ntoseye¶
ntoseye is a Windows debugger for Linux and macOS. It debugs the Windows kernel and user-mode processes of virtual and physical machines, and analyzes crash dumps offline, with the command language of WinDbg.
Debugging via REPL |
Debugging via VS Code + DAP |
|---|---|
|
|
ntoseye is available under the MIT license.
Using ntoseye¶
New to ntoseye? Install it, attach to a VM with the Quickstart, then follow Your first session from attaching to stepping. If you already know WinDbg, Coming from WinDbg lists what carries over and what differs.
Every REPL command is documented in the command reference, which is the same text .hh <command> prints. To drive the debugger from code, start with the Python SDK.
Debugging from the host¶
ntoseye runs outside the machine it debugs and reaches it through one of four backends:
Backend |
Connects over |
Needs in Windows |
Stops and steps |
|---|---|---|---|
|
KDCOM, on a VM serial port |
Kernel debugging |
Yes |
|
KDNET, on the network |
Kernel network debugging |
Yes |
|
The hypervisor’s GDB stub |
Nothing |
Yes |
|
The VM’s memory |
Nothing |
No |
KDNET reaches any machine Windows can debug, physical or virtual. With gdb and memory, Windows runs without its debugger enabled and does not know it is being debugged. With a VM on the same host, ntoseye reads guest memory straight from the VM process whenever it can, instead of through the debugger transport. Choosing a backend compares the backends in full.
Because it reads memory itself, ntoseye also sees what Windows’ own debugger cannot: the secure kernel and trustlets that virtualization-based security isolates in VTL1, and where each processor left off when it stopped inside the Windows hypervisor.
Symbols and source¶
Symbols come from Microsoft’s symbol server, into a cache in the symstore layout that WinDbg, IDA, and Ghidra also read. Private PDBs and local source add source lines, local variables, and source breakpoints for your own drivers, and driver replacement loads a rebuilt driver from the host without copying it into the guest.
Platform support¶
ntoseye debugs 64-bit Windows 10 and 11 on AMD64 and ARM64, live or from a crash dump, and runs on Linux (x86-64, ARM64) and macOS on Apple Silicon. It sets up and works directly with KVM/QEMU and VMware Workstation on Linux and UTM on macOS; any other machine, physical or virtual, is reached over KDNET.
Get involved¶
The source is on GitHub. It builds with Cargo:
git clone https://github.com/dmaivel/ntoseye.git
cd ntoseye
cargo build --release
Report bugs on the issue tracker, and ask questions or share what you have built in Discussions.