wineye

Look inside Windows memory,
WinDbg-style.

wineye inspects kernel crash dumps, raw memory images and live Hyper-V VMs from their memory alone — no debug transport in the guest. One Python file on MemProcFS's vmm.dll: no WSL, no pip package.

Download View on GitHub Français 
PS> python wineye.py --vmm C:\Tools\MemProcFS\vmm.dll --dump MEMORY.DMP
wineye> ps
   PID   PPID            EPROCESS                 PEB  Name
----------------------------------------------------------------------
     4      0  0xffffb00012340004  0x0000000000000000  System
  7480   6312  0xffffb00012347480  0x0000007ff0000000  notepad.exe
wineye> x nt!PsInitialSystemProcess
wineye> dq nt!PsInitialSystemProcess L4

What it does

Passive, read-only analysis: the target does not know it is being looked at.

Any memory source

Kernel .dmp, .raw / .mem / .vmem images, any LeechCore device, or a live Hyper-V VM.

WinDbg commands

ps, lm, x, dq, dt, !vad, !handle, pattern search — with PDB symbols.

Server modes

Expose the target as an MCP server for AI agents, a gdbserver, or a DAP adapter for your IDE.

Scriptable

-c "ps;lm", --batch, --json, or import wineye and use the Vmm class.

Quick start

Windows x64, Python 3.10 or newer.

  1. Get vmm.dll and leechcore.dll from a MemProcFS release.
  2. Download wineye.py.
  3. Open a dump:
python wineye.py --vmm C:\Tools\MemProcFS\vmm.dll --dump C:\dumps\MEMORY.DMP
python wineye.py --vmm C:\Tools\MemProcFS\vmm.dll --dump vm0.raw -c "ps;lm 4" --batch --json

Live Hyper-V VMs (--live, --vm N, --from-vm N) need administrator rights and the components set up by HvKdFusion.

Commands

Addresses accept 0x.., decimal and module!symbol.

CommandEffect
psprocesses
!process [pid]process details
.pid <n|-1>process context (-1 = physical memory)
lm [pid]modules
x <mod>!<sym>resolve a symbol through the PDB
db | dw | dd | dq <addr> [L<n>]hex dump
dt <mod>!<type> [field] [addr]type size, field offset and value
!vad [pid], !handle [pid]VADs, handles
s <addr> <len> <hex>byte pattern search
freeze, resume, r [reg...]control channel on a live VM (--vm N or .ctl N)

Server modes

Run --serve instead of the REPL. Read-only passive memory; the banner goes to stderr so stdout carries only the protocol.

ModeCommandUse
MCP--serve mcpJSON-RPC 2.0 over stdio for AI / agent clients: list_processes, list_modules, read_memory, resolve_symbol, ...
gdbserver--serve gdb [--listen 127.0.0.1:2159]GDB Remote Serial Protocol: target remote, then x/16xg, info registers
DAP--serve dap [--listen 127.0.0.1:4711]Debug Adapter Protocol for an IDE: modules, readMemory, evaluate
 
{ "command": "python",
  "args": ["C:\\Tools\\wineye\\wineye.py", "--vmm", "C:\\Tools\\MemProcFS\\vmm.dll",
           "--dump", "C:\\dumps\\vm0.raw", "--serve", "mcp"] }

Limits

Passive memory gives no run control: no breakpoints, no single-stepping, no register writes. For that, use WinDbg/kd through HvKdFusion (hvkdfusion.py debug).