ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

windbg-mcp

WinDbg MCP An MCP Model Context Protocol server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents full control over user-mode processes, kernel sessions, and...

voltron

Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...

windbg-decompile-ext

Windbg Decompile Extension via LLM This project is a Windows x64 WinDbg extension skeleton that resolves a function by name or address, reconstructs a deterministic control-flow view, and asks an LLM directly from the extension to produce pseudocode. Layout src/extension: WinDbg extension DLL and...

drvtrace

tracedrv Tiny WinDbg extension to trace transitions from a debugged driver into other modules i.e. to trace function calls. Usage root@kitploit: !tracedrv 4000 trace for 4000 instructions...

PrivFu

PrivFu Kernel mode WinDbg extension and PoCs for testing how token privileges work. There are notable repository and articles about token privilege abuse such Grzegorz Tworek's Priv2Admin. Codes in this repository are intended to help investigate how token privileges work. Table Of Contents PrivF...

SwishDbgExt

SwishDbgExt SwishDbgExt is a Microsoft WinDbg debugging extension that expands the set of available commands by Microsoft WinDbg, but also fixes and improves existing commands. This extension has been developed by Matt Suiche @msuiche – feel free to reach out on [email protected] ask for mor...

WinDbg-Samples

This is a collection of extensions and sample scripts for extending WinDbg. We'll be adding more samples and extensions over time. Getting Started To load JavaScript extensions: 1. Download the script file locally. 2. Ensure you have a recent version of WinDbg. 3. Start your debugging session. 4...

lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

lupo

Lupoの使用方法については、https://github.com/malienist/lupo/wiki/Lupo-Wiki を参照してください Lupo — マルウェアIOC抽出機能 マルウェア解析自動化のためのデバッグモジュール Lupoの使用方法に関するステップバイステップの投稿（画像と手順付き）については、こちらの投稿をご覧ください： https://medium.com/@vishalthakur/lupo-malware-ioc-extractor-cc86ae76b85d はじめに...

ttddbg

ttddbg - 时间旅行调试 IDA 插件 ⚠️ 注意：使用 IDA 8 的用户，在将 ttddbg 与 IDA 8 配合使用时目前需要一种变通方法，请参阅已知问题 此插件为 IDA 添加了一个新的调试器，支持加载使用 WinDBG Preview 生成的时间旅行调试跟踪记录。 此插件支持 x86 和 x64 跟踪记录，并由此支持 IDA 和 IDA64。 安装 可以使用发布页面上的安装程序来安装此插件。只要你已安装 WinDBG Preview，安装程序将自动安装所需的依赖项。 使用方法 安装后，您可以在 IDA 界面中选择 ttddbg 调试器，并将您的 .run...

kernel-debug-lab-for-virtual-box

How to set up a VirtualBox lab to debug Kernel Driver with Windbg We consider here that on Computer A windbg is already installed and on Computer B Visual Studio, the SDK and WDK are installed. 1. Open the Host network Manager to create or set up a new Virtual Box Host-Only Ethernet adapter 2...

defcon_27_windbg_workshop

"Modern Debugging with WinDbg Preview" DEFCON 27 workshop This repository contains the materials for the DEFCON 27 workshop Overview Abstract It's 2019 and yet too many Windows developers and hackers alike rely on useful but rather old school tools for debugging Windows binaries OllyDbg, Immunity...

windbg_js_scripts

WinDbg JavaScript Scripts Install as a WinDbg gallery Clone the repository root@kitploit: git clone https://github.com/hugsy/windbgjsscripts In windbgjsscripts\config.xml, edit the lines Setting Name="LocalCacheRootFolder" to reflect the local path of the repository. In WinDbg, load the config.xm...

lolbin-poc

lolbin-poc Small PoC of using a Microsoft signed executable as a lolbin. Building 32-bit root@kitploit: cmake -B build32 -A Win32 cmake --build build32 --config Release Building 64-bit root@kitploit: cmake -B build64 -A x64 cmake --build build64 --config Release Usage Download WinDbg from here, p...

yara-ttd

yara-ttd - The ultimate packer nemesis Use YARA rules on Time Travel Debugging traces 1. Demo 2. Motivations 3. Install 4. Usage 5. Upcoming features Demo A binary packed with UPX A simple binary that launches calc.exe, packed with UPX. yara-ttd finds the calc.exe string in the module memory,...

recon_2024_windbg_workshop

REcon 2024 - Tips & Tricks for better debugging with WinDbg This repository contains the materials created for the workshop "Tips & Tricks for better debugging with WinDbg", at REcon 2024. Setup The workshop materials aims to provide useful features for WinDbg, when debugging in kernel-mode, but...

The Windows Registry Adventure #6: Kernel-mode objects

Posted by Mateusz Jurczyk, Google Project Zero Welcome back to the Windows Registry Adventure! In the previous installment of the series, we took a deep look into the internals of the regf hive format. Understanding this foundational aspect of the registry is crucial, as it illuminates the design...

The vulnerability of the multi-purpose debugger WinDbg, related to errors in checking cryptographic signatures, allows a hacker to execute remote code.

The vulnerability of the multi-purpose debugger WinDbg is related to errors in checking the cryptographic signature. Exploiting this vulnerability can allow a remote attacker to execute malicious code remotely...

Microsoft WinDbg Remote Code Execution (March 2025)

The Microsoft WinDbg app installed on the remote host is affected by a remote code execution vulnerability: - Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network. CVE-2025-24043 Note that Nessus has not tested for this issue but ha...