Windiff Version Diff Analysis

If you need to know what Microsoft changed between Windows builds,new syscalls, mitigation flags, kernel callbacks, ETW providers,this skill runs WinDiff's CLI to diff the binaries and then actually interprets the results. It doesn't just dump symbol lists. It explains what new MitigationFlags2Values bits do, which EtwTi channels appeared, whether ci.dll or win32k got new lockdown surface. The workflow generates databases for both versions, diffs ntoskrnl/ntdll/win32k/ci.dll, and frames findings for EDR developers (new telemetry hooks), anti-cheat teams (PPL changes), and vuln researchers (attack surface deltas). The scripts handle the noisy parts like anonymous struct renaming and syscall renumbering so you can focus on what the changes mean for security posture.

GitHub stars: 387
last updated: Jun 10, 2026

View on GitHub

Install

$ npx -y skills add ergrelet/windiff --skill windiff-version-diff-analysis --agent claude-code

Installs into .claude/skills of the current project.

Files

WinDiff Version Diff Analysis

Compare two Windows builds and turn the raw symbol/type/syscall delta into a security-research report: what was added, what it probably does, and why it matters for attack surface, exploitation, or defense.

Run this skill from a WinDiff repository checkout. It uses windiff_cli to generate the per-binary JSON databases, then diffs and interprets them. The interpretation is the point: explain intent from Windows internals conventions instead of merely listing symbols.

Locate bundled resources

Resolve all scripts/ and references/ paths relative to this SKILL.md, not relative to the current working directory and not through a harness-specific directory such as .claude/ or .agents/. Before running a bundled script, set SKILL_DIR to the absolute directory containing this file. The examples below assume that has been done:

SKILL_DIR="<absolute directory containing this SKILL.md>"

If separate shell-tool calls do not share environment, substitute that absolute path for $SKILL_DIR in each command instead of relying on prior shell state.

SKILL.md on GitHub

Details

Repository: github.com/ergrelet/windiff
Categories: Git & Pull Requests, Release Management
License: GPL-3.0
First seen: Jun 11, 2026