Tool

Windbg Decompile Extension via LLM

Windows x64 WinDbg extension that resolves a function by name or address, reconstructs a control-flow view, and asks an LLM from the extension to produce pseudocode. The README limits the current scope to x64 and to live-memory analysis through DbgEng.

Targets: Binary
Category: Debugging and dynamic analysis
Relationship: Foundation tool
Sources reviewed: 2026-11-07

Stars: 113
Last commit: 2026-06-22
Language: C++
License (GitHub): MIT

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Prerequisites: Windows x64 WinDbg. The documented command is !decomp, and the current scope is x64-only live-memory analysis through DbgEng.
Prerequisites: A vendored Zydis tree at third_party/zydis is used by default when it is present. third_party/dbgeng can hold an optional copy of dbgeng.h and dbgeng.lib.

Cite

BibTeX

@misc{windbg-decompile-ext,
  title = {{Windbg Decompile Extension via LLM}},
  howpublished = {\url{https://github.com/kernullist/windbg-decompile-ext}},
  url = {https://github.com/kernullist/windbg-decompile-ext},
  urldate = {2026-11-07},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/windbg-decompile-ext/}}
}

Plain text

Windbg Decompile Extension via LLM. https://github.com/kernullist/windbg-decompile-ext (accessed 2026-11-07). Awesome REA entry: https://awesomerea.org/resources/windbg-decompile-ext/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · kernullist/windbg-decompile-ext · Revision c1d911d