bb

Benowin Blanc — Windows through a detective's lens.

(Name credits go to my beloved spouse. ꨄ︎)

A set of command-line tools that parse Windows SDK and PHNT headers via libclang and let you inspect what's actually in them: struct layouts, field offsets, enum values, constants, #define macros, and function declarations with full ABI breakdowns — the works.

Think of it as dt + x from WinDbg, but you don't need a debugger running, and it works against any SDK version, architecture, or PHNT release you throw at it.

Try bb viewer in your browser

_{bb-viewer — a vanilla TypeScript SPA built with Bun, powered by bb's JSON exports.}

Browse 8,000+ functions, 5,000+ types, and 25,000+ constants from the Windows SDK and PHNT headers across all architectures (amd64, x86, arm64, arm) — with ABI layouts, memory visualizations, C expressions, and an interactive type graph. No install required.

Dashboard — stats, charts, top types	CreateFileW — ABI layout, metadata, known values

bb-types Struct and class layouts, right in your terminal

bb-consts Constants, enums, and macro definitions

bb-types-tui Interactive struct browser

bb-consts-tui Interactive constant browser

What is this?

Windows ships with thousands of C/C++ headers (the Windows SDK) that define every struct, enum, constant, macro, and function the OS exposes. Separately, the community-maintained PHNT (Process Hacker NT headers) documents internal structures and syscalls that Microsoft doesn't publish.

bb parses these headers with libclang and gives you fast, searchable, pretty-printed access to all of it — struct layouts, constant values, function ABIs with per-parameter register/stack locations, and more (hell, even TUIs!) — no debugger, no IDE, no digging through .h files by hand.

Quick start

Building

On a Windows host, you will need the following: - Visual Studio 2019/2022 Build Tools - LLVM + Clang (libclang.dll) version >=18.1 - Rust 2024 edition - uv (Python package + project manager — winget install --id=astral-sh.uv -e). Plain Python >=3.10 also works as a fallback.

Afterwards, you may produce the binaries by invoking the following command:

.\update-submodules.ps1   # init + generate submodule data
cargo build --release

The project uses two submodules, managed by update-submodules.ps1:

You can update them individually or all at once (.\update-submodules.ps1). Both support env var overrides for custom data:

AST cache

After the first bb-funcs / bb-types / bb-consts invocation, the parsed translation unit is saved (via clang_saveTranslationUnit) under %LOCALAPPDATA%\bb\ast\<sha256>.ast. Subsequent runs with the same SDK + arch + mode load the AST directly and skip libclang's full re-parse. Typical numbers on this SDK / WDK combo:

The cache key hashes the synthetic header content, every clang argument, and the bb-sdk crate version — any change to header config, SDK install path, target arch, or a bb-sdk release invalidates automatically. Saved ASTs are ~80 MB; delete the bb/ast/ directory to nuke them, or set BB_NO_CACHE=1 to bypass per-invocation.

First commands

Inspect a struct layout:

bb-types --struct _PEB

Recurse into nested types:

bb-types --phnt --struct _PEB --depth 2

Search for constants by wildcard:

bb-consts --name GENERIC_*

Scope to a specific enum:

bb-consts --enum _MINIDUMP_TYPE

Use Enum::Constant syntax to search within enums:

bb-consts --name "_MINIDUMP_TYPE::*"

Target a different architecture from your host:

bb-types --arch arm64 --struct _CONTEXT

Inspect a function's ABI breakdown:

bb-funcs --name CreateFileW

List exported functions from a header:

bb-funcs --name "Create*" --filter fileapi.h --exported

Filter functions with SQL WHERE clauses:

bb-funcs --where "params > 3 AND return_type = 'BOOL'"
bb-funcs --where "name LIKE '%File%' AND is_exported = true"

Filter kernel/driver functions by IRQL constraint:

bb-funcs --mode kernel --name "Wdf*" --irql "<= DISPATCH_LEVEL"
bb-funcs --mode kernel --irql PASSIVE_LEVEL

Export as JSON or SQLite for your own tooling:

bb-types --arch arm64 --struct _CONTEXT --json
bb-consts --name "PROCESS_*" --json
bb-funcs --name "Nt*" --phnt --json

# or export to SQLite
bb-funcs --name "Create*" --sqlite funcs.db
bb-types --struct "_*" --sqlite types.db

JSON mode in bb-types performs full nested type expansion, producing all matched types alongside their deduplicated referenced_types — regardless of the --depth flag. SQLite exports mirror the same level of detail as JSON.

Typo? Both CLIs suggest close matches:

bb-types --struct _PBE
error: no structs matching '_PBE'

  did you mean?

    _ABC
    _PSP
    _PEB

The tools

Web viewer

Supported headers