القائمة
Trace execution (into or over calls) for N steps or until a condition, then analyze the recorded instruction log
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | tracealyzer |
| description | Trace execution (into or over calls) for N steps or until a condition, then analyze the recorded instruction log |
| allowed-tools | mcp__x64dbg__get_debugger_status, mcp__x64dbg__pause, mcp__x64dbg__trace_into, mcp__x64dbg__trace_over, mcp__x64dbg__eval_expression, mcp__x64dbg__get_symbol, mcp__x64dbg__disassemble, mcp__x64dbg__get_all_registers, mcp__x64dbg__set_comment, mcp__x64dbg__set_label, Read, Bash |
Trace debuggee execution — stepping into or over calls — for a specified number of instructions or until a condition is met. The full instruction log is captured to a file and then analyzed.
Follow these steps exactly:
Call mcp__x64dbg__get_debugger_status to confirm the debugger is connected and a debuggee is loaded and paused. If it is running, call mcp__x64dbg__pause. If no debuggee is loaded, tell the user and stop.
Ask the user for the following if not already provided:
1000)cip == 0x7FF6A0001000, rax != 0)If the user provides a symbol or address for the stop condition, resolve it with mcp__x64dbg__eval_expression and build the break_condition expression (e.g. cip == <resolved_addr>).
When the user only specifies a step count N and no explicit break condition, use break_condition 0 (never true — the trace runs until max_steps is hit).
Call mcp__x64dbg__get_all_registers and mcp__x64dbg__disassemble at the current instruction pointer to record the starting state. Note the starting address.
Prepare the output log path: ./traces/trace_<timestamp>.log (create the traces directory if it doesn't exist via Bash).
Call the appropriate trace tool (mcp__x64dbg__trace_into or mcp__x64dbg__trace_over) with:
| Parameter | Value |
|---|---|
break_condition | The user's condition, or 0 if only a step count was given |
max_steps | The user's step count, or 50000 if only a condition was given |
log_text | `{p:cip} {i:cip} |
log_file | The output log path from above |
wait_timeout | Scale with max_steps — use max(60, max_steps // 500) seconds |
Read the trace log file. The log contains one line per executed instruction in the format:
<address> <disassembly> | Label=<label> Comment=<comment>
Ignore when Labels or Comments say [Formatting Error], it just means there is no label or comment at that instruction.
Analyze the trace and present a summary to the user:
Use mcp__x64dbg__get_symbol to resolve notable addresses to symbol names where possible.
If the trace log is very large (>2000 lines), read it in chunks and summarize progressively.
After presenting the summary, ask the user if they would like any follow-up actions such as:
mcp__x64dbg__set_comment / mcp__x64dbg__set_labelScan a state snapshot's memory dumps with YARA signatures to detect packers, crypto constants, malware, and more
Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis
Smart trace-based OEP finder for packed/protected PE executables. Traces through packer stubs using intelligent stepping, anti-debug evasion, and heuristic OEP detection, then captures a state snapshot at the original entry point.
Hunt for vulnerabilities in a running debuggee by analyzing imports/exports, triaging attack surface, and iteratively testing for bugs with PoC generation.
Load, unpack, and analyze shellcode in x64dbg. Use this skill when the user wants to analyze shellcode, load a shellcode blob into a debugger, unpack encoded/encrypted shellcode, or perform static/dynamic analysis of shellcode payloads.
Decompile a function to C-like pseudocode using angr