~/bl4nk - tools

Connecting LLM to IDA MCP Server in a Virtual Machine (feat. Gemini CLI)

2025-12-10T00:00:00+00:00

0x00. Introduction

MCP (Model Context Protocol) is an open standard that enables AI models to communicate with other systems. By using MCP, LLMs can connect to various data sources like PCs or databases, and tools like search engines or calculators to perform complex and valuable tasks. It’s often described as a “USB-C port for AI.”

While there is an official plugin from Hex-Rays, this guide is based on the GitHub repository which has more stars and community traction. I also structured this setup using a virtual machine for the MCP Server, enabling a workflow where I can freely analyze in parallel while the agent handles its tasks.

0x01. Install

Guest

As mentioned, the MCP server will be set up inside a virtual machine. You can use any OS that supports IDA (macOS, Linux, and Windows), but I used Windows 10 x64.

Python

Python 3.11 or higher is required. Usually, IDA installs Python if it’s missing, but older versions might install 3.10. Since we’re running this in a VM, it’s easier to install the latest version beforehand.

I personally install it in C:\Python\Python[VER]. Make sure to add the following paths to your system’s PATH environment variable:

C:\Python\Python314\
C:\Python\Python314\Scripts\

IDA Pro

The GitHub repository recommends IDA Pro 8.3 or higher, or version 9. Note that IDA Free is not supported, but according to sources, IDA Home (the individual plan) works fine.

During installation, uncheck the option to install Python so that IDA uses the version you previously installed.

IDA MCP

Refer to the GitHub installation guide for detailed steps.

pip uninstall ida-pro-mcp
pip install https://github.com/mrexodia/ida-pro-mcp/archive/refs/heads/main.zip

ida-pro-mcp --install

After installation, go to Edit -> Plugins -> MCP in the IDA menu. If the output looks like this, the installation was successful:

[MCP] Server started:
  Streamable HTTP: http://127.0.0.1:13337/mcp
  SSE: http://127.0.0.1:13337/sse
  Config: http://127.0.0.1:13337/config.html

Since it listens on 127.0.0.1 by default, you can set up port forwarding or simply run the following command to allow host communication:

ida-pro-mcp --transport http://0.0.0.0:13337/sse

Host

While you could install the AI application on the guest OS, I preferred separating the guest and host. I use these applications frequently on my host, and it feels slightly faster.

The host environment is Windows 11 with WSL, and the following steps are for WSL.

Gemini CLI

The demo on GitHub uses Claude Desktop, but since I subscribe to Gemini, I’ll be using the Gemini CLI.

# Install nvm and Node.js (requires version > 20)
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
nvm install node

# Install Gemini CLI
npm install -g @google/gemini-cli

To communicate with the guest, add the MCP server information to ~/.gemini/settings.json:

{
  "mcpServers": {
    "ida-vm": {
      "url": "http://xxx.xxx.xxx.xxx:13337/sse"
    }
  }
}

If everything is set up correctly, running the gemini command should show a log saying Using: 1 MCP server.


   ░░░            ░░░░░░░░░  ░░░░░░░░░░ ░░░░░░   ░░░░░░ ░░░░░ ░░░░░░   ░░░░░ ░░░░░
     ░░░         ░░░     ░░░ ░░░        ░░░░░░   ░░░░░░  ░░░  ░░░░░░   ░░░░░  ░░░
       ░░░      ░░░          ░░░        ░░░ ░░░ ░░░ ░░░  ░░░  ░░░ ░░░  ░░░    ░░░
 ███     ░░░    █████████░░██████████ ██████ ░░██████░█████░██████ ░░█████ █████░
   ███ ░░░     ███░    ███░███░░      ██████  ░██████░░███░░██████  ░█████  ███░░
     ███      ███░░░     ░░███░░      ███░███ ███ ███░░███░░███░███  ███░░  ███░░
   ░░░ ███    ███ ░░░█████░██████░░░░░███░░█████  ███░░███░░███░░███ ███░░░ ███░░░
     ███      ███      ███ ███        ███   ███   ███  ███  ███   ██████    ███
   ███         ███     ███ ███        ███         ███  ███  ███    █████    ███
 ███            █████████  ██████████ ███         ███ █████ ███     █████  █████

Tips for getting started:
1. Ask questions, edit files, or run commands.
2. Be specific for the best results.
3. Create GEMINI.md files to customize your interactions with Gemini.
4. /help for more information.

