# WinDbg

> Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory. The current app keeps the engine, commands and extensions of WinDbg (Classic) and adds Time Travel Debugging, which records a user-mode process and replays it in both directions, JavaScript and NatVis scripting and Linux ELF dump analysis; since 1.2610.1001.0 it also offers WinDbg MCP for supported AI clients.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/>
- Catalog page: <https://awesomerea.org/resources/windbg/>
- Record JSON: <https://awesomerea.org/resources/windbg/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/windbg/index.md)

## Requirements & limits

- **Prerequisites:** WinDbg installs from Microsoft's installer, the Microsoft Store or winget on x64 or ARM64 Windows 11 or Windows 10 1607 and later, not Windows 10/11 S, and direct and Store installs self-update; the release notes, updated 2026-11-05, list 1.2611.4001.0 as newest.
- **Prerequisites:** Debugging Tools for Windows (WinDbg Classic and the KD, NTKD, CDB and NTSD console debuggers) ships with the WDK or Windows SDK or as an SDK-only install, with archived SDKs for older Windows. Kernel debugging typically needs a second machine or VM, local kernel debugging and TTD need elevation, and full analysis needs symbols, which for commercial code depend on the vendor.
- **License:** Free in the Microsoft Store under Microsoft's proprietary WinDbg license terms (updated 2026-10-08): the software is licensed, not sold, may not be redistributed and may send usage data to Microsoft.
- **Limits:** TTD records user-mode processes only, and not protected ones such as PPL; recording is typically 10–20x slower, traces can reach several gigabytes in minutes, with index files about twice as large, and may hold personal or security data; anti-virus software can interfere.
- **Limits:** WinDbg MCP officially supports GitHub Copilot in Visual Studio Code and GitHub Copilot CLI, one client per session; clients may send debugger context to their model service, AI findings are not authoritative, and default secure mode blocks high-risk commands such as .shell.

## Primary sources

1. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/>
2. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools>
3. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-overview>
4. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-release-notes>
5. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-overview>
6. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debuggers-in-the-debugging-tools-for-windows-package>
7. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windows-debugging>
8. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-user-mode-dump-file>
9. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-kernel-mode-preview>
10. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/linux-dwarf-symbols>
11. <https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-mcp-overview>
12. <https://learn.microsoft.com/en-us/legal/windows-sdk/windbg-software-license-terms>
13. <https://apps.microsoft.com/detail/9pgjgd53tn86>

## More in Native binaries

- [010 Editor](https://awesomerea.org/resources/010-editor/index.md) · Tool
- [pestudio](https://awesomerea.org/resources/pestudio/index.md) · Tool
- [OllyDbg](https://awesomerea.org/resources/ollydbg/index.md) · Tool
- [Tenet](https://awesomerea.org/resources/tenet/index.md) · Tool
- [findcrypt-yara](https://awesomerea.org/resources/findcrypt-yara/index.md) · Tool
- [deREferencing](https://awesomerea.org/resources/dereferencing/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.