SystemDiff

English | 简体中文

See what apps, installers, and scripts change on Windows.

Offline-first · Read-only · No account · No telemetry

SystemDiff takes a before Snapshot and an after Snapshot, then explains the evidence that changed. It is for questions like: “I installed this program—what startup entries or Windows services did it change?”

Important

SystemDiff is pre-release software. Today it captures and compares the documented Windows Registry Run/RunOnce startup locations and Windows service configuration visible to the current token. The first guided desktop workflow can be built from source for development, and an unsigned, short-lived Windows x64 CLI Developer Preview is available from eligible CI runs. There is no official binary Release. Scheduled Tasks, rules, redaction, and desktop distribution are not implemented.

See the desktop workflow · Try the sample · CLI Developer Preview · Build from source

A real Windows desktop dogfood run: SystemDiff captured before and after a guarded synthetic HKCU Run change, classified exactly one Added startup entry, and verified exact-data cleanup. No personal host evidence is shown.

Available today

Capability	Status
Capture current-user and local-machine Run/RunOnce evidence	Implemented on supported Windows systems
Human-readable, technical, and deterministic JSON Diff output	Implemented
Coverage-aware comparison that does not turn missing evidence into a false removal	Implemented
Capture current-token-visible Windows service configuration (drivers excluded)	Implemented with conservative partial coverage
Guided Start capture → Finish & compare desktop workflow	Implemented as a source-built development app
Scheduled Tasks Collector	Planned; not implemented
Rules, signatures, risk classification, and redacted sharing	Planned; not implemented

SystemDiff reports facts such as “Added to current-user startup.” It does not currently decide whether an entry is malicious, safe, signed, or worthy of removal.

Desktop development build

The first desktop vertical slice reuses the same Rust Collectors, Diff engine, and report semantics as the CLI. It guides a user through one local session, shows calm grouped results for Startup and Windows Services, preserves incomplete coverage as Inconclusive, and offers exact technical details on demand. English (en-US) and Simplified Chinese (zh-CN) are included.

It is intentionally a development app, not a distributed product build: there is no installer, signed executable, desktop Actions artifact, update mechanism, history, file import, or clean-machine WebView2 bootstrap yet. It requires an installed WebView2 Runtime and the source-build prerequisites in apps/desktop/README.md.

npm ci --prefix apps/desktop
npm --prefix apps/desktop run tauri -- dev

The app stores temporary unredacted before/after evidence under its backend-owned local session directory and removes verified session files after finish, cancel, a new capture, or a stable normal exit. It does not expose paths to the web frontend or add Registry/service write capability. Exiting during an in-flight native capture, a cleanup failure, or a crash can leave sensitive local evidence for conservative startup recovery; Results then surface a cleanup warning when the process is still running. This is not yet a shareable-report workflow.

CLI Developer Preview builds

Successful main CI runs attach systemdiff-windows-x86_64-developer-preview for 14 days. This is an ephemeral GitHub Actions artifact, not a GitHub Release or a supported version. To get it:

1. sign in to GitHub and open a successful CI workflow run;
2. find Artifacts at the bottom of the run and download systemdiff-windows-x86_64-developer-preview;
3. extract GitHub's outer download, verify systemdiff-windows-x86_64.zip against the adjacent SHA256SUMS, then extract the portable ZIP;
4. read QUICKSTART.md and run .\systemdiff.exe --help.

The x64 executable is built in Cargo's release profile. CI checks its PE architecture and imports, verifies an embedded asInvoker / uiAccess=false manifest, and runs the downloaded artifact without Cargo. The current portable build statically links the MSVC CRT, so inspection shows no dynamic VC/UCRT runtime import; ordinary Windows system DLLs remain dependencies. Clean-machine validation on every supported Windows baseline is still required before an official alpha.

The preview is not Authenticode-signed. Windows may show a SmartScreen or reputation warning. Verify the checksum and public source; SystemDiff does not ask users to disable or bypass Windows security controls. Browser artifact downloads require GitHub sign-in and expire, so this is intentionally not presented as the final public download experience.