 Using: 1 MCP server
╭──────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ >   Type your message or @path/to/file                                                               │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────╯
 ~/mcp                          no sandbox (see /docs)                           Auto (Gemini 3) /model

You can verify the available tools using the /mcp command.

> /mcp

Configured MCP servers:

🟢 ida-vm - Ready (71 tools, 15 resources)
  Tools:
  - analyze_funcs
  - analyze_strings
  - apply_types
  ...
  Resources:
  - idb_metadata_resource (ida://idb/metadata) [application/json]
  - idb_segments_resource (ida://idb/segments) [application/json]
  - idb_entrypoints_resource (ida://idb/entrypoints) [application/json]
  ...

0x02. Prompt Engineering

For better analysis results, using a well-crafted prompt is highly recommended. Here is the default recommended prompt:

Your task is to analyze the open file in IDA Pro. You can use the MCP tools to retrieve information. In general use the following strategy:

- Inspect the decompilation and add comments with your findings
- Rename variables to more sensible names
- Change the variable and argument types if necessary (especially pointer and array types)
- Change function names to be more descriptive
- If more details are necessary, disassemble the function and add comments with your findings
- NEVER convert number bases yourself. Use the `int_convert` MCP tool if needed!
- Do not attempt brute forcing, derive any solutions purely from the disassembly and simple python scripts
- Create a report.md with your findings and steps taken at the end
- When you find a solution, prompt to user for feedback with the password you found

And here is a more detailed prompt shared by another user (@can1357):

Your task is to create a complete and comprehensive reverse engineering analysis. Reference AGENTS.md to understand the project goals and ensure the analysis serves our purposes.

Use the following systematic methodology:

1. **Decompilation Analysis**
   - Thoroughly inspect the decompiler output
   - Add detailed comments documenting your findings
   - Focus on understanding the actual functionality and purpose of each component (do not rely on old, incorrect comments)

2. **Improve Readability in the Database**
   - Rename variables to sensible, descriptive names
   - Correct variable and argument types where necessary (especially pointers and array types)
   - Update function names to be descriptive of their actual purpose

3. **Deep Dive When Needed**
   - If more details are necessary, examine the disassembly and add comments with findings
   - Document any low-level behaviors that aren't clear from the decompilation alone
   - Use sub-agents to perform detailed analysis

4. **Important Constraints**
   - NEVER convert number bases yourself - use the int_convert MCP tool if needed
   - Use MCP tools to retrieve information as necessary
   - Derive all conclusions from actual analysis, not assumptions

5. **Documentation**
   - Produce comprehensive RE/*.md files with your findings
   - Document the steps taken and methodology used
   - When asked by the user, ensure accuracy over previous analysis file
   - Organize findings in a way that serves the project goals outlined in AGENTS.md or CLAUDE.md

Windows kernel debugging

2025-04-25T00:00:00+00:00

0x00. Introduction

This post covers setting up an environment for Windows kernel analysis and documents useful commands.

0x01. Setup

Host (Debugger)

Previously, the setup process was complex with Windows SDK, Virtual KD, etc. for convenience. Now it’s much simpler with the official WinDbg release. Just install WinDbg from the Microsoft Store and run it.

From the top menu, go to File -> Start Debugging -> Attach to kernel, select COM, and configure as follows:

After completing the configuration and clicking “OK” in the lower right, it enters debugging standby mode.

Guest (Debuggee)

The debugging target can be set up through various programs. This post describes the configuration method when using VMware.

First, start the target VM, run PowerShell with administrator privileges, and execute these commands:

bcdedit /debug on
bcdedit /dbgsettings serial debugport:1 baudrate:115200

Then shut down the VM, select VM -> Settings -> Add from the top menu, and add a Serial Port.

Configure the added Serial Port as follows. Note that selecting “The other end is a virtual machine” instead of “The other end is an application” also seems to work for connection.

Finally, starting the target VM connects it to the host.

0x02. Commands

Modules

`lm` (List Modules)

Lists loaded modules or checks information for a specific module.

kd> lm
kd> lm m fltmgr
kd> lm Dvm fltmgr

Note that kernel mode regions load at high addresses like fffff800'00000000.

