Windbg MCP

Session

1 tool - e.g. open_dump, open_trace, attach_kernel_local, attach_kernel, attach_process, launch, interrupt, end_session, session_status

session

Inspect

1 tool - e.g. current_location (instruction pointer, execution context, and PE coordinate), registers, read_memory, backtrace (the stack as typed frames, each carrying module

inspect

Crash

1 tool - e.g. crash_triage - a bug check as fields: code and parameters, crashing process, the stack as module+RVA, and the faulting driver frame; exception_triage - the user

crash

run & execute

1 tool - e.g. go, step_over, step_into, set_breakpoint, breakpoints (the session's whole inventory, as records - what to check before resuming or detaching a live target), cl

exec

Batch

1 tool - e.g. debug_batch - an ordered sequence with assertions and a rollback the engine process runs on every path where it can still identify the target it would aim at

batch

Ttd

1 tool - e.g. step_back (t-), step_over_back (p-), reverse_go (g-), goto_position (!tt)

ttd

Ioctl

1 tool - e.g. decode_ioctl, driver_object, device_object, irp_stack, ioctl_trace, reachable_from_dispatch, driver_hazards, ioctl_map - the control codes a dispatch routine ac

ioctl

Allocator

1 tool - e.g. pool_find_tag, pool_chunk, pool_census, pool_diagnostics

allocator