHub Actions to fetch the latest Windows updates and Insider Previews daily.
  • Agent-Ready: Includes an "Agent Skill" that allows AI assistants like Claude Code or Codex to automate the analysis of binary diffs and interpret the results.
  • Detailed Analysis: Tracks changes in exports, symbols, modules, syscalls, and complex type/bitfield changes.
  • Web-Based Visualization: Provides a user-friendly interface for browsing binary information across versions.

Related

  • Project
    Joyi-code/DeepSeekMonitorWindows

    A Windows desktop application built with Tauri and Rust to monitor DeepSeek API account balances, monthly spending, and token usage trends.

  • Project
    Ataraxy-Labs/sem

    A semantic version control tool built on Git that tracks changes at the entity level (functions, classes, methods) rather than lines, providing deeper insights for humans and AI agents.

  • Project
    tanishqkancharla/calldiff

    A tool that diffs call stacks across git commits to visualize changes in function call flows, supporting 23 languages and providing structured output for AI agents.

  • Project
    aardio/ImTip

    A Windows desktop assistant that provides cursor-side input method status indicators and programmable AI-powered hotkeys for translation and productivity.

  • Project
    modiqo/cliare

    A tool that audits command-line interfaces by probing runtime behavior to create an evidence-backed command index, reducing token burn and errors for AI agents using CLIs.