AI Guide

AI Agent Operational Guide & Visual Stepping Protocol

📌 Full Guide Source: Read the complete public document at guides/AI_Guide.md.

This guide establishes the mandatory operational protocols and directory rules for AI agents interacting with WinDbgMCP.

---

1. Directory Hygiene & Target Workspace Architecture

For EVERY target binary analyzed, the AI agent MUST create:

analysis/<TARGET_NAME>/
├── mds/
│   ├── scratchpad.md               # Mandatory live log for disassemblies, registers & traces
│   └── <TARGET_NAME>_Final_Report.md # Executive summary report upon task completion
└── scripts/                        # ALL custom solvers, AOB tools, and analysis scripts

---

2. Live WinDbg GUI (WinDbgX) Visual Stepping Protocol

When attached to a desktop WinDbg GUI remote server (tcp:Port=5005):

1. Milestone Banners: Execute annotate_session(milestone="...") before major stepping or analysis phases to stream DML-colorized block banners into the user's WinDbg GUI window.
2. Live Disassembly Movement: Issue !de.disasm $ip L20 (or u $ip L20) after stepping (p, t, gu, ret, so) so the user can visually watch the disassembly cursor and register panel move live in their WinDbg GUI window.
3. Intent Banners: Pass the reasoning parameter on command execution tools so === [AI INTENT]: <reasoning> === streams live into the WinDbg GUI log.

---

📖 Live Example & Case Study

Check out a live example of an AI agent utilizing this operational protocol and toolset on a real target binary (GigaApp.exe):

👉 WinDbgX-MCP AI Reverse Engineering Protocol (GigaApp Case Study)