windbg-debugginglisted

# WinDbg debugging via the `windbg` MCP server This skill drives the `windbg` MCP server, which wraps WinDbg/DbgEng for four kinds of Windows debugging: **crash-dump** analysis, **live user-mode** debugging, **kernel** debugging, and **Time Travel Debugging (TTD)** of `.run` traces. **Verify the environment first.** Most failures are setup, not debugging — wrong engine DLL, missing symbols, or no elevation. Read **[setup.md](setup.md)** before the first session of a workflow you haven't run yet in this environment. ## Pick a playbook | Task | Playbook | |------|----------| | Build / engine bundling / symbols / elevation | [setup.md](setup.md) | | Triage a `.dmp` crash dump | [crash-dump.md](crash-dump.md) | | Launch/attach a process, or debug the kernel | [live-and-kernel.md](live-and-kernel.md) | | Record / open / navigate / analyze a `.run` trace | [ttd.md](ttd.md) | | Enumerate a driver's IOCTLs & test user-mode reachability | [driver-ioctl.md](driver-ioctl.md) | ## Tool map Knowing which verb exists keeps you from reaching for raw `execute` when a typed tool already does the job. | Group | Tools | |-------|-------| | Session | `open_dump`, `open_trace`, `attach_kernel_local`, `attach_kernel`, `attach_process`, `launch`, `end_session` | | State | `registers`, `read_memory`, `backtrace`, `modules`, `threads`, `disassemble`, `dx` | | Control | `go`, `step_over`, `step_into`, `set_breakpoint` | | TTD nav | `step_back` (`t-`), `step_over_back` (`p-`), `reverse_go` (`g-`