{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-overview",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-release-notes",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-overview",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debuggers-in-the-debugging-tools-for-windows-package",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windows-debugging",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-user-mode-dump-file",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-kernel-mode-preview",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/linux-dwarf-symbols",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-mcp-overview",
    "https://learn.microsoft.com/en-us/legal/windows-sdk/windbg-software-license-terms",
    "https://apps.microsoft.com/detail/9pgjgd53tn86"
  ],
  "category": "dynamic-analysis",
  "description_en": "Microsoft's WinDbg debugger and the Debugging Tools for Windows, documented on Microsoft Learn, for debugging live user-mode and kernel-mode code, analyzing crash dumps and examining CPU registers and memory. The current app keeps the engine, commands and extensions of WinDbg (Classic) and adds Time Travel Debugging, which records a user-mode process and replays it in both directions, JavaScript and NatVis scripting and Linux ELF dump analysis; since 1.2610.1001.0 it also offers WinDbg MCP for supported AI clients.",
  "description_zh": "微软的 WinDbg 调试器及 Debugging Tools for Windows 工具包，文档发布于 Microsoft Learn，用于调试运行中的用户态和内核态代码、分析崩溃转储，以及检查 CPU 寄存器和内存。当前的 WinDbg 应用沿用 WinDbg (Classic) 的调试引擎、命令和扩展，并新增时间旅行调试（Time Travel Debugging，可录制用户态进程并向前、向后回放）、JavaScript 与 NatVis 脚本和 Linux ELF 转储分析；自 1.2610.1001.0 版起还提供面向受支持 AI 客户端的 WinDbg MCP。",
  "entry_url": "https://awesomerea.org/resources/windbg/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/windbg/",
  "evidence_url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/",
  "group": "tools",
  "id": "windbg",
  "json_url": "https://awesomerea.org/resources/windbg/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/windbg/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/windbg/index.md",
  "name": "WinDbg",
  "name_zh": "WinDbg Windows 调试器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "prerequisites",
    "license",
    "limits",
    "limits"
  ],
  "requirements": [
    "WinDbg installs from Microsoft's installer, the Microsoft Store or winget on x64 or ARM64 Windows 11 or Windows 10 1607 and later, not Windows 10/11 S, and direct and Store installs self-update; the release notes, updated 2026-11-05, list 1.2611.4001.0 as newest.",
    "Debugging Tools for Windows (WinDbg Classic and the KD, NTKD, CDB and NTSD console debuggers) ships with the WDK or Windows SDK or as an SDK-only install, with archived SDKs for older Windows. Kernel debugging typically needs a second machine or VM, local kernel debugging and TTD need elevation, and full analysis needs symbols, which for commercial code depend on the vendor.",
    "Free in the Microsoft Store under Microsoft's proprietary WinDbg license terms (updated 2026-10-08): the software is licensed, not sold, may not be redistributed and may send usage data to Microsoft.",
    "TTD records user-mode processes only, and not protected ones such as PPL; recording is typically 10–20x slower, traces can reach several gigabytes in minutes, with index files about twice as large, and may hold personal or security data; anti-virus software can interfere.",
    "WinDbg MCP officially supports GitHub Copilot in Visual Studio Code and GitHub Copilot CLI, one client per session; clients may send debugger context to their model service, AI findings are not authoritative, and default secure mode blocks high-risk commands such as .shell."
  ],
  "requirements_zh": [
    "WinDbg 可通过微软安装程序、Microsoft Store 或 winget 安装，支持 x64 或 ARM64 架构的 Windows 11 及 Windows 10 1607 以上版本，不支持 Windows 10/11 S；直接安装或经 Store 安装的版本会自动更新。发行说明（2026-11-05 更新）列出的最新版本为 1.2611.4001.0。",
    "Debugging Tools for Windows（含 WinDbg (Classic) 及 KD、NTKD、CDB、NTSD 控制台调试器）随 WDK 或 Windows SDK 提供，也可在 SDK 安装程序中只选此组件单独安装，旧版 Windows 则使用归档中的对应 SDK。内核调试通常需要另一台计算机或虚拟机，本地内核调试和 TTD 需以提升的权限运行，完整分析还需要符号文件，商业软件的符号能否获得取决于厂商。",
    "在 Microsoft Store 中免费提供，采用微软专有的 WinDbg 软件许可条款（2026-10-08 更新）：软件仅授予使用许可而非出售，禁止再分发，并可能把使用数据发送给微软。",
    "TTD 只能录制用户态进程，且不能录制 PPL 等受保护进程；录制时通常会慢 10 至 20 倍，几分钟内跟踪文件就可能达到数 GB，索引文件通常还要大一倍，且可能包含个人身份或安全相关信息；杀毒软件可能干扰录制。",
    "WinDbg MCP 官方支持 Visual Studio Code 中的 GitHub Copilot 和 GitHub Copilot CLI，每个会话同时只能连接一个客户端；客户端可能把调试器上下文发送给其模型服务，AI 给出的结论并不权威，默认开启的安全模式会阻止 .shell 等高风险命令。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}