{
  "added_at": "2026-11-09",
  "category": "dynamic-analysis",
  "description_en": "Windows x64 WinDbg extension that resolves a function by name or address, reconstructs a control-flow view, and asks an LLM from the extension to produce pseudocode. The README limits the current scope to x64 and to live-memory analysis through DbgEng.",
  "description_zh": "Windows x64 WinDbg 扩展：按名称或地址解析函数，重建控制流视图，并由扩展直接请求 LLM 生成伪代码。README 将当前范围限定为 x64，以及通过 DbgEng 分析实时内存。",
  "entry_url": "https://awesomerea.org/resources/windbg-decompile-ext/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/windbg-decompile-ext/",
  "evidence_url": "https://github.com/kernullist/windbg-decompile-ext/blob/c1d911d9f20ef383ee4cc4d4d22aecea24976460/README.md",
  "group": "tools",
  "id": "windbg-decompile-ext",
  "json_url": "https://awesomerea.org/resources/windbg-decompile-ext/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/windbg-decompile-ext/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/windbg-decompile-ext/index.md",
  "name": "Windbg Decompile Extension via LLM",
  "name_zh": "Windbg Decompile Extension：用 LLM 生成伪代码的 WinDbg 扩展",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "prerequisites"
  ],
  "requirements": [
    "Windows x64 WinDbg. The documented command is !decomp, and the current scope is x64-only live-memory analysis through DbgEng.",
    "A vendored Zydis tree at third_party/zydis is used by default when it is present. third_party/dbgeng can hold an optional copy of dbgeng.h and dbgeng.lib."
  ],
  "requirements_zh": [
    "需要 Windows x64 版 WinDbg。文档中的命令是 !decomp，当前范围是仅限 x64、通过 DbgEng 进行的实时内存分析。",
    "若存在 third_party/zydis 中的 Zydis 源码树，默认构建会使用它。third_party/dbgeng 可以放置可选的 dbgeng.h 和 dbgeng.lib 副本。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/kernullist/windbg-decompile-ext",
  "verification": "source-reviewed",
  "verified_at": "2026-11-07"
}