Command line

ntoseye --help and each subcommand’s --help, as the installed binary prints them. Options listed for ntoseye itself go before or after a subcommand.

Usage

WinDbg-like kernel debugger for Windows, from Linux and macOS

Usage: ntoseye [OPTIONS] [COMMAND]

Commands:
  configure  Interactively configure a supported hypervisor for ntoseye
  status     Inspect configured hypervisor transports and recover launch commands
  mcp        Run as an MCP server, exposing the debugger as tools
  dap        Run as a Debug Adapter Protocol server for editor integration
  gdbserver  Serve the session over the GDB remote protocol, for IDA, Binary Ninja, Ghidra, gdb, and lldb
  help       Print this message or the help of the given subcommand(s)

Options:
  -v, --version
          Print version information

      --gdbstub-instructions
          Print how to enable QEMU's gdbstub for the gdb backend

      --kd-instructions
          Print how to enable KD over serial in QEMU and Windows

      --plain-repl
          Use a line-oriented REPL without terminal cursor queries, completion, or history

  -b, --backend <BACKEND>
          Debugger backend: 'kd' (Windows KD over serial, default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive live-VM introspection)

      --connect <CONNECT>
          Backend target: GDB address, KD socket path, or KDNET listen address; unused by memory

      --kdnet-key <KDNET_KEY>
          KDNET encryption key (four base-36 components); required by the kdnet backend

      --memory-source <MEMORY_SOURCE>
          KD/KDNET memory source: auto (validated host memory, then KD fallback), host, or kd

      --dump <DUMP>
          Open a Windows kernel crash dump (.dmp) for offline analysis instead of attaching to a live VM

      --pdb-server <PDB_SERVER>
          Additional PDB symbol server URL (repeatable; tried before the Microsoft default), using the standard symbol-server path convention: {server}/{filename}/{guid}{age}/{filename}

      --force-download-symbols
          Force redownloading of symbols

  -h, --help
          Print help

ntoseye configure

Interactively configure a supported hypervisor for ntoseye

Usage: ntoseye configure [OPTIONS]

Options:
  -b, --backend <BACKEND>
          Debugger backend: 'kd' (Windows KD over serial, default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive live-VM introspection)

      --connect <CONNECT>
          Backend target: GDB address, KD socket path, or KDNET listen address; unused by memory

      --kdnet-key <KDNET_KEY>
          KDNET encryption key (four base-36 components); required by the kdnet backend

      --memory-source <MEMORY_SOURCE>
          KD/KDNET memory source: auto (validated host memory, then KD fallback), host, or kd

      --dump <DUMP>
          Open a Windows kernel crash dump (.dmp) for offline analysis instead of attaching to a live VM

      --pdb-server <PDB_SERVER>
          Additional PDB symbol server URL (repeatable; tried before the Microsoft default), using the standard symbol-server path convention: {server}/{filename}/{guid}{age}/{filename}

      --force-download-symbols
          Force redownloading of symbols

  -h, --help
          Print help

ntoseye status

Inspect configured hypervisor transports and recover launch commands

Usage: ntoseye status [OPTIONS]

Options:
  -b, --backend <BACKEND>
          Debugger backend: 'kd' (Windows KD over serial, default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive live-VM introspection)

      --connect <CONNECT>
          Backend target: GDB address, KD socket path, or KDNET listen address; unused by memory

      --kdnet-key <KDNET_KEY>
          KDNET encryption key (four base-36 components); required by the kdnet backend

      --memory-source <MEMORY_SOURCE>
          KD/KDNET memory source: auto (validated host memory, then KD fallback), host, or kd

      --dump <DUMP>
          Open a Windows kernel crash dump (.dmp) for offline analysis instead of attaching to a live VM

      --pdb-server <PDB_SERVER>
          Additional PDB symbol server URL (repeatable; tried before the Microsoft default), using the standard symbol-server path convention: {server}/{filename}/{guid}{age}/{filename}

      --force-download-symbols
          Force redownloading of symbols

  -h, --help
          Print help

ntoseye mcp

Run as an MCP server, exposing the debugger as tools

Attaches at launch when --backend/--connect/--dump name a target; otherwise the client attaches with the 'open' tool. Defaults to the stdio transport (the client launches this binary); pass --http to serve over the network.

Usage: ntoseye mcp [OPTIONS]

Options:
      --http <HTTP>
          Serve the Streamable HTTP transport on this address (e.g. 127.0.0.1:8080) instead of stdio, for web MCP clients that connect over the network

      --unsafe-http
          Allow Streamable HTTP to bind to a non-loopback address and accept any browser origin (CORS); exposes debugger control tools to the network, so only use on trusted hosts/networks. Without it, HTTP is loopback-only and cross-origin requests are restricted to loopback origins

  -b, --backend <BACKEND>
          Debugger backend: 'kd' (Windows KD over serial, default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive live-VM introspection)

      --connect <CONNECT>
          Backend target: GDB address, KD socket path, or KDNET listen address; unused by memory

      --kdnet-key <KDNET_KEY>
          KDNET encryption key (four base-36 components); required by the kdnet backend

      --memory-source <MEMORY_SOURCE>
          KD/KDNET memory source: auto (validated host memory, then KD fallback), host, or kd

      --dump <DUMP>
          Open a Windows kernel crash dump (.dmp) for offline analysis instead of attaching to a live VM

      --pdb-server <PDB_SERVER>
          Additional PDB symbol server URL (repeatable; tried before the Microsoft default), using the standard symbol-server path convention: {server}/{filename}/{guid}{age}/{filename}

      --force-download-symbols
          Force redownloading of symbols

  -h, --help
          Print help (see a summary with '-h')

ntoseye dap

Run as a Debug Adapter Protocol server for editor integration

Attaches at launch when --backend/--connect/--dump name a target; otherwise the client's launch/attach arguments do. Defaults to stdio; pass --port to serve one client over loopback TCP instead.

Usage: ntoseye dap [OPTIONS]

Options:
      --port <PORT>
          Serve one DAP client on 127.0.0.1:<port> instead of stdio, for clients configured with a debugServer port

  -b, --backend <BACKEND>
          Debugger backend: 'kd' (Windows KD over serial, default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive live-VM introspection)

      --connect <CONNECT>
          Backend target: GDB address, KD socket path, or KDNET listen address; unused by memory

      --kdnet-key <KDNET_KEY>
          KDNET encryption key (four base-36 components); required by the kdnet backend

      --memory-source <MEMORY_SOURCE>
          KD/KDNET memory source: auto (validated host memory, then KD fallback), host, or kd

      --dump <DUMP>
          Open a Windows kernel crash dump (.dmp) for offline analysis instead of attaching to a live VM

      --pdb-server <PDB_SERVER>
          Additional PDB symbol server URL (repeatable; tried before the Microsoft default), using the standard symbol-server path convention: {server}/{filename}/{guid}{age}/{filename}

      --force-download-symbols
          Force redownloading of symbols

  -h, --help
          Print help (see a summary with '-h')

ntoseye gdbserver

Serve the session over the GDB remote protocol, for IDA, Binary Ninja, Ghidra, gdb, and lldb

Attaches to the target --backend/--connect/--dump name, then serves one client at a time until interrupted.

Usage: ntoseye gdbserver [OPTIONS]

Options:
      --listen <LISTEN>
          Address to listen on
          
          [default: 127.0.0.1:2345]

  -b, --backend <BACKEND>
          Debugger backend: 'kd' (Windows KD over serial, default), 'kdnet' (Windows KD over UDP), 'gdb' (QEMU GDB stub), or 'memory' (passive live-VM introspection)

      --connect <CONNECT>
          Backend target: GDB address, KD socket path, or KDNET listen address; unused by memory

      --kdnet-key <KDNET_KEY>
          KDNET encryption key (four base-36 components); required by the kdnet backend

      --memory-source <MEMORY_SOURCE>
          KD/KDNET memory source: auto (validated host memory, then KD fallback), host, or kd

      --dump <DUMP>
          Open a Windows kernel crash dump (.dmp) for offline analysis instead of attaching to a live VM

      --pdb-server <PDB_SERVER>
          Additional PDB symbol server URL (repeatable; tried before the Microsoft default), using the standard symbol-server path convention: {server}/{filename}/{guid}{age}/{filename}

      --force-download-symbols
          Force redownloading of symbols

  -h, --help
          Print help (see a summary with '-h')