dariushoule/x64dbg-skills

# decompile

Decompile a function from the debugged binary into C-like pseudocode using angr.

If no address is specified, decompiles the function containing the current instruction pointer. Accepts an address or symbol name as an argument.

## Instructions

Follow these steps exactly:

### 1. Check prerequisites

Run `pip show angr` via Bash. If angr is not installed, tell the user:

# find-oep

Smart trace-based OEP finder for packed/protected PE executables. Walks through unpacking stages using intelligent stepping, anti-debug evasion, and heuristic OEP detection. Once the OEP is found, captures a state snapshot for downstream use (PE reconstruction, analysis, etc.).

## Instructions

### 1. Gather input and assess target

Ask the user (via `AskUserQuestion`) for any information not already provided:

- **Target path** — absolute path to the packed PE on disk
- **x64dbg path** — absolute path to x64dbg/x32dbg (if not already known)
- **Bitness** — 64-bit or 32-bit (default: 64)

# shellcode-analyzer

Load a raw shellcode blob into x64dbg using a sacrificial process, then optionally unpack, statically analyze, and dynamically analyze it.

## Instructions

### 1. Gather input

Ask the user (via `AskUserQuestion`) for:

- **Shellcode path** — absolute path to the raw shellcode file on disk
- **x64dbg path** — absolute path to the x64dbg/x32dbg binary (if not in memory)
- **Bitness** — 64-bit or 32-bit (default: 64, but one is not recommended over the other; it depends on the shellcode being analyzed)

# state-diff

Compare two debuggee state snapshots and produce a detailed change analysis — which registers changed, which memory regions were modified, and what the changes mean.

## Instructions

Follow these steps exactly:

### 1. Identify snapshots

List the available snapshots:

```
dir "${CLAUDE_PLUGIN_ROOT}\snapshots"

# state-snapshot

Capture a full debuggee state snapshot — all committed memory regions as raw binary files plus the complete processor state as JSON.

## Instructions

Follow these steps exactly:

### 1. Verify debugger connection

Call `mcp__x64dbg__get_debugger_status` to confirm the debugger is connected and a debuggee is loaded. Note the **session PID** and **x64dbg path** from the current MCP connection — you will need these to reconnect later.

If no debuggee is loaded, tell the user and stop.

# tracealyzer

Trace debuggee execution — stepping into or over calls — for a specified number of instructions or until a condition is met. The full instruction log is captured to a file and then analyzed.

## Instructions

Follow these steps exactly:

### 1. Verify debugger connection

Call `mcp__x64dbg__get_debugger_status` to confirm the debugger is connected and a debuggee is loaded and **paused**. If it is running, call `mcp__x64dbg__pause`. If no debuggee is loaded, tell the user and stop.

### 2. Gather trace parameters

# vuln-hunter

Hunt for vulnerabilities in a running debuggee. Performs import/export reconnaissance, triages attack surface by I/O context, then iteratively tests for bugs (buffer overflows, integer wraps, logic flaws, etc.) and builds proof-of-concept exploits.

## Prerequisites

- The target program must be loaded in x64dbg and paused (at entrypoint or a function of interest)
- Be conservative with the context window — disassemble on demand, read memory on demand, do not dump large regions speculatively

## Instructions

### 1. Connect and verify state

Confirm the debugger is connected and the debuggee is paused:

# yara-sigs

Scan debuggee memory (via a state snapshot) against a large YARA signature database to identify packers, crypto constants, anti-debug tricks, malware families, and more.

## Instructions

Follow these steps exactly:

### 1. Check prerequisites

Run `pip show yara-python` via Bash. If not installed, tell the user to run `pip install yara-python` and stop.
Run `git --version` via Bash. If not installed, tell the user to install Git and stop.

### 2. Ensure the YARA signature database is available