Try the Registry demo

With a stable Rust MSVC toolchain installed:

cargo run --locked --quiet -p systemdiff-cli -- diff fixtures/snapshots/registry-before-v1.json fixtures/snapshots/registry-after-v1.json

The sample contains one synthetic HKCU\Software\Microsoft\Windows\CurrentVersion\Run addition and is fixed by a regression test.

Verified output from the committed Registry-only fixtures. No real host data is shown.

The three report modes serve different needs:

# Calm, readable summary
systemdiff diff before.json after.json

# Exact text evidence for power users and debugging
systemdiff diff --technical before.json after.json

# Versioned, deterministic machine-readable document
systemdiff diff --json before.json after.json

The default output uses no color or ANSI formatting, so meaning is preserved when redirected or piped. --technical exposes Collector version, scope, canonical identity, Registry and service configuration evidence, raw numeric values, and coverage diagnostics. --json preserves the language-neutral Diff schema.

Capture a real before/after pair

systemdiff snapshot -o before.json

# Install or run the software you want to observe.

systemdiff snapshot -o after.json
systemdiff diff before.json after.json

This workflow currently covers Registry Run/RunOnce evidence and Windows service configuration. Service visibility depends on the current token and object ACLs, so Services v1 conservatively marks its scope partial: a missing service becomes Inconclusive rather than a confirmed removal. Compare Snapshots from the same Windows installation and the same user/principal context. Snapshots and every Diff/report mode are unredacted: human text, technical text, and JSON can contain service accounts, paths and arguments, descriptions, command strings, usernames, hashes, and other host details. Review every report before sharing, and never attach unreviewed real evidence to a public Issue.

Current minimum collection platform: Windows 10 version 1709 or Windows Server 2016 version 1709. ARM64 captures current-user shared Registry scopes, but Collector v1 reports HKLM alternate-view coverage as unsupported until those views can be represented and tested correctly.

Why trust the design?

• Offline-first: scanning, diffing, and reporting happen locally.
• Read-only product behavior: SystemDiff observes and reports; it does not clean, remediate, execute evidence, or change startup configuration.
• Coverage is evidence: permission and collection gaps are explicit. Incomplete scope coverage produces an Inconclusive result rather than a false Removed result.
• Evidence remains inspectable: plain-language output is layered over technical text and versioned JSON.
• No account or telemetry: the current product has no upload path, network client, or usage tracking.

See the product principles, architecture, data format, and threat model.

Build from source

Prerequisites on Windows:

• Git;
• stable Rust MSVC toolchain with rustfmt and clippy;
• Microsoft C++ Build Tools (Desktop development with C++).

cargo fmt --all --check
cargo clippy --locked --workspace --all-targets -- -D warnings
cargo test --locked --workspace --all-targets

cargo run --locked -p systemdiff-cli -- collectors

There is no official binary Release yet. The CI CLI Developer Preview above is unsigned and temporary. The existing synthetic HKCU write-based E2E harnesses are test-only, require explicit gates, refuse to overwrite an existing value, perform exact-data guarded cleanup, and are not run by default CI.

Architecture and roadmap

The Rust workspace separates versioned domain data, Windows API access, deterministic Diff, rules, reporting, and CLI composition. The Tauri 2 desktop development app reuses those crates through a narrow Rust-owned session and presentation boundary; React handles localization and layout without reclassifying evidence.

Registry startup and Windows Services are the first two completed vertical slices, not the finished v0.1. See the Collector notes and roadmap for current boundaries.

Contributing

Contributions are welcome in English or Chinese. Useful work is not limited to Rust: documentation, translations, synthetic fixtures, Windows API research, privacy analysis, issue reproduction, and UI design all matter.

Read CONTRIBUTING.md and contributing a Collector.

Security and project boundary

SystemDiff is defensive auditing software. Credential dumping, token/cookie extraction, keylogging, persistence creation, AV/EDR bypass, stealth/C2, exploitation, and unauthorized-access tooling are outside the project boundary. Report vulnerabilities through GitHub Private Vulnerability Reporting; see SECURITY.md.

License

SystemDiff is licensed under the Apache License 2.0. The portable binary's dependency notices are listed in THIRD_PARTY_LICENSES.txt.