windbg-debugginglisted

# WinDbg debugging via the `windbg` MCP server This skill drives the `windbg` MCP server, which wraps WinDbg/DbgEng for four kinds of Windows debugging: **crash-dump** analysis, **live user-mode** debugging, **kernel** debugging, and **Time Travel Debugging (TTD)** of `.run` traces. **Verify the environment first.** Most failures are setup, not debugging — wrong engine DLL, missing symbols, or no elevation. Read **[setup.md](setup.md)** before the first session of a workflow you haven't run yet in this environment. ## Pick a playbook | Task | Playbook | |------|----------| | Build / engine bundling / symbols / elevation / 32-bit .NET | [setup.md](setup.md) | | Triage a `.dmp` crash dump | [crash-dump.md](crash-dump.md) | | Launch/attach a process, or debug the kernel | [live-and-kernel.md](live-and-kernel.md) | | Walk kernel pools or user Segment Heaps | [heap-walking.md](heap-walking.md) | | Record / open / navigate / analyze a `.run` trace | [ttd.md](ttd.md) | | Enumerate a driver's IOCTLs & test user-mode reachability | [driver-ioctl.md](driver-ioctl.md) | | Compare Windows component builds for an MSRC CVE with BN Personal | [MSRC patch-diff skill](../msrc-patch-diff/SKILL.md) | ## Tool map Knowing which verb exists keeps you from reaching for raw `execute` when a typed tool already does the job. | Group | Tools | |-------|-------| | Session | `open_dump`, `open_trace`, `attach_kernel_local`, `attach_kernel`, `attach_process`, `launch`, `end_session`, `session_statu