WinDbg 확장 프로그램 + Python MCP 서버. MCP 호환 클라이언트(커서, 클로드, VS 코드 + Cline/Roo)가 깨끗하고 검증된 명령어로 WinDbg를 구동할 수 있습니다. 커널 우선; 사용자 모드도 작동합니다.

목차

• 퀵 스타트
• 건축
• 사용 사례
• 여기 뭐가 있나
• 정신 건강 확인
• 문제 해결
• 구성
• 테스트
• 주석

퀵 스타트

선수과목

• 윈도우 10/11
• WinDbg (Windows SDK “Windows용 디버깅 도구”)
• Visual Studio 빌드 툴 (C++)
• 파이썬 3.10+ 및 시 2.x

확장 프로그램 빌드 (Developer PowerShell for VS):

WinDbg 로딩:

MCP 서버를 설치 및 실행하세요(루트 디렉터리에서):

건축

• 확장 기능은 네임드 파이프 서버를 호스팅하며 WinDbg 명령을 안전하게 실행합니다.
• Python 서버는 입력을 검증하고, 타임아웃을 해결하며, 도구를 MCP 클라이언트에 노출합니다.

사용 예시

일반 (자연어 프롬프트)

• “커널 내 모든 실행 중인 프로세스를 보여주세요”
• “현재 스레드의 스택 트레이스는 무엇인가요?”
• "주소 0x1000에서 메모리 분석
• “이 크래시 덤프를 이해할 수 있게 도와줘”
• “nt에 브레이크포인트를 설정하세요! NtCreateFile을 사용하고 실행 계속”
• “다음 3가지 지시를 진행하고 레지스터를 보여줘”

루트킷 동작 (연구 전용)

WinDbg‑ext‑MCP

WinDbg extension + Python MCP server. Lets MCP‑compatible clients (Cursor, Claude, VS Code + Cline/Roo) drive WinDbg with clean, validated commands. Kernel‑first; user‑mode works too.

Contents

• Quick Start
• Architecture
• Usage Examples
• What’s Here
• Sanity Check
• Troubleshooting
• Configuration
• Tested With
• Notes

Quick Start

Prereqs

• Windows 10/11
• WinDbg (Windows SDK “Debugging Tools for Windows”)
• Visual Studio Build Tools (C++)
• Python 3.10+ and Poetry 2.x

Build the extension (Developer PowerShell for VS):

msbuild extension\windbgmcpExt.sln /p:Configuration=Release /p:Platform=x64

Load in WinDbg:

.load C:\path\to\windbgmcpExt.dll

Install and run the MCP server (in root directory):

poetry install
poetry run selftest
poetry run mcp --list-tools
poetry run mcp

Architecture

MCP Client (stdio)    Python MCP Server (stdio)    WinDbg Extension (named pipe)    WinDbg/Target
                             FastMCP                      \\.\pipe\windbgmcp                   Kernel/User

• The extension hosts a named‑pipe server and executes WinDbg commands safely.
• The Python server validates inputs, resolves timeouts, and exposes tools to MCP clients.

Usage Examples

General (natural language prompts)

• “Show me all running processes in the kernel”
• “What’s the current thread’s stack trace?”
• “Analyze the memory at address 0x1000”
• “Help me understand this crash dump”
• “Set a breakpoint on nt!NtCreateFile and continue execution”
• “Step through the next 3 instructions and show me the registers”

Rootkit behavior (research‑only)

• “Hide explorer.exe using EPROCESS unlink and PspCidTable Unlink”
• “Make OneDrive.exe appear to have no open handles”
• “Make notepad.exe resistance to termination and kill attempts”
• “Install invisible system call hooks that dont modify SSDT”
• “Hide network connections from netstat while keeping them active”
• “Make files invisible to directory enumeration but accessible by direct path”

Note: These are for lawful, defensive research in controlled test labs only.

Available Tools

• debug_session: session status and metadata
• connection_manager: connection health and resilience controls
• session_manager: capture/restore debugging context
• run_command: execute a WinDbg command with validation/timeout handling
• run_sequence: execute multiple commands in order
• breakpoint_and_continue: set a breakpoint and continue execution
• analyze_process: process enumeration, info, and context switching
• analyze_thread: thread info and stack traces
• analyze_memory: memory display, typed structures, searches
• analyze_kernel: kernel objects and system analysis
• performance_manager: optimization controls and performance report
• async_manager: parallel execution and async task stats
• troubleshoot: quick diagnostics and guidance
• get_help: list tools and usage tips