Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Comparing Office Documents with WinMerge

Published: 2020-06-22
Last Updated: 2020-06-22 17:58:18 UTC
by Didier Stevens (Version: 1)
1 comment(s)

Sometimes I have to compare the internals of Office documents (OOXML files, e.g. ZIP container with XML files, …). Since they are ZIP containers, I have to compare the files within. I used to do this with with zipdump.py tool, but recently, I started to use WinMerge because of its graphical user interface.

WinMerge is a free Windows tool to compare files.

It is capable of comparing files stored inside archives: this is exactly what Office documents like .docx, .xlsm, … are.

First I have to change a setting so that WinMerge will recognize archive files like ZIP files based on their content too, and not only their extension.

Then I open the 2 Word documents. The first .docx file is a Word document with the text "This is test 1", the second Word document is an edited copy with the text "This is test 2".

I make sure that all comparisons are visible, and expand all subfolders:

It is not a surprise that document.xml is one of the files that is different: it contains the words I typed into the document and then altered:

WinMerge can also be used to compare XML files:

And then it is easier to see the changes I made:

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

Keywords:
1 comment(s)
Diary Archives