`x` (eXamine symbols)

Searches symbols or finds specific symbols.

kd> x win32k!
kd> x win32k!vStr*

Symbols

`!sym noisy` (Noisy symbol loading)

Displays detailed symbol loading process. Good for debugging loading-related issues.

kd> !sym noisy

`!sympath` (Set symbol path)

Sets the path to symbol server or local directory where symbol files are stored.

kd> !sympath SRV*C:\symbols*https://msdl.microsoft.com/download/symbols
kd> !sympath C:\symbols

`.reload` (Reload symbols)

Reloads symbols. The /f option forces symbol loading.

kd> .reload
kd> .reload /f CLFS

Memory

`db` `dw` `dd` `dq` (Display memory)

Displays memory in byte, word, double word, and quad word units respectively. You can specify the count by adding L[Length], specify range by entering the end address, or use register names to read and use values stored in registers.

kd> db [Address]
kd> dw [Address] L[Length]
kd> dd [Address] [Address]
kd> dq rsp

`ds` `du` `dc` (Display string)

Displays memory as ASCII and Unicode strings respectively. dc displays both hex values and strings simultaneously.

kd> ds [Address]
kd> du [Address]

`dps` (Display Pointers and Symbols)

Interprets and displays pointers stored in memory based on symbol information.

kd> dps [Address]

`u` `ub` `uf` (Unassemble)

Interprets and displays instructions in memory as assembly. Using basic u together with ub, which displays assembly code in reverse from the input address, is convenient for viewing instructions before and after at once.

uf displays the entire function. You can input any location within the function, not just the beginning. However, symbols must be properly loaded.

kd> u rip
kd> ub rip
kd> uf [Address]

Information

`!analyze -v` (Analyze crash dump)

When a crash occurs, it displays various information including the general cause and register states.

kd> !analyze -v

`k` `kv` (Stack trace)

Displays the current thread’s call stack. The kv command also displays the values of passed arguments.

kd> k
kd> kv

`!process` `!thread` (Process / Thread information)

Displays process information. Using !process alone displays detailed information about the current process. Adding 0 0 displays brief information about all processes. To check specific process information, input that process’s address.

!thread displays thread information. When used alone, it displays current thread information. Inputting a specific thread address displays that thread’s information.

kd> !process
kd> !process 0 0
kd> !process [Address]
kd> !thread
kd> !thread [Address]

Debug

`bp` `ba` (Break Point)

Stops execution at the specified address or symbol. The ba command can stop on read/write/execute operations on specific memory.

kd> bp 0x401000
kd> bp ntdll!NtCreateFile
kd> ba [r/w/x/rw][Length] [Address]

`p` `t` `pt` `g` `pc` (Flow control)

Various debugging flow control commands exist: p(ni) executes the next instruction, t(si) executes the next instruction and steps into functions, pt executes until function completion, g runs until the next breakpoint, and pc runs to a specific address.

kd> p
kd> t
kd> pt
kd> g
kd> pc [Address]

Setting up Windows for pwnable

2025-01-15T00:00:00+00:00

0x00. Introduction

After purchasing a new desktop and frequently reconfiguring the environment due to driver issues, I thought it would be nice to document the setup process for reference. The installation environment is Windows 11 + Ubuntu(WSL).

I’ll add more useful settings or tools as I discover them.

0x01. Windows

WSL

In Turn Windows Features On or Off, check the following items.

After restarting, execute these commands in the terminal.

# Install WSL
wsl --install

# Check available packages and versions
wsl --list --online

# Specific version
wsl --install -d Ubuntu-[xx.xx]
# Latest version
wsl --install -d Ubuntu

Visual Studio Code

Theme Settings

After installing the desired theme, press ctrl + shift + p -> Preferences: Color Theme -> Browse Additional Color Themes... to select it.

Keyboard Shortcuts

Press ctrl + shift + p -> Preferences: Open Keyboard Shortcuts(JSON) and paste the following. This is good when switching between editor and terminal.

