Updated 2d ago
by ergrelet
windiff
Tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI and/or LLMs.
392 GitHub stars (392)
+2 in 20 days
| Period | New stars |
|---|---|
| Sep 27 | 0 |
| Sep 28 | 0 |
| Sep 29 | 0 |
| Sep 30 | 0 |
| Oct 1 | 0 |
| Oct 2 | 0 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | 0 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | 0 |
| Oct 14 | +1 |
| Oct 15 | +1 |
| Oct 16 | 0 |
- 1 skill (1 skills found in its SKILL.md files)
- 20 forks (20 forks)
- 2d ago last update (Last updated 2d ago)
Install
Skills CLI
npx skills add ergrelet/windiff
Asks which agents to install it for. Add -g to install it for every project.
Claude Code
git clone https://github.com/ergrelet/windiffcp -r "windiff/skills/windiff-version-diff-analysis" ~/.claude/skills/
Copies the windiff-version-diff-analysis skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project).
Plugin
/plugin marketplace add ergrelet/windiff
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
windiff-version-diff-analysis
Generate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases. Use when comparing Windows builds or binaries such as ntoskrnl.exe, ntdll.dll, win32k*.sys, ci.dll, or cng.sys to find changed syscalls, symbols, types, mitigation flags, callbacks, ETW/EtwTi telemetry, code-integrity behavior, drivers, or attack surface. Explain li…
skills/windiff-version-diff-analysis/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.