Windiff Version Diff Analysis

If you need to know what Microsoft changed between Windows builds,new syscalls, mitigation flags, kernel callbacks, ETW providers,this skill runs WinDiff's CLI to diff the binaries and then actually interprets the results. It doesn't just dump symbol lists. It explains what new MitigationFlags2Values bits do, which EtwTi channels appeared, whether ci.dll or win32k got new lockdown surface. The workflow generates databases for both versions, diffs ntoskrnl/ntdll/win32k/ci.dll, and frames findings for EDR developers (new telemetry hooks), anti-cheat teams (PPL changes), and vuln researchers (attack surface deltas). The scripts handle the noisy parts like anonymous struct renaming and syscall renumbering so you can focus on what the changes mean for security posture.

Install to Claude Code

npx -y skills add ergrelet/windiff --skill windiff-version-diff-analysis --agent claude-code