x64dbg-reversing

# X64dbg Reversing Skill This skill enables AI-powered dynamic reverse engineering through the X64dbg MCP server. It provides comprehensive guidance for debugging, memory analysis, breakpoint management, and binary patching. ## Prerequisites - x64dbg or x32dbg installed (download from qq:212717393) - x64dbg MCP plugin installed (x64dbg_mcp.dp64/x32dbg_mcp.dp32) - Node.js >= 18 for the MCP server - MCP server running (x64dbg-mcp-server via npx) ## Architecture ``` MCP Client (Claude) --> TypeScript MCP Server --> C++ Plugin (in x64dbg) --> x64dbg Engine (stdio) (localhost:27042) (REST API) ``` ## Available Tools ### 1. Debugger Control **x64dbg_debug** - Control execution flow | Action | Description | |--------|-------------| | `run` | Resume execution | | `pause` | Pause debugger | | `force_pause` | Force pause immediately | | `step_into` | Step into function calls | | `step_over` | Step over function calls | | `step_out` | Step out of current function | | `stop_debug` | Stop debugging session | | `restart_debug` | Restart debuggee | | `run_to_address` | Run until specified address | | `state` | Get current debugger state | ### 2. Register Operations **x64dbg_registers** - Read/write CPU registers | Action | Description | |--------|-------------| | `get_all` | Get all general purpose registers | | `get_specific` | Get specific register(s) | | `get_flags` | Get CPU flags (ZF, CF, OF, etc.) | | `get_avx512` | Get AVX-512 registers | | `set` | Set register value | ### 3. Memory Operations **x64dbg_memory** - Memory read/write/manage | Action | Description | |--------|-------------| | `read` | Read memory at address | | `write` | Write data to memory | | `info` | Get memory region info | | `is_valid` | Check if address is valid | | `is_code` | Check if address