Command line¶
ntoseye --help and each subcommand’s --help, as the installed
binary prints them. Options listed for ntoseye itself go before or
after a subcommand.
Usage¶
WinDbg-like kernel debugger for Windows, from Linux and macOS
Usage: ntoseye [OPTIONS] [COMMAND]
Commands:
configure Configure a supported hypervisor for ntoseye interactively
status Show the configured hypervisor transports and recover launch commands
mcp Run as an MCP server that makes the debugger available as tools
dap Run as a Debug Adapter Protocol server for use with editors
gdbserver Serve the session over the GDB remote protocol to IDA, Binary Ninja, Ghidra, gdb, and lldb
help Print this message or the help of the given subcommand(s)
Options:
-v, --version
Print version information
--gdbstub-instructions
Print the steps to enable the QEMU gdbstub for the gdb backend
--kd-instructions
Print the steps to enable KD over serial in QEMU and Windows
--plain-repl
Use a line-based REPL with no terminal cursor queries, no completion, and no history
-c, --command <COMMANDS>
Run these debugger commands after attaching, each echoed after the prompt and run as if typed there (a ;-separated list, as at the prompt); give it more than once to run several lists in order
--batch
Quit after the -c commands instead of prompting, leaving a live target as q does, and print only the commands' output, not the startup summary or the stop. The exit status is 1 if a command reported an error
-b, --backend <BACKEND>
The debugger backend: 'kd' (Windows KD over serial, the default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive inspection of a live VM)
--connect <CONNECT>
The backend target: a GDB address, a KD socket path, or a KDNET listen address. The memory backend does not use it
--kdnet-key <KDNET_KEY>
The KDNET encryption key (four base-36 components), which the kdnet backend requires
--kd-handshake-timeout <SECONDS>
Seconds to wait for the initial KD/KDNET handshake. Overrides NTOSEYE_KD_TIMEOUT; defaults to 8 seconds when neither is set
--memory-source <MEMORY_SOURCE>
The memory source for KD and KDNET: auto (validated host memory first, then KD), host, or kd
--dump <DUMP>
Open a Windows kernel crash dump or user-mode minidump (.dmp) for offline analysis instead of attaching to a live VM
--pdb-server <PDB_SERVER>
An additional PDB symbol server URL, which you can give more than once. ntoseye tries these servers before the default Microsoft server. The URL uses the standard symbol-server path layout: {server}/{filename}/{guid}{age}/{filename}
--sympath-append <SYMPATH_APPEND>
Append a local directory to the symbol path, which you can give more than once. ntoseye looks for PDB files (bare, in symbol-store layout, or in subdirectories) in these directories after checking the cache and before contacting symbol servers
--srcpath <SRCPATH>
Map source files the PDBs record to a local copy, which you can give more than once: a local root that holds the source tree, or recorded-prefix=local-root, as `.srcpath+` takes it. `ls`, the stop card, and the disassembly use these mappings from the start of the session
--force-download-symbols
Download the symbols again
--no-pdb-from-memory
Do not rebuild a missing PDB from the pages of the file in guest memory. NTOSEYE_NO_PDB_FROM_MEMORY=1 in the environment has the same effect
-h, --help
Print help
ntoseye configure¶
Configure a supported hypervisor for ntoseye interactively
Usage: ntoseye configure [OPTIONS]
Options:
-b, --backend <BACKEND>
The debugger backend: 'kd' (Windows KD over serial, the default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive inspection of a live VM)
--connect <CONNECT>
The backend target: a GDB address, a KD socket path, or a KDNET listen address. The memory backend does not use it
--kdnet-key <KDNET_KEY>
The KDNET encryption key (four base-36 components), which the kdnet backend requires
--kd-handshake-timeout <SECONDS>
Seconds to wait for the initial KD/KDNET handshake. Overrides NTOSEYE_KD_TIMEOUT; defaults to 8 seconds when neither is set
--memory-source <MEMORY_SOURCE>
The memory source for KD and KDNET: auto (validated host memory first, then KD), host, or kd
--dump <DUMP>
Open a Windows kernel crash dump or user-mode minidump (.dmp) for offline analysis instead of attaching to a live VM
--pdb-server <PDB_SERVER>
An additional PDB symbol server URL, which you can give more than once. ntoseye tries these servers before the default Microsoft server. The URL uses the standard symbol-server path layout: {server}/{filename}/{guid}{age}/{filename}
--sympath-append <SYMPATH_APPEND>
Append a local directory to the symbol path, which you can give more than once. ntoseye looks for PDB files (bare, in symbol-store layout, or in subdirectories) in these directories after checking the cache and before contacting symbol servers
--srcpath <SRCPATH>
Map source files the PDBs record to a local copy, which you can give more than once: a local root that holds the source tree, or recorded-prefix=local-root, as `.srcpath+` takes it. `ls`, the stop card, and the disassembly use these mappings from the start of the session
--force-download-symbols
Download the symbols again
--no-pdb-from-memory
Do not rebuild a missing PDB from the pages of the file in guest memory. NTOSEYE_NO_PDB_FROM_MEMORY=1 in the environment has the same effect