[
    {
        "key":     "ctrl+`",
        "command": "workbench.action.terminal.focus"
    },
    {
        "key":     "ctrl+`",
        "command": "workbench.action.focusActiveEditorGroup",
        "when":    "terminalFocus"
    }    
]

This is more convenient when switching between multiple windows.

[
    {
        "key": "ctrl+`",
        "command": "workbench.action.focusNextGroup"
    }
]

VMware

You need to register on the Broadcom official website. I had trouble because the verification email didn’t arrive when I thoughtlessly used my university email, so just use gmail.com to be safe.

After logging in, select Software -> VMware Cloud Foundation -> My Downloads
Find VMware Workstation Pro and select the desired release
Note that you must check I agree to the Terms and Conditions to enable the download button

Fill in the address field that appears and click the download button again to complete the installation.

IDA Free

While it only supports x86/x86-64 architectures, IDA is now available for free. On the hex-rays official website, select Products -> IDA Free and receive a license through email verification.

It seems fine now, but I once had an experience where it was too slow, and using a VPN to Belgium (where their headquarters is) made it much faster.

shell:sendto

Typing shell:sendto in the win + r run window lets you register programs that appear in the send to menu when right-clicking files.

For example, create an IDA shortcut and place it in that folder. Then right-click a binary and select IDA from send to to analyze it directly. It’s a bit inconvenient in Windows 11 since you need to press Show more options to see it, but it’s quite useful.

You can apparently edit the registry to revert to the Windows 10 menu, but I skipped it to keep the new computer feeling.

0x02. Linux

Packages

# initialize
sudo apt update
sudo apt upgrade -y

# oh my zsh
sudo apt install zsh git -y
sh -c "$(wget https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh -O -)"

# zsh plugins
git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting
sed -i 's/^plugins=(git)$/plugins=(git zsh-autosuggestions zsh-syntax-highlighting)/' ~/.zshrc
source .zshrc

# python packages
sudo apt install python3-pwntools -y

# one gadget
sudo apt install ruby -y
sudo gem install one_gadget

# gef
bash -c "$(wget https://gef.blah.cat/sh -O -)"

jekyll

# Install dependencies
sudo apt install ruby-full build-essential zlib1g-dev -y

# Change the file according to your shell
echo '# Install Ruby Gems to ~/.gems' >> ~/.zshrc
echo 'export GEM_HOME="$HOME/.gems"' >> ~/.zshrc
echo 'export PATH="$HOME/.gems/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

# Install jekyll
gem install jekyll bundler

# Execute in jekyll directory such as github.io repository
cd fitbl4nk.github.io
bundle install

zola

# Download the latest version of zola (https://github.com/getzola/zola/releases)
wget https://github.com/getzola/zola/releases/download/v0.20.0/zola-v0.20.0-x86_64-unknown-linux-gnu.tar.gz
rm zola-v0.20.0-x86_64-unknown-linux-gnu.tar.gz
sudo mv zola /usr/local/bin

# Execute in zola directory such as github.io repository
cd bl4nk.kr
zola serve

Automating GDB Debugging with Pwntools

2024-05-31T00:00:00+00:00

0x00. Introduction

When solving pwnable challenges, I primarily use pwntools for scripting and gdb for debugging. Usually, you’d spawn a process and attach gdb from another terminal - but with pwntools and tmux, we can automate all of this within the script itself.

0x01. Debugging with pwntools

Spawning Process

BINARY = ""
LIBRARY = ""

# for remote
s = remote(server, port)
# for local
s = process(BINARY, env={"LD_PRELOAD" : LIBRARY})

Use remote for remote, and process for local to run and connect to processes. Especially, remote is used not only when connecting to actual servers but also when connecting to locally running docker.

Open Debugger

The attach function from pwntools’ gdb module lets you attach a debugger to a running process:

bp = {
    'main' : 0x555555555249,
    'end_of_main' : 0x5555555552d3,
    'foo' : 0x55555555566f,
}

gs = f'''
b *{bp['main']}
continue
'''

gdb.attach(s, gs)

The second argument takes a gdb script, so you can automate setting breakpoints and continuing code flow.

Also, you can attach debugger to a process inside of docker with pid, using the following script:

CONTAINER = ""

pid = os.popen(f"sudo docker top {CONTAINER} -eo pid,comm | grep {BINARY} | awk '{{print $1}}'").read()
gdb.attach(int(pid), gs, exe=BINARY)

With this script, it is possible to minimize the difference between local and remote environment. However, errors can occasionally occur when inside and outside of container has permissions that don’t match (see Permission Error).

