ForensicDbg

ForensicDbg is a modern post-mortem debugger for native Windows software, built to make difficult crashes easier to investigate for both engineers and AI tools. It handles x86 and x64 crash dumps, can attach to running processes, and can become the system's just-in-time debugger so it is available when a failure happens. The product focuses on user-mode debugging and presents process state through a visual interface instead of expecting every user to interpret raw addresses and debugger commands. It is currently offered through a free private beta, with access granted by invitation.

The desktop interface connects the pieces of a crash investigation. Memory regions are labeled with symbol names and object types, objects appear in a structure initialization format, and an address can be clicked to move through the process space. Panels stay synchronized while the user navigates, and color-coded output is designed to make different kinds of data recognizable at a glance. Multi-threaded symbol loading keeps symbol work moving, while SourceServer and SourceLink support help connect compiled state back to source. Light and dark modes follow the system, and a simple C++ expression evaluator supports targeted inspection.

Its deeper value lies in interpreting incomplete or misleading crash evidence. ForensicDbg deduces types from usage and references, tracks register values as they move through disassembly, and validates call stacks so suspicious references don't masquerade as reliable frames. It can simulate the Windows image loader to reconstruct missing read-only regions in minidumps. It also attempts to select the thread, frame, and instruction that caused the exception automatically. These steps encode the sort of cross-checking an experienced native debugger performs before deciding which data deserves attention.

That reconstruction work matters because a minidump may omit read-only process regions that are useful for understanding code and constants. By simulating the loader, ForensicDbg aims to restore enough of that missing context to make navigation and analysis more complete. Type deduction then uses references and observed usage to label data that raw memory alone wouldn't explain clearly. Register tracking connects values with the instructions that move them, while stack validation removes misleading references before they become the foundation for a diagnosis. The result is meant to be a linked account of process state rather than a set of isolated debugger views.

An included MCP server exposes the same debugging engine to compatible AI coding and analysis tools through standard input and output communication. Instead of handing a model an undifferentiated block of hexadecimal data, the server supplies interpreted and labeled debugger output. That lets the external AI spend more of its context on reasoning about the failure and less on recovering basic relationships that the debugger already understands. ForensicDbg itself isn't presented as the AI model. It prepares structured crash evidence and provides the interface through which another tool can inspect it.

The product fits C++ engineers, native Windows teams, reliability specialists, and developers responsible for failures that are hard to reproduce locally. A team can open a customer crash dump for visual investigation, attach the debugger while testing a live process, or register it for just-in-time analysis during development. Teams that already work with an MCP-compatible coding agent can also let that agent query the interpreted state as part of a diagnosis. The visual workflow matters for engineers who want to stay in control, while the MCP path gives automation access to the same labeled process model. The official product example shows the intended level of specificity by tracing a null dereference to an empty text window and identifying where a missing guard should be added.

ForensicDbg is still in active development and the current beta is private, so prospective users must submit their name and email to request an invitation. The beta is free, but the site doesn't publish post-beta pricing or a general release date. Its scope is also intentionally narrow. It targets Windows user-mode crashes on x86 and x64 rather than every platform, architecture, or debugging discipline. Within that boundary, the combination of reconstructed minidump regions, type deduction, validated call stacks, linked visual navigation, and an MCP interface is a substantive toolkit for teams that spend real time tracing native Windows failures.