vm_snapshot_restore

MCP tool from Windbg MCP by memoryforensics1

Restore a named snapshot (debug sessions are cleanly torn down and can reconnect after)

How to use it

vm_snapshot_restore is exposed by the Windbg MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the vm_snapshot_restore tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install Windbg MCP

$pip install frida-tools

FULL WINDBG MCP LISTING

Other tools in Windbg MCP (28)

get_system_state

Full state overview — VM power, KD, guest ops, UMD. Always allowed.

guest_kill_process

Kill a process by PID

guest_list_processes

List running processes with PIDs

guest_run_command

Execute command in guest OS, capture stdout/stderr

guest_transfer_from_vm

Copy file from guest to host

guest_transfer_to_vm

Copy file from host to guest

Halt running target (Ctrl+Break)

Attach to kernel via KDNET. Target breaks on connect.

Resume target execution

Detach from kernel. Resumes target so VM keeps running.

Run any WinDbg command (k, r, lm, !process 0 0, !analyze -v, etc.)

Step one instruction (into or over)

kd_wait_for_event

Wait for breakpoint/exception with timeout. Always returns.

umd_dbgsrv_connect

Connect to remote dbgsrv in guest

umd_dbgsrv_execute

Attach to PID, run WinDbg commands, detach

umd_dbgsrv_skill

dbgsrv best practices and WinDbg command reference for LLMs

Inject JS, eval expressions, list processes, detach

umd_frida_attach

Attach Frida to a guest process

umd_frida_skill

Frida best practices and API reference for LLMs

Time Travel Debugging — record, stop, retrieve, list traces

Query TTD traces (not yet implemented)

Freeze entire VM

Unpause a paused VM

Capture VM display as PNG

Switch the active VM target at runtime (VMX path + credentials)

vm_snapshot_list

List available snapshots

Power on the VM

Shut down (graceful or hard)