A time travel extension for Windows

The new Windbg from Microsoft comes with a powerful extension to allow for forward stepping and backward stepping. This allows the user to effectively go both foward and backward through time, hence the name McFly.

The introduction of time-travel debugging radically changed the capabilities of the Windows debugger. By using the existing powerful capabilities of Windbg along with the new time travel features, we can create a timeline of interesting changes inside the process during execution. It can help answer questions like:

1. What system calls were made?
2. What strings were in memory half way through the trace?
3. How does a hashing algorithm work?
4. What is throwing a null reference exception?

1. Security researchers
2. Application developers
3. The curious

1. Index register and memory values before and after any instruction
2. Search for changes in memory over time
3. Find most commonly used modules/functions/instructions
4. Get statistical analysis on memory, syscalls, function calls, etc

# load the extension
.load C:\users\you\Downloads\mcfly.dll

# get help
!mf help
!mf help init
!mf help start
!mf help index

# add settings
!mf settings list
!mf settings open
!mf settings list
!mf settings reload
!mf settings list

# start the server
!mf start

# index all kernel32 calls
!mf index --bm kernel32!*

# index all reads/writes to abc123 through abc12b
!mf index --ba rw8:abc123

This application is written for cutting edge Microsoft systems, which should be obvious based on the requirement of having the latest Windbg release.

Make sure you match the build bitness to the trace file bitness. You cannot use a build of the extension on a mismatched bitness (32 v 64)

1. Clone the repository and build using MSBuild. If you don't want to use the command line, then get VS2017 and build from there.
2. Open the new Windbg from the Microsoft App store
3. Open a trace file
4. .load c:\path\to\mcfly.dll (see the note on matching bitness above)
5. !mf help

These are the tools I am using for development. If you use something different your mileage my vary.

1. Windows 10 x64
2. Visual Studio 2017
3. Resharper 2017.3
4. NDepend 2018.1.0
5. GhostDoc Pro 5.9