windbg-mcp

WinDbg MCP Un servidor MCP Model Context Protocol que expone cada función del depurador de Windows de pybag como una herramienta nativa de MCP. Le otorga a cualquier cliente compatible con MCP Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor y agentes personalizados control total sob...

kernel-debug-lab-for-virtual-box

How to set up a VirtualBox lab to debug Kernel Driver with Windbg We consider here that on Computer A windbg is already installed and on Computer B Visual Studio, the SDK and WDK are installed. 1. Open the Host network Manager to create or set up a new Virtual Box Host-Only Ethernet adapter 2...

PrivFu

PrivFu Kernel mode WinDbg extension and PoCs for testing how token privileges work. There are notable repository and articles about token privilege abuse such Grzegorz Tworek's Priv2Admin. Codes in this repository are intended to help investigate how token privileges work. Table Of Contents PrivF...

windbg-decompile-ext

Windbg Decompile Extension via LLM This project is a Windows x64 WinDbg extension skeleton that resolves a function by name or address, reconstructs a deterministic control-flow view, and asks an LLM directly from the extension to produce pseudocode. Layout src/extension: WinDbg extension DLL and...

WinDbg-Samples

This is a collection of extensions and sample scripts for extending WinDbg. We'll be adding more samples and extensions over time. Getting Started To load JavaScript extensions: 1. Download the script file locally. 2. Ensure you have a recent version of WinDbg. 3. Start your debugging session. 4...

drvtrace

tracedrv Tiny WinDbg extension to trace transitions from a debugged driver into other modules i.e. to trace function calls. Usage root@kitploit: !tracedrv 4000 trace for 4000 instructions...

voltron

Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...

SwishDbgExt

SwishDbgExt SwishDbgExt es una extensión de depuración de Microsoft WinDbg que amplía el conjunto de comandos disponibles de Microsoft WinDbg, pero también corrige y mejora comandos existentes. Esta extensión ha sido desarrollada por Matt Suiche @msuiche – no dudes en contactar a...

ShellCodeEmulator

Herramienta de emulación de shellcode de Windows basada en unicorn framework. ShellcodeEmulator emula shellcode de Windows con la ayuda de volcados de memoria de procesos de windbg. Puede proporcionar shellcode para analizar con cualquier imagen de volcado de proceso de Windows. La herramienta...

lupo

Para instrucciones sobre cómo usar Lupo, visita https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Extractor de IOC de Malware Módulo de depuración para Automatización de Análisis de Malware Para una publicación paso a paso sobre cómo usar Lupo, con imágenes e instrucciones, consulta esta...

lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

defcon_27_windbg_workshop

"Modern Debugging with WinDbg Preview" DEFCON 27 workshop This repository contains the materials for the DEFCON 27 workshop Overview Abstract It's 2019 and yet too many Windows developers and hackers alike rely on useful but rather old school tools for debugging Windows binaries OllyDbg, Immunity...

windbg_js_scripts

WinDbg JavaScript Scripts Install as a WinDbg gallery Clone the repository root@kitploit: git clone https://github.com/hugsy/windbgjsscripts In windbgjsscripts\config.xml, edit the lines Setting Name="LocalCacheRootFolder" to reflect the local path of the repository. In WinDbg, load the config.xm...

lolbin-poc

lolbin-poc Small PoC of using a Microsoft signed executable as a lolbin. Building 32-bit root@kitploit: cmake -B build32 -A Win32 cmake --build build32 --config Release Building 64-bit root@kitploit: cmake -B build64 -A x64 cmake --build build64 --config Release Usage Download WinDbg from here, p...

yara-ttd

yara-ttd - The ultimate packer nemesis Use YARA rules on Time Travel Debugging traces 1. Demo 2. Motivations 3. Install 4. Usage 5. Upcoming features Demo A binary packed with UPX A simple binary that launches calc.exe, packed with UPX. yara-ttd finds the calc.exe string in the module memory,...

recon_2024_windbg_workshop

REcon 2024 - Tips & Tricks for better debugging with WinDbg This repository contains the materials created for the workshop "Tips & Tricks for better debugging with WinDbg", at REcon 2024. Setup The workshop materials aims to provide useful features for WinDbg, when debugging in kernel-mode, but...

ttddbg

ttddbg - Time Travel Debugging IDA 플러그인 ⚠️ IDA 8 사용자 주의: 현재 IDA 8에서 ttddbg를 사용하려면 임시 해결 방법이 필요합니다.알려진 문제를 참조하세요. 이 플러그인은 WinDBG Preview로 생성된 Time Travel Debugging 트레이스의 로드를 지원하는 새 디버거를 IDA에 추가합니다. 이 플러그인은 x86 및 x64 트레이스를 모두 지원하며, 그에 따라 IDA 및 IDA64도 지원합니다. 설치 플러그인 설치는 릴리스 페이지의 설치 프로그램을 사용하여 수행할 수...

The Windows Registry Adventure #6: Kernel-mode objects

Posted by Mateusz Jurczyk, Google Project Zero Welcome back to the Windows Registry Adventure! In the previous installment of the series, we took a deep look into the internals of the regf hive format. Understanding this foundational aspect of the registry is crucial, as it illuminates the design...

The vulnerability of the multi-purpose debugger WinDbg, related to errors in checking cryptographic signatures, allows a hacker to execute remote code.

The vulnerability of the multi-purpose debugger WinDbg is related to errors in checking the cryptographic signature. Exploiting this vulnerability can allow a remote attacker to execute malicious code remotely...

Microsoft WinDbg Remote Code Execution (March 2025)

The Microsoft WinDbg app installed on the remote host is affected by a remote code execution vulnerability: - Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network. CVE-2025-24043 Note that Nessus has not tested for this issue but ha...