SwishDbgExt

SwishDbgExt SwishDbgExt is a Microsoft WinDbg debugging extension that expands the set of available commands by Microsoft WinDbg, but also fixes and improves existing commands. This extension has been developed by Matt Suiche @msuiche – feel free to reach out on [email protected] ask for mor...

PrivFu

PrivFu Kernel mode WinDbg extension and PoCs for testing how token privileges work. There are notable repository and articles about token privilege abuse such Grzegorz Tworek's Priv2Admin. Codes in this repository are intended to help investigate how token privileges work. Table Of Contents PrivF...

lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

WinDbg-Samples

Esta es una colección de extensiones y scripts de ejemplo para ampliar WinDbg. Iremos añadiendo más ejemplos y extensiones con el tiempo. Primeros pasos Para cargar extensiones de JavaScript: 1. Descargue el archivo de script localmente. 2. Asegúrese de tener una versión reciente de WinDbg. 3...

windbg-decompile-ext

Windbg Decompile Extension via LLM This project is a Windows x64 WinDbg extension skeleton that resolves a function by name or address, reconstructs a deterministic control-flow view, and asks an LLM directly from the extension to produce pseudocode. Layout src/extension: WinDbg extension DLL and...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

drvtrace

tracedrv Tiny WinDbg extension to trace transitions from a debugged driver into other modules i.e. to trace function calls. Usage !tracedrv 4000 trace for 4000 instructions...

windbg-mcp

WinDbg MCP An MCP Model Context Protocol server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents full control over user-mode processes, kernel sessions, and...

voltron

Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...

lupo

关于如何使用Lupo的说明，请访问 https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — 恶意软件IOC提取器 用于恶意软件分析自动化的调试模块 关于如何使用Lupo的详细步骤（含图片和说明），请参阅这篇文章：https://medium.com/@vishalthakur/lupo-malware-ioc-extractor-cc86ae76b85d 简介 在处理涉及恶意软件的安全事件时，我们经常遇到需要自动化部分分析过程的情况，因为完全手动分析往往由于多种因素（时间、技能、规模等）而无法针对每个案例都进行。...

ttddbg

ttddbg - Plugin de Time Travel Debugging para IDA ⚠️ Atención usuarios de IDA 8: usar ttddbg con IDA 8 requiere una solución temporal por el momento, consulteProblemas conocidos Este plugin añade un nuevo depurador a IDA que permite cargar trazas de Time Travel Debugging generadas con WinDBG...

kernel-debug-lab-for-virtual-box

Cómo configurar un laboratorio de VirtualBox para depurar un controlador de kernel con Windbg Consideramos aquí que en el Equipo A windbg ya está instalado y en el Equipo B están instalados Visual Studio, el SDK y el WDK. 1. Abre el Administrador de red del host para crear o configurar un nuevo...

defcon_27_windbg_workshop

Taller "Modern Debugging with WinDbg Preview" de DEFCON 27 Este repositorio contiene los materiales para el taller de DEFCON 27 Descripción general Resumen Estamos en 2019 y, aun así, demasiados desarrolladores y hackers de Windows por igual siguen confiando en herramientas útiles, pero bastante ...

windbg_js_scripts

Scripts de JavaScript para WinDbg Instalar como una galería de WinDbg Clona el repositorio git clone https://github.com/hugsy/windbgjsscripts En windbgjsscripts\config.xml, edita las líneas Setting Name="LocalCacheRootFolder" para que reflejen la ruta local del repositorio. En WinDbg, carga el...

lolbin-poc

lolbin-poc Pequeño PoC de uso de un ejecutable firmado por Microsoft como lolbin. Compilación 32-bit cmake -B build32 -A Win32 cmake --build build32 --config Release Compilación 64-bit cmake -B build64 -A x64 cmake --build build64 --config Release Uso Descarga WinDbg desde aquí, coloca el...

yara-ttd

yara-ttd - La némesis definitiva de los empaquetadores Usa reglas YARA en trazas de Time Travel Debugging 1. Demo 2. Motivaciones 3. Instalación 4. Uso 5. Próximas funciones Demo Un binario empaquetado con UPX Un binario simple que lanza calc.exe, empaquetado con UPX. yara-ttd encuentra la cadena...

recon_2024_windbg_workshop

REcon 2024 - Consejos y trucos para mejorar la depuración con WinDbg Este repositorio contiene los materiales creados para el taller "Tips & Tricks for better debugging with WinDbg" Consejos y trucos para mejorar la depuración con WinDbg, en REcon 2024. Configuración Los materiales del taller...

The Windows Registry Adventure #6: Kernel-mode objects

Posted by Mateusz Jurczyk, Google Project Zero Welcome back to the Windows Registry Adventure! In the previous installment of the series, we took a deep look into the internals of the regf hive format. Understanding this foundational aspect of the registry is crucial, as it illuminates the design...

The vulnerability of the multi-purpose debugger WinDbg, related to errors in checking cryptographic signatures, allows a hacker to execute remote code.

The vulnerability of the multi-purpose debugger WinDbg is related to errors in checking the cryptographic signature. Exploiting this vulnerability can allow a remote attacker to execute malicious code remotely...

Microsoft WinDbg Remote Code Execution (March 2025)

The Microsoft WinDbg app installed on the remote host is affected by a remote code execution vulnerability: - Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network. CVE-2025-24043 Note that Nessus has not tested for this issue but ha...