gitfool/windbg
Debug Windows dumps, live user-mode/kernel targets, and time travel traces via WinDbg.
Investigate a Windows CVE through MSRC, acquire verified current and previous stable component binaries for the same Windows product and architecture, and compare them with Binary Ninja Personal and external BinDiff. Use for CVE patch comparisons and similarity acceptance captures.
Drive WinDbg/DbgEng via the windbg MCP server to debug Windows crash dumps, live user-mode and kernel targets, and Time Travel Debugging (.run) traces, and to inspect or control a VBS guest's Secure Kernel (VTL1). Use when analyzing a .dmp, attaching to a process or the kernel, recording/navigating/analyzing a TTD trace, inspecting a saved state's Secure Kernel, or stopping, stepping and resuming an exact disposable VTL1 target.