-h, --help
Print help
ntoseye status¶
Show the configured hypervisor transports and recover launch commands
Usage: ntoseye status [OPTIONS]
Options:
-b, --backend <BACKEND>
The debugger backend: 'kd' (Windows KD over serial, the default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive inspection of a live VM)
--connect <CONNECT>
The backend target: a GDB address, a KD socket path, or a KDNET listen address. The memory backend does not use it
--kdnet-key <KDNET_KEY>
The KDNET encryption key (four base-36 components), which the kdnet backend requires
--kd-handshake-timeout <SECONDS>
Seconds to wait for the initial KD/KDNET handshake. Overrides NTOSEYE_KD_TIMEOUT; defaults to 8 seconds when neither is set
--memory-source <MEMORY_SOURCE>
The memory source for KD and KDNET: auto (validated host memory first, then KD), host, or kd
--dump <DUMP>
Open a Windows kernel crash dump or user-mode minidump (.dmp) for offline analysis instead of attaching to a live VM
--pdb-server <PDB_SERVER>
An additional PDB symbol server URL, which you can give more than once. ntoseye tries these servers before the default Microsoft server. The URL uses the standard symbol-server path layout: {server}/{filename}/{guid}{age}/{filename}
--sympath-append <SYMPATH_APPEND>
Append a local directory to the symbol path, which you can give more than once. ntoseye looks for PDB files (bare, in symbol-store layout, or in subdirectories) in these directories after checking the cache and before contacting symbol servers
--srcpath <SRCPATH>
Map source files the PDBs record to a local copy, which you can give more than once: a local root that holds the source tree, or recorded-prefix=local-root, as `.srcpath+` takes it. `ls`, the stop card, and the disassembly use these mappings from the start of the session
--force-download-symbols
Download the symbols again
--no-pdb-from-memory
Do not rebuild a missing PDB from the pages of the file in guest memory. NTOSEYE_NO_PDB_FROM_MEMORY=1 in the environment has the same effect
-h, --help
Print help
ntoseye mcp¶
Run as an MCP server that makes the debugger available as tools
If --backend/--connect/--dump names a target, the server attaches to it at launch, and otherwise the client attaches with the 'open' tool. The default transport is stdio, with the client starting this binary. Use --http to serve over the network.
Usage: ntoseye mcp [OPTIONS]
Options:
--http <HTTP>
Serve the Streamable HTTP transport on this address (for example 127.0.0.1:8080), for web MCP clients that connect over the network. Without this option, the server uses stdio
--unsafe-http
Let Streamable HTTP bind to a non-loopback address, answer requests addressed to any host, and accept any browser origin (CORS). This option makes the debugger control tools available to the network, so use it only on trusted hosts and networks. Without this option, HTTP binds only to loopback addresses, answers only requests addressed to a loopback host, and accepts cross-origin requests only from loopback origins
-b, --backend <BACKEND>
The debugger backend: 'kd' (Windows KD over serial, the default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive inspection of a live VM)
--connect <CONNECT>
The backend target: a GDB address, a KD socket path, or a KDNET listen address. The memory backend does not use it
--kdnet-key <KDNET_KEY>
The KDNET encryption key (four base-36 components), which the kdnet backend requires
--kd-handshake-timeout <SECONDS>
Seconds to wait for the initial KD/KDNET handshake. Overrides NTOSEYE_KD_TIMEOUT; defaults to 8 seconds when neither is set
--memory-source <MEMORY_SOURCE>
The memory source for KD and KDNET: auto (validated host memory first, then KD), host, or kd
--dump <DUMP>
Open a Windows kernel crash dump or user-mode minidump (.dmp) for offline analysis instead of attaching to a live VM
--pdb-server <PDB_SERVER>
An additional PDB symbol server URL, which you can give more than once. ntoseye tries these servers before the default Microsoft server. The URL uses the standard symbol-server path layout: {server}/{filename}/{guid}{age}/{filename}
--sympath-append <SYMPATH_APPEND>
Append a local directory to the symbol path, which you can give more than once. ntoseye looks for PDB files (bare, in symbol-store layout, or in subdirectories) in these directories after checking the cache and before contacting symbol servers
--srcpath <SRCPATH>
Map source files the PDBs record to a local copy, which you can give more than once: a local root that holds the source tree, or recorded-prefix=local-root, as `.srcpath+` takes it. `ls`, the stop card, and the disassembly use these mappings from the start of the session
--force-download-symbols
Download the symbols again
--no-pdb-from-memory
Do not rebuild a missing PDB from the pages of the file in guest memory. NTOSEYE_NO_PDB_FROM_MEMORY=1 in the environment has the same effect
-h, --help
Print help (see a summary with '-h')
ntoseye dap¶
Run as a Debug Adapter Protocol server for use with editors
If --backend/--connect/--dump names a target, the server attaches to it at launch, and otherwise to the target that the launch or attach arguments of the client name. The default transport is stdio. Use --port to serve one client over loopback TCP.
Usage: ntoseye dap [OPTIONS]
Options:
--port <PORT>
Serve one DAP client on 127.0.0.1:<port>, for clients configured with a debugServer port. Without this option, the server uses stdio
-b, --backend <BACKEND>
The debugger backend: 'kd' (Windows KD over serial, the default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive inspection of a live VM)
--connect <CONNECT>
The backend target: a GDB address, a KD socket path, or a KDNET listen address. The memory backend does not use it
--kdnet-key <KDNET_KEY>
The KDNET encryption key (four base-36 components), which the kdnet backend requires
--kd-handshake-timeout <SECONDS>
Seconds to wait for the initial KD/KDNET handshake. Overrides NTOSEYE_KD_TIMEOUT; defaults to 8 seconds when neither is set
--memory-source <MEMORY_SOURCE>
The memory source for KD and KDNET: auto (validated host memory first, then KD), host, or kd
--dump <DUMP>
Open a Windows kernel crash dump or user-mode minidump (.dmp) for offline analysis instead of attaching to a live VM
--pdb-server <PDB_SERVER>
An additional PDB symbol server URL, which you can give more than once. ntoseye tries these servers before the default Microsoft server. The URL uses the standard symbol-server path layout: {server}/{filename}/{guid}{age}/{filename}
--sympath-append <SYMPATH_APPEND>
Append a local directory to the symbol path, which you can give more than once. ntoseye looks for PDB files (bare, in symbol-store layout, or in subdirectories) in these directories after checking the cache and before contacting symbol servers
--srcpath <SRCPATH>
Map source files the PDBs record to a local copy, which you can give more than once: a local root that holds the source tree, or recorded-prefix=local-root, as `.srcpath+` takes it. `ls`, the stop card, and the disassembly use these mappings from the start of the session
--force-download-symbols
Download the symbols again
--no-pdb-from-memory
Do not rebuild a missing PDB from the pages of the file in guest memory. NTOSEYE_NO_PDB_FROM_MEMORY=1 in the environment has the same effect
-h, --help
Print help (see a summary with '-h')
ntoseye gdbserver¶
Serve the session over the GDB remote protocol to IDA, Binary Ninja, Ghidra, gdb, and lldb
The server attaches to the target that --backend/--connect/--dump names, and then serves one client at a time until you interrupt it.
Usage: ntoseye gdbserver [OPTIONS]
Options:
--listen <LISTEN>
The address to listen on
[default: 127.0.0.1:2345]
-b, --backend <BACKEND>
The debugger backend: 'kd' (Windows KD over serial, the default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive inspection of a live VM)
--connect <CONNECT>
The backend target: a GDB address, a KD socket path, or a KDNET listen address. The memory backend does not use it
--kdnet-key <KDNET_KEY>
The KDNET encryption key (four base-36 components), which the kdnet backend requires
--kd-handshake-timeout <SECONDS>
Seconds to wait for the initial KD/KDNET handshake. Overrides NTOSEYE_KD_TIMEOUT; defaults to 8 seconds when neither is set
--memory-source <MEMORY_SOURCE>
The memory source for KD and KDNET: auto (validated host memory first, then KD), host, or kd
--dump <DUMP>
Open a Windows kernel crash dump or user-mode minidump (.dmp) for offline analysis instead of attaching to a live VM
--pdb-server <PDB_SERVER>
An additional PDB symbol server URL, which you can give more than once. ntoseye tries these servers before the default Microsoft server. The URL uses the standard symbol-server path layout: {server}/{filename}/{guid}{age}/{filename}
--sympath-append <SYMPATH_APPEND>
Append a local directory to the symbol path, which you can give more than once. ntoseye looks for PDB files (bare, in symbol-store layout, or in subdirectories) in these directories after checking the cache and before contacting symbol servers
--srcpath <SRCPATH>
Map source files the PDBs record to a local copy, which you can give more than once: a local root that holds the source tree, or recorded-prefix=local-root, as `.srcpath+` takes it. `ls`, the stop card, and the disassembly use these mappings from the start of the session
--force-download-symbols
Download the symbols again
--no-pdb-from-memory
Do not rebuild a missing PDB from the pages of the file in guest memory. NTOSEYE_NO_PDB_FROM_MEMORY=1 in the environment has the same effect
-h, --help
Print help (see a summary with '-h')