Set Terminal

You need to configure where the attached debugger shows up. Simple enough with the context module’s terminal variable - just pick your preferred layout:

context.terminal = ['tmux', 'splitw', '-h']     # split current window horizontally
context.terminal = ['tmux', 'splitw', '-v']     # split current window vertically
context.terminal = ['tmux', 'splitw', '-hf']    # split entire window horizontally
context.terminal = ['tmux', 'splitw', '-vf']    # split entire window vertically

I know it’s pretty old-fashioned, but I’ve been using tmux since it’s pretty clean. You should also note that you’re actually running inside a tmux session before executing the script (see Tmux Session Error).

0x02. Conclusion

Here’s the final script I use as my exploit.py template:

from pwn import *
from pwnlib.util.packing import p32, p64, u32, u64
from time import sleep
from argparse import ArgumentParser

BINARY = ""
LIBRARY = ""
CONTAINER = ""
code_base = 0x555555554000
bp = {
    'main' : code_base + 0x16ae,
}

gs = f'''
b *{bp["main"]}
continue
'''
context.terminal = ['tmux', 'splitw', '-hf']

def main(server, port, debug):
    if(port):
        s = remote(server, port)
        if debug:
            pid = os.popen(f"sudo docker top {CONTAINER} -eo pid,comm | grep {BINARY} | awk '{{print $1}}'").read()
            gdb.attach(int(pid), gs, exe=BINARY)
    else:
        s = process(BINARY, env={"LD_PRELOAD" : LIBRARY})
        if debug:
            gdb.attach(s, gs)
    elf = ELF(BINARY)
    lib = ELF(LIBRARY)

    s.interactive()

if __name__=='__main__':
    parser = ArgumentParser()
    parser.add_argument('-s', '--server', type=str, default="0.0.0.0")
    parser.add_argument('-p', '--port', type=int)
    parser.add_argument('-d', '--debug', type=int, default=1)
    args = parser.parse_args()
    main(args.server, args.port, args.debug)

The main function takes three arguments. If -p or --port is provided, it connects remotely. Otherwise, it runs locally for debugging:

➜  python3 exploit.py -p 7777
➜  python3 exploit.py --port 7777

When you’re done debugging, pass 0 to -d or --debug to run without a debugger:

➜  python3 exploit.py -d 0
➜  python3 exploit.py --debug 0

Finally, to hit the actual server, pass the domain or IP to -s or --server - and definitely disable debugging:

➜  python3 exploit.py -s server.com -d 0
➜  python3 exploit.py --server x.x.x.x --debug 0

Side note: I’m already doing from pwn import *, but I explicitly import the packing functions again on line 2 because vscode doesn’t seem to find them. Otherwise it shows annoying underlines.

0x03. Troubleshooting

Permission Error

GEF for linux ready, type `gef' to start, `gef config' to configure
93 commands loaded and 5 functions added for GDB 12.1 in 0.00ms using Python engine 3.10
Reading symbols from challenge...
(No debugging symbols found in challenge)
Attaching to program: /home/user/challenge, process 165353
Could not attach to process.  If your uid matches the uid of the target
process, check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user.  For more details, see /etc/sysctl.d/10-ptrace.conf
ptrace: Operation not permitted.
/home/user/challenge/165353: No such file or directory.
/tmp/pwnlib-gdbscript-kd8sfrgq.gdb:4: Error in sourced command file:
The program is not being run.
gef➤

When debugging a process inside of docker, the error above might occurs sometimes. If we take a closer look at the error, it’s something to do with permission. Printing out the current process list is as follows:

➜  ps -ef | grep challenge
root      165261  165241  0 16:01 ?        00:00:00 /bin/sh -c socat TCP-LISTEN:8794,reuseaddr,fork EXEC:/home/ctf/challenge
root      165284  165261  0 16:01 ?        00:00:00 socat TCP-LISTEN:8794,reuseaddr,fork EXEC:/home/ctf/challenge
root      165521  165284  0 16:05 ?        00:00:00 socat TCP-LISTEN:8794,reuseaddr,fork EXEC:/home/ctf/challenge
root      165524  165521  0 16:05 ?        00:00:00 /home/ctf/challenge
user      165545   66182  0 16:05 pts/9    00:00:00 /usr/bin/gdb -q challenge 165524 -x /tmp/pwnlib-gdbscript-webj6wb7.gdb

The debugger opened via python script is executed with user permission, whereas the target process challenge is executed with root permission. In this case attaching to the process fails, so the following lines should be added to Dockerfile.

RUN /usr/sbin/useradd -u 1000 ctf
USER ctf

You should note that the uid above should be identical with the user’s, who is running the python script. In the case of Ubuntu 24.04, for example, the user ubuntu is preempting uid 1000, possibly causing error because a new user will have uid 1001.

Tmux Session Error

This is what greeted me when I first ran the script:

➜  python3 exploit.py
[+] Starting local process './challenge': pid 3886107
[*] running in new terminal: ['/usr/bin/gdb', '-q', './challenge', '3886107', '-x', '/tmp/pwnjmmmxq9k.gdb']
Traceback (most recent call last):
  File "/home/user/exploit.py", line 133, in <module>
    main()
  File "/home/user/exploit.py", line 60, in main
    gdb.attach(s, gs)
  File "/home/user/.local/lib/python3.10/site-packages/pwnlib/context/__init__.py", line 1581, in setter
    return function(*a, **kw)
  File "/home/user/.local/lib/python3.10/site-packages/pwnlib/gdb.py", line 1100, in attach
    gdb_pid = misc.run_in_new_terminal(cmd, preexec_fn = preexec_fn)
  File "/home/user/.local/lib/python3.10/site-packages/pwnlib/util/misc.py", line 413, in run_in_new_terminal
    pid = int(out)
ValueError: invalid literal for int() with base 10: b''
[*] Stopped process './challenge' (pid 3886107)

The error hit at gdb.attach(s, gs) with a type issue, so I spent way too long thinking it was a pid datatype mismatch. Turns out it was something completely different.

The script tries to create a terminal in a tmux session - but there was no active tmux session to attach to. I naively assumed it would just create one automatically…

➜  tmux
➜  python3 exploit.py

~/bl4nk - tools

Connecting LLM to IDA MCP Server in a Virtual Machine (feat. Gemini CLI)

0x00. Introduction

0x01. Install

Guest

Python

IDA Pro

IDA MCP

Host

Gemini CLI

0x02. Prompt Engineering

Windows kernel debugging

0x00. Introduction

0x01. Setup

Host (Debugger)

Guest (Debuggee)

0x02. Commands

Modules

lm (List Modules)

x (eXamine symbols)

Symbols

!sym noisy (Noisy symbol loading)

!sympath (Set symbol path)

.reload (Reload symbols)

Memory

db dw dd dq (Display memory)

ds du dc (Display string)

dps (Display Pointers and Symbols)

u ub uf (Unassemble)

Information

!analyze -v (Analyze crash dump)

k kv (Stack trace)

!process !thread (Process / Thread information)

Debug

bp ba (Break Point)

p t pt g pc (Flow control)

Setting up Windows for pwnable

0x00. Introduction

0x01. Windows

WSL

Visual Studio Code

Theme Settings

Keyboard Shortcuts

VMware

IDA Free

shell:sendto

0x02. Linux

Packages

jekyll

zola

Automating GDB Debugging with Pwntools

0x00. Introduction

0x01. Debugging with pwntools

Spawning Process

Open Debugger

Set Terminal

0x02. Conclusion

0x03. Troubleshooting

Permission Error

Tmux Session Error

`lm` (List Modules)

`x` (eXamine symbols)

`!sym noisy` (Noisy symbol loading)

`!sympath` (Set symbol path)

`.reload` (Reload symbols)

`db` `dw` `dd` `dq` (Display memory)

`ds` `du` `dc` (Display string)

`dps` (Display Pointers and Symbols)

`u` `ub` `uf` (Unassemble)

`!analyze -v` (Analyze crash dump)

`k` `kv` (Stack trace)

`!process` `!thread` (Process / Thread information)

`bp` `ba` (Break Point)

`p` `t` `pt` `g` `pc` (Flow control)