Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

WinDiff Version Diff Analysis

Uses the WinDiff CLI to diff two Windows builds and interpret new syscalls, structs, mitigation flags, and ETW/callback surface into a security-research report.

Security & ReviewAdvanced★ 392⑂ 21AI score 8/10Last updated: Aug 11, 2026

What it does

  • Runs windiff_cli inside the WinDiff repo to generate symbol/type/syscall databases for two Windows versions (or two patch levels of one version).
  • Builds a minimal config with make_config.py and computes per-binary added/removed/modified deltas with windiff_diff.py.
  • Resolves anonymous bitfields (_unnamed_0xNNNN) back to their named parents so new mitigation bits — e.g. a new bit under _EPROCESS::MitigationFlags2Values — aren't lost as noise.
  • Goes beyond symbol lists: infers intent from Nt/Zw/Ps/Ke/Mm/Ob/Se/Cm/Etw/Ci prefixes and component roles, then writes a report framed for anti-malware/EDR, anti-cheat, and vulnerability-research audiences.

Who it's for

  • Windows kernel security researchers and vulnerability hunters
  • EDR / anti-malware developers tracking new ETW providers, Ps/Ob/Cm callbacks, and the EtwTi channel
  • Anti-cheat developers watching PPL, anti-tamper, and handle/object hardening changes
  • Teams that must document attack-surface changes after each Windows update

Example uses

  • "Diff ntoskrnl.exe between 21H2 and 24H2 and list the new syscalls."
  • "What changed in win32k.sys and ci.dll in this KB — show me only new mitigation flags."
  • "Any new ETW providers or kernel callbacks in this build, and what do they mean for EDR visibility?"

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/ergrelet/windiff/HEAD/.claude/skills/windiff-version-diff-analysis/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the .claude/skills/windiff-version-diff-analysis folder from the GitHub repo ergrelet/windiff into my ~/.claude/skills/windiff-version-diff-analysis/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/ergrelet/windiff.git && mkdir -p ~/.claude/skills && cp -r windiff/.claude/skills/windiff-version-diff-analysis ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Make sure you have the Rust toolchain (cargo) and Python 3 installed. Network access is required: PEs come from Winbindex and PDBs from MSDL.
  2. Clone the repo: git clone https://github.com/ergrelet/windiff.git
  3. Copy the skill into your personal skills directory: mkdir -p ~/.claude/skills && cp -r windiff/.claude/skills/windiff-version-diff-analysis ~/.claude/skills/
  4. The skill is designed to run inside the WinDiff repo, so cd windiff before launching Claude Code (you can skip step 3 since the repo already ships .claude/skills/).
  5. Create a scratch directory for output: mkdir -p local
  6. Ask Claude something like "diff ntoskrnl.exe between 21H2 and 11-24H2"; the skill will generate the config, run the CLI, diff the databases, and write an interpreted report.
  7. Check ci/db_configuration.json in the repo for valid version/update spellings before requesting a build.
View source on GitHub ↗License: GPL-3.0