3 ms·

Claiming to use WinDBG for debugging a crash dump and the only commands I can find in the MCP code are these ? I am not trying to be a dick here, but how does t

Claiming to use WinDBG for debugging a crash dump and the only commands I can find in the MCP code are these ? I am not trying to be a dick here, but how does this really work under the covers ? Is the MCP learning windbg ? Is there a model that knows windbg ? I am asking becuase I have no idea. results["info"] = session.send_command(".lastevent") results["exception"] = session.send_command("!analyze -v") results["modules"] = session.send_command("lm") results["threads"] = session.send_command("~") You cannot debug a crash dump only with these 4 commands, all the time.

psanchez 1y ago
It looks like it is using "Microsoft Console Debugger (CDB)" as the interface to windbg. Just had a quick look at the code: https://github.com/svnscha/mcp-windbg/blob/main/src/mcp_server_windbg/server.py https://github.com/svnscha/mcp-windbg/blob/main/src/mcp_serv... I might be wrong, but at first glance I don't think it is only using those 4 commands. It might be using them internally to get context to pass to the AI agent, but it looks like it exposes: - open_windbg_dump - run_windbg_cmd - close_windbg_dump - list_windbg_dumps The most interesting one is "run_windbg_cmd" because it might allow the MCP server to send whatever the AI agent wants. E.g: elif name == "run_windbg_cmd": args = RunWindbgCmdParams(**arguments) session = get_or_create_session( args.dump_path, cdb_path, symbols_path, timeout, verbose ) output = session.send_command(args.command) return [TextContent( type="text", text=f"Command: {args.command}\n\nOutput:\n```\n" + "\n".join(output) + "\n```" )] (edit: formatting)
- svnscha 1y ago
  Yes, that's exactly the point. LLMs "know" about WinDBG and its commands. So if you ask to switch the stack frame, inspect structs, memory or heap - it will do so and give contextual answers. Trivial crashes are almost analyzed fully autonomous whereas for challenging ones you can get quite a cool assistant on your side, helping you to analyze data, patterns, structs - you name it.
gustavoaca1997 1y ago
I think the magic happens in the function "run_windbg_cmd". AFAIK, the agent will use that function to pass any WinDBG command that the model thinks will be useful. The implementation basically includes the interface between the model and actually calling CDB through CDBSession.
- eknkc 1y ago
  Yeah that seems correct. It's like creating an SQLite MCP server with single tool "run_sql". Which is just fine I guess as long as the LLM knows how to write SQL (or WinDBG commands). And they definitely do know that. I'd even say this is better because this shifts the capability to LLM instead of the MCP.
dark-star 1y ago
The magic happens in the "analyze -v" part. This does quite a long analysis of a crashdump (https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/using-the--analyze-extension https://learn.microsoft.com/en-us/windows-hardware/drivers/d...) After that, all that is required is interpreting the results and connecting it with the source code. Still impressive at first glance, but I wonder how well it works with a more complex example (like a crash in the Windows kernel due to a broken driver, for example)
deleted 1y ago
[deleted]

psanchez 1y ago

It looks like it is using "Microsoft Console Debugger (CDB)" as the interface to windbg. Just had a quick look at the code: https://github.com/svnscha/mcp-windbg/blob/main/src/mcp_server_windbg/server.py https://github.com/svnscha/mcp-windbg/blob/main/src/mcp_serv... I might be wrong, but at first glance I don't think it is only using those 4 commands. It might be using them internally to get context to pass to the AI agent, but it looks like it exposes: - open_windbg_dump - run_windbg_cmd - close_windbg_dump - list_windbg_dumps The most interesting one is "run_windbg_cmd" because it might allow the MCP server to send whatever the AI agent wants. E.g: elif name == "run_windbg_cmd": args = RunWindbgCmdParams(**arguments) session = get_or_create_session( args.dump_path, cdb_path, symbols_path, timeout, verbose ) output = session.send_command(args.command) return [TextContent( type="text", text=f"Command: {args.command}\n\nOutput:\n```\n" + "\n".join(output) + "\n```" )] (edit: formatting)

svnscha 1y ago
Yes, that's exactly the point. LLMs "know" about WinDBG and its commands. So if you ask to switch the stack frame, inspect structs, memory or heap - it will do so and give contextual answers. Trivial crashes are almost analyzed fully autonomous whereas for challenging ones you can get quite a cool assistant on your side, helping you to analyze data, patterns, structs - you name it.

gustavoaca1997 1y ago

I think the magic happens in the function "run_windbg_cmd". AFAIK, the agent will use that function to pass any WinDBG command that the model thinks will be useful. The implementation basically includes the interface between the model and actually calling CDB through CDBSession.

eknkc 1y ago
Yeah that seems correct. It's like creating an SQLite MCP server with single tool "run_sql". Which is just fine I guess as long as the LLM knows how to write SQL (or WinDBG commands). And they definitely do know that. I'd even say this is better because this shifts the capability to LLM instead of the MCP.

dark-star 1y ago

The magic happens in the "analyze -v" part. This does quite a long analysis of a crashdump (https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/using-the--analyze-extension https://learn.microsoft.com/en-us/windows-hardware/drivers/d...) After that, all that is required is interpreting the results and connecting it with the source code. Still impressive at first glance, but I wonder how well it works with a more complex example (like a crash in the Windows kernel due to a broken driver, for example)

deleted 1y ago

[deleted]