Show status of all MCO sub-servers: running/stopped, PID, tool count, uptime.

Restart a crashed MCO sub-server by name (windbg / ida / x64dbg / orchestrator / sessions).

List all configured MCO sub-servers with description and tool counts.

Show a quick orientation cheatsheet for this MCP: typical workflow, key concepts, address forms, and timeout semantics. Call this first if you are unsure how to drive the debugger.

Launch a Windows executable under cdb. The target starts SUSPENDED at the initial breakpoint — use windbg_continue to run it.

Attach cdb to a running process by PID. The process is paused on attach.

Open a Windows crash dump (.dmp) for post-mortem analysis. Combine with windbg_analyze_crash.

Quit the cdb session and release the target.

Show whether a session is active, current target, RIP, nearest symbol, current process and thread.

Show MCP-side debugger I/O state: active cdb PID, buffered output lines, async command, and async age.

Break into a running target (Ctrl+Break). Use this when the program is executing and you need to pause it.

Run an arbitrary cdb/WinDbg command verbatim. Optional regex filter keeps only matching lines; max_lines caps noisy output.

Send a raw cdb command and return immediately without waiting for a prompt and without break-in. Use windbg_wait_for_event/read_output afterward.

Resume execution (cdb 'g'). Returns when the target hits a breakpoint, exception, or exits. On timeout the server auto-breaks the target so you can recover.

Resume execution with cdb 'g' and return immediately. Does not install a timeout and never sends break-in by itself.

Recommended safe continue: send cdb 'g', then wait for event/output without ever sending break-in on timeout.

Wait for output/prompt from an async command without sending break-in on timeout. Use after windbg_continue_async.

Wait for exception/crash output using a preset filter profile (default/tg/asan). Does not send break-in on timeout.

Drain currently buffered cdb output without blocking and without sending break-in.

Single-step one instruction, stepping INTO calls (cdb 't').

Single-step one instruction, stepping OVER calls (cdb 'p').

Run until the current function returns (cdb 'gu').

Run until execution reaches a given address or symbol (cdb 'g ').

Set a software breakpoint at an address or symbol. Optional cdb-expression condition.

Build and set a conditional cdb breakpoint safely, including optional .printf logging and false-branch gc.

Set a breakpoint from an AI-friendly template: log this/args, log expression, stop on signed-negative, pointer range, or stack log.

Set a hardware data breakpoint (cdb 'ba'). Triggers on read/write/execute access.

Set a hardware data breakpoint that logs IP, watched value, optional stack, then continues. Avoids hand-written ba/.printf escaping.

List all configured breakpoints (cdb 'bl').

Persist current breakpoints using cdb .bpcmds into .windbg_mcp_breakpoints/.cmd.

Restore a previously saved breakpoint set. Optionally clears existing breakpoints first.

Delete one or all breakpoints (cdb 'bc').

Disable a breakpoint without deleting it (cdb 'bd').

Re-enable a previously disabled breakpoint (cdb 'be').

Read the CPU registers. Output is parsed into a clean key=value table plus the raw cdb output.

Modify a CPU register, e.g. name='rax', value='0x42'.

Evaluate a cdb expression (cdb '?'). Useful for arithmetic, symbol lookup, and casting.

Show the call stack of the current thread.

Search all thread stacks for a regex/module/SP/address and optionally switch to the matching thread.

Dump the CET hardware shadow stack using dps @ssp. Useful when HW-enforced stack protection is enabled.

Dump normal stack and shadow stack side by side for quick return-address divergence checks.

Resolve one shadow stack return slot: dps slot, nearest symbol, and disassembly at poi(slot).

Run to poi(@ssp+index*8). Async by default so long waits do not force break-in.

Disassemble code forward. By default shows N instructions at an address; with function=true disassembles the whole function (cdb 'uf').

Disassemble N instructions BEFORE an address (cdb 'ub'). Useful for seeing what led to the current IP.

Read memory in a chosen format (byte/word/dword/qword/ascii/unicode/pointer).

Write memory in a chosen format (byte/word/dword/qword/ascii/unicode).

Search a memory range for a byte/string/dword/qword pattern.

List loaded modules. Optional name filter (cdb 'lm m ').

Show detailed info for one module (paths, version, symbols).

List all threads in the current process.

Switch debugger context to a specific thread index.

Switch debugger context by OS thread id using cdb ~~[tid]s. Accepts values like '43110', '0x43110', or 'pid.tid'.

List processes in the current debugger session (cdb '|').

Search symbols by pattern across modules (cdb 'x'). Pattern: 'mod!func'.

Find the nearest symbol to an address (cdb 'ln').

Show local variables of the current frame (requires private symbols).

Show source code lines around an address (requires source path).

Run !analyze on the current state. Best after windbg_open_dump or on an unhandled exception.

Dump the Process Environment Block of the current process (cdb '!peb').

Dump the Thread Environment Block of the current thread (cdb '!teb').

Run !heap with optional arguments (e.g. '-s' for summary, '-p -a ' to inspect a block).

Run !handle to inspect kernel handles in the target. Empty args lists all handles.

Describe a virtual address with !address. Filters noisy 'Building memory map' progress lines and can cap output.

Dump a structure type with cdb 'dt'. Optionally apply to an address.

Set the symbol search path (cdb '.sympath') and reload symbols. Use 'srvc:\symhttps://msdl.microsoft.com/download/symbols' for the public store.

Reload symbols (cdb '.reload'). Use force=true to discard cached symbols.

Set the source code search path (cdb '.srcpath').

Full crash triage in one call: !analyze -v + registers + call stack + exception record + fault address context. Best first tool after hitting a crash.

Inspect a specific heap block: size, flags, neighbors, memory before/after. Use with ASAN crash addresses to understand overflow context.

Inspect a heap block plus bytes and pointer/symbol view before and after it.

One-call object/heap context: address eval, symbol, !address, !heap, qwords, bytes/pointers around, potential vtable, optional VRle::Span decode.

Show call stacks for ALL threads simultaneously (cdb '~* kP'). Essential for race condition / UAF analysis.

Show full exception chain: last event + exception record + context + stack at exception + SEH chain.

Check if an address contains a vtable pointer and resolve it to a symbol + disassembly. Useful for type confusion / UAF analysis.

Find heap object candidates whose first qword equals a vtable pointer. With heap_start+heap_length searches that range; otherwise parses heap ranges from !address -f:Heap and searches each range.

Decode VRle::Span entries from memory. Layout assumed: {x:i16, y:i16, len:u16, cov:u8, raw7:u8}.

Parse ASAN crash context: exception record + context record + call stack at exception. Use when debugging ASAN-instrumented binaries.

Check if IDA Pro is connected and get binary info. Always call first.

Get detailed binary info: path, arch, image base, entry point, size.

List functions in the binary. Supports pagination and name filtering.

List all binary segments (.text, .data, .rdata, etc.) with addresses and permissions.

Get the import table, optionally filtered by DLL name.

Get the export table (for DLLs/EXEs with exports).

Find all strings in the binary. Useful for IOC extraction.

List all named addresses (functions, globals, labels) with optional pattern filter.

Disassemble instructions at an address. Use function=true for entire function.

Decompile function to pseudocode using Hex-Rays decompiler.

Deep function analysis: calls, string refs, xrefs, decompile. Best starting point.

Get all cross-references TO an address (who calls/references this).

Get all cross-references FROM an address (what this calls/references).

Rename a function, label, or global variable at an address.

Add a comment at an address. Kinds: regular, repeatable, anterior, posterior.

Set the type signature for a function or variable (C declaration syntax).

Get the type signature of a function or variable.

Read raw bytes at an address and show a hex+ASCII dump.

Search the binary for a byte pattern or string. kind: bytes|string|unicode

List binary entry points (start address + DLL exports if applicable).

Get struct definition from IDA's type library (name, members, offsets, sizes).

Force-create a function at an address (useful for undefined code regions).