Windbg MCP

Session

1 tool - e.g. open_dump, open_trace, attach_kernel_local, attach_kernel, attach_process, launch, interrupt, end_session, session_status

session

Inspect

1 tool - e.g. registers, read_memory, backtrace (the stack as typed frames, each carrying module+RVA where the engine can place it, as well as its symbol), modules, threads,

inspect

Crash

1 tool - e.g. crash_triage - a bug check as fields: code and parameters, crashing process, the stack as module+RVA, and the faulting driver frame

crash

run & execute

1 tool - e.g. go, step_over, step_into, set_breakpoint, run_to_address

exec

Batch

1 tool - e.g. debug_batch - an ordered sequence with assertions and a rollback the engine process runs on every path

batch

Ttd

1 tool - e.g. step_back (t-), step_over_back (p-), reverse_go (g-), goto_position (!tt)

ttd

Ioctl

1 tool - e.g. decode_ioctl, driver_object, device_object, irp_stack, ioctl_trace, reachable_from_dispatch

ioctl

Allocator

1 tool - e.g. pool_find_tag, pool_chunk, pool_census, pool_diagnostics

allocator