reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/win-dev-skills/plugins/windbg/skills/windbg-user-ttd-reverse-debugging-triage/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: windbg-user-ttd-reverse-debugging-triage
+description: 'Use when an app, service, or user-mode driver host TTD recording is available and earlier calls, writes, or lifetimes matter. Not for kernel replay or history from a normal dump.'
+---
+
+# TTD Reverse Debugging Triage
+
+**Load `windbg-diagnostic-method` first** if it is not already loaded in this
+conversation, and apply it throughout for evidence ranking, hypothesis testing,
+confidence calibration, independent review, and report validation. This skill
+adds the bug-family-specific commands and evidence requirements.
+
+## Requirements and scope
+
+Time Travel Debugging records a user-mode process for replay, including an
+authorized application, service, or user-mode driver host process. A dump alone
+contains no execution timeline. Confirm a valid recording and matching module
+symbols before attempting timeline queries. It does not record kernel execution
+or automatically include another process's server-side activity.
+
+Recording can change timing, require substantial storage, and capture sensitive
+memory. Obtain authorization before capture. Check the installed recorder's help
+for supported target, architecture, and options. WinDbg's **Launch executable
+(advanced)** / **Record with Time Travel Debugging** flow can record a named
+test application without guessing a recorder command.
+
+## Workflow
+
+### 1. Open and index the recording
+
+Open the recorded `.run` file in WinDbg and load public Windows symbols and
+matching PDBs for your own binaries.
+
+```text
+!tt.index
+dx @$cursession.TTD
+```
+
+Confirm the timeline range. Indexing and data-model availability depend on
+WinDbg/TTD versions; consult the installed help if the command is unavailable.
+
+### 2. Ask a bounded history question
+
+```text
+dx @$cursession.TTD.Calls("MyModule!MyFunction")
+dx @$cursession.TTD.Memory(<start-address>, <end-address>, "w")
+```
+
+Query the known function or exact memory range, then inspect relevant results
+and their timeline positions. An empty result can mean unmatched symbols,
+uninstrumented execution, or an out-of-range query, not proof of absence.
+
+Use the call query to find allocation/free or module lifetime transitions and
+the memory query to locate candidate writes. Account for allocator reuse: the
+same virtual address may represent different objects over the recording.
+
+### 3. Seek and inspect state
+
+```text
+!tt <position>
+k
+r
+g-
+```
+
+Seek to an actual position returned by the query. `g-` continues backward;
+use the installed reverse-step controls to refine the search. Capture the
+last-good and first-bad states, writer/caller stack, and ownership transition.
+
+Do not equate the last write with the bug until you establish the object's
+identity, valid lifetime, intended invariant, and relevant cross-thread order.
+
+### 4. Continue with a shipped investigation
+
+| Evidence | Skill |
+|---|---|
+| Bad free/write or allocation-boundary violation | `windbg-user-heap-corruption-investigation` |
+| Growing allocation/reservation usage | `windbg-user-virtual-memory-exhaustion` |
+| Lock survives coroutine suspension | `windbg-user-mutex-held-across-co-await` |
+| Blocker or cross-process dependency at the selected moment | `windbg-user-wait-chain-analysis` |
+
+For other user-mode families continue reasoning from the timeline rather than
+dispatching to absent skills. For a kernel crash use `windbg-kernel-bugcheck-triage`;
+TTD is not a kernel-history substitute.
+
+## Validation
+
+Record the question, trace identity, timeline positions, relevant object
+lifetime, and source/stack evidence. Test alternatives and state recording
+boundaries. A reproducible timeline proves what occurred in that recording;
+it does not establish that instrumentation preserved all production timing.
+
+## References
+
+- [Time Travel Debugging overview](https://learn.microsoft.com/windows-hardware/drivers/debuggercmds/time-travel-debugging-overview)
+- [TTD data-model queries](https://learn.microsoft.com/windows-hardware/drivers/debuggercmds/time-travel-debugging-object-model)
+- [TTD extension commands](https://learn.microsoft.com/windows-hardware/drivers/debuggercmds/time-travel-debugging-extension-commands)
+
+## Feedback
+
+Follow `FEEDBACK.md` and report a reviewed summary to
+[WinDbg-Feedback](https://github.com/microsoft/WinDbg-Feedback/issues).
+Include `windbg-user-ttd-reverse-debugging-triage` and the package version from
+`plugin.json`; never automatically upload a recording or its memory/query
+contents.