Net-based Device That Permits Evaluating Image, Sort And Syscall Info Of Microsoft Home windows Binaries Throughout Completely different Variations Of The OS

WinDiff is an open-source web-based device that enables looking and evaluating image, sort and syscall data of Microsoft Home windows binaries throughout totally different variations of the working system. The binary database is routinely up to date to incorporate data from the most recent Home windows updates (together with Insider Preview).

It was impressed by ntdiff and made doable with the assistance of Winbindex.

The CLI device is used to generate compressed JSON databases out of a configuration file and depends on Winbindex to seek out and obtain the required PEs (and PDBs). Varieties are reconstructed utilizing resym. The thought behind the CLI device is to have the ability to simply replace and regenerate databases as new variations of Home windows are launched. The CLI device’s code is within the windiff_cli listing.

The frontend is used to visualise the info generated by the CLI device, in a user-friendly manner. The frontend follows the identical precept as ntdiff, because it permits looking data extracted from official Microsoft PEs and PDBs for sure variations of Microsoft Home windows and likewise permits evaluating this data between variations. The frontend’s code is within the windiff_frontend listing.

A scheduled GitHub motion fetches new updates from Winbindex each day and updates the configuration file used to generate the dwell model of WinDiff. Presently, due to (free plans) storage and compute limitations, solely KB and Insider Preview updates lower than one 12 months previous are stored for the dwell model. You possibly can after all rebuild a neighborhood model of WinDiff your self, with out these limitations if you should. See the following part for that.

Word: Winbindex does not present distinctive obtain hyperlinks for 100% of the listed information, so it would occur that some PEs’ data are unavailable in WinDiff due to that. Nevertheless, as quickly as these PEs are on VirusTotal, Winbindex will have the ability to present distinctive obtain hyperlinks for them and they’re going to then be built-in into WinDiff routinely.

Methods to Construct

Stipulations

• Rust 1.68 or superior
• Node.js 16.8 or superior

Command-Line

The total construct of WinDiff is “self-documented” in ci/build_frontend.sh, which is the construct script used to construct the dwell model of WinDiff. Here is what’s inside:

# Resolve the venture's root folder
PROJECT_ROOT=$(git rev-parse --show-toplevel)
# Generate databases
cd "$PROJECT_ROOT/windiff_cli"
cargo run --release "$PROJECT_ROOT/ci/db_configuration.json" "$PROJECT_ROOT/windiff_frontend/public/"
# Construct the frontend
cd "$PROJECT_ROOT/windiff_frontend"
npm ci
npm run construct

The configuration file used to generate the info for the dwell model of WinDiff is situated right here: ci/db_configuration.json, however you may customise it or use your personal. PRs aimed toward including new binaries to trace within the dwell configuration are welcome.