WinDiff for Windows Binary Comparison and Analysis

WinDiff is an open-source web-based tool for browsing and comparing symbols, data types, and system call information extracted from Microsoft Windows binaries across different operating system versions. It helps reverse engineers, malware analysts, and Windows security researchers identify changes in internal structures and exported functions between releases.

Inspired by ntdiff and built with data from Winbindex, WinDiff provides a searchable interface for examining information derived from Windows Portable Executable (PE) files and Program Database (PDB) files. Its database configuration can be updated as new Windows releases and updates become available.

Key Features of WinDiff

Binary information comparison: Browse and compare symbols, reconstructed types, and system call information across supported Windows versions.
Windows release tracking: The project can incorporate information from regular Windows updates and Insider Preview releases.
Web-based interface: Explore generated databases through a frontend designed to make cross-version comparisons easier.
Automated database updates: Scheduled GitHub Actions help refresh the configuration used to generate the live database.
Custom database generation: Developers can modify the configuration and build a local instance to track additional binaries or Windows versions.

How WinDiff Works

WinDiff consists of two main components: a command-line database generator written in Rust and a web frontend built with TypeScript and Next.js.

1. Rust-Based CLI

The CLI generates compressed JSON databases from a configuration file. It uses Winbindex to locate and download supported Windows PE binaries and their associated PDB files. Type information is reconstructed with resym, helping make internal structures available for comparison.

This design separates data collection and processing from the web interface. Developers can regenerate the databases when new Windows updates become available or adjust the configuration to suit a particular research project.

2. TypeScript and Next.js Frontend

The frontend displays the information generated by the CLI. Researchers can browse binary metadata and compare information extracted from different Windows releases, making it easier to investigate changes in functions, symbols, and data structures.

The source code is organized into two principal directories:

windiff_cli: Contains the Rust command-line tool used to generate databases.
windiff_frontend: Contains the Next.js frontend used to display and compare the generated data.

3. Automated Database Maintenance

A scheduled GitHub Actions workflow checks Winbindex for updates and refreshes the configuration used by the live service. Due to hosting storage and compute limits, the live database retains only supported cumulative updates and Insider Preview updates less than one year old, as described by the project.

Some binary records may be unavailable because Winbindex cannot provide unique download links for every indexed file. The availability of a binary’s information therefore depends on the underlying data sources and the project’s database generation process.

Building WinDiff Locally

Building a local copy allows researchers to customize the database configuration and work beyond the retention limits of the hosted instance. The project’s documented prerequisites include:

Rust 1.68 or later
Node.js 16.8 or later
Git and npm

Start by cloning the official repository and entering the project directory:

git clone https://github.com/ergrelet/windiff.git
cd windiff

Verify the installed toolchain versions:

rustc --version
cargo --version
node --version
npm --version

Generate the Databases

The database generation step runs the Rust CLI in release mode and writes the generated data to the frontend’s public directory. From the repository root, execute:

cd windiff_cli
cargo run --release ../ci/db_configuration.json ../windiff_frontend/public/

The configuration file at ci/db_configuration.json specifies the binaries and Windows releases included in the generated database. You can modify it to track additional supported targets, subject to the availability of their binary and symbol files.

Build the Frontend

After generating the databases, install the frontend dependencies and create the production build:

cd ../windiff_frontend
npm ci
npm run build

The npm ci command installs dependencies using the project’s lockfile, while npm run build runs the frontend’s configured production build process. Follow the repository’s current instructions for serving the generated frontend locally.

Applications in Windows Security Research

Reverse engineering: Examine changes in symbols and reconstructed data structures between Windows versions.
Malware analysis: Support investigations into how suspicious software interacts with Windows internals.
Vulnerability research: Compare relevant system components across releases to help identify changes that warrant deeper investigation.
System call research: Explore available system call information and investigate differences between supported Windows builds.
Security tooling development: Use generated binary metadata as a reference when building analysis scripts and research tools.

WinDiff is an analysis aid, not a vulnerability scanner. Differences between Windows builds do not automatically indicate a security flaw, and reconstructed types or symbols may be incomplete when source files or matching PDBs are unavailable.

Project Repository and Resources

Visit the official WinDiff repository for the latest source code, build instructions, database configuration, and contribution guidance. Researchers working on Windows internals can also explore forensic analysis tools for related investigative workflows.

By combining automated binary metadata collection with an accessible comparison interface, WinDiff helps researchers investigate how Windows internals evolve across operating system versions. Its local build workflow also provides flexibility for specialized reverse engineering and security research projects.