List all known sessions (gdb plugin connections and launched processes) with their state.

Detailed status of one gdb session: state, inferior info, last stop reason.

Detach the MCP plugin from gdb. With kill_gdb=True, also quit gdb itself (and with it the debugged process). Default leaves the externally launched gdb running.

Tail the stdout/stderr log of a launched session (gdb or script). Requires the session to have been started by launch_gdb / launch_script.

Launch gdb with the MCP plugin loaded inside WSL2 (background process, log captured to a file). program may be a Windows or WSL path; the session registers itself when the plugin connects. With run=True, the inferior is started immediately (equivalent to gdb -ex run).

Launch a Python (typically pwntools) script inside WSL2. script must be an absolute Windows or WSL file path; inline code is not supported. If the script starts gdb with the MCP plugin loaded (via gdb_args/gdbscript), the new gdb session id is returned once it registers. A script that exits without gdb returns immediately with its state, return code, and log tail.

End a session. For gdb, the default detaches the plugin and leaves gdb running; force=True also terminates gdb. Script sessions are terminated gracefully by default or killed with force=True.

Execute a raw gdb command and return its output. Use for pwndbg-specific commands (vmmap, heap, got, checksec, ropgadget, search, ...) or any other gdb CLI command. Works while the inferior is running (queued until the next stop).

Resume the inferior: continue / step / next / stepi / nexti / finish / until. Returns immediately; use wait_for_stop to wait for the next stop event, or rely on the async stop notification.

Interrupt the running inferior (equivalent to Ctrl-C in gdb). The inferior stops and a stop notification is emitted.

Wait until the inferior stops (signal, breakpoint, exit) or the timeout elapses. Returns immediately when the inferior is already stopped.

The reason the inferior last stopped (signal, fault address, breakpoint info).

Read raw memory from the inferior. address may be an int, a hex string ('0x401000'), or a gdb expression ('main+0x10', '&puts@got'). Returns hex, printable-ascii, and unreadable ranges.

Write raw bytes (given as a hex string, e.g. '9090c3' or '90 90 c3') to the inferior's memory.

Read register values (all general-purpose registers by default, or the named subset).

Write a register. value is a gdb expression (e.g. '0x401000', '$rax+8', 'main').

Stack backtrace: pc, function name, source file/line per frame.

Disassemble count instructions at start (address, gdb expression, function name — or the current PC when omitted).

Evaluate a gdb expression against the live inferior (PIE-aware): 'main', '&puts@got', '$rax+8', '(char*)0x404000'.

List inferior threads and which one is selected.

Select a stack frame by level (0 = innermost) for subsequent register/memory/local inspection.

Memory mappings of the inferior (info proc mappings — works without pwndbg). For richer output use execute_command('vmmap').

Load a program (file <path>) or core dump (core-file <path>) into the gdb session. For gdb sessions started without an inferior.

Set a breakpoint at an address/symbol/expression ('main', '*main+0x20', '0x401000'). Types: breakpoint (software), hw (hardware), watch, hw_watch.

List all breakpoints/watchpoints.

Delete / enable / disable a breakpoint by number.

One-call crash triage: signal, fault address, PC, registers, backtrace, disassembly around PC, memory at PC/SP/fault address and the head of the memory map. Use after wait_for_stop (or after a stop notification). Best-effort: unreadable pieces are reported in warnings instead of failing the whole call.