Tool
WinDbg
Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory. The current app keeps the engine, commands and extensions of WinDbg (Classic) and adds Time Travel Debugging, which records a user-mode process and replays it in both directions, JavaScript and NatVis scripting and Linux ELF dump analysis; since 1.2610.1001.0 it also offers WinDbg MCP for supported AI clients.
- Targets
- Binary
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: WinDbg installs from Microsoft's installer, the Microsoft Store or winget on x64 or ARM64 Windows 11 or Windows 10 1607 and later, not Windows 10/11 S, and direct and Store installs self-update; the release notes, updated 2026-11-05, list 1.2611.4001.0 as newest.
- Prerequisites: Debugging Tools for Windows (WinDbg Classic and the KD, NTKD, CDB and NTSD console debuggers) ships with the WDK or Windows SDK or as an SDK-only install, with archived SDKs for older Windows. Kernel debugging typically needs a second machine or VM, local kernel debugging and TTD need elevation, and full analysis needs symbols, which for commercial code depend on the vendor.
- License: Free in the Microsoft Store under Microsoft's proprietary WinDbg license terms (updated 2026-10-08): the software is licensed, not sold, may not be redistributed and may send usage data to Microsoft.
- Limits: TTD records user-mode processes only, and not protected ones such as PPL; recording is typically 10–20x slower, traces can reach several gigabytes in minutes, with index files about twice as large, and may hold personal or security data; anti-virus software can interfere.
- Limits: WinDbg MCP officially supports GitHub Copilot in Visual Studio Code and GitHub Copilot CLI, one client per session; clients may send debugger context to their model service, AI findings are not authoritative, and default secure mode blocks high-risk commands such as .shell.
About this entry
The description was reviewed against primary sources.
Primary sources
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-overview
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-release-notes
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-overview
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debuggers-in-the-debugging-tools-for-windows-package
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windows-debugging
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-user-mode-dump-file
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-kernel-mode-preview
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/linux-dwarf-symbols
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-mcp-overview
- https://learn.microsoft.com/en-us/legal/windows-sdk/windbg-software-license-terms
- https://apps.microsoft.com/detail/9pgjgd53tn86
More in Native binaries
- 010 Editor · Tool
- pestudio · Tool
- OllyDbg · Tool
- Tenet · Tool
- findcrypt-yara · Tool
- deREferencing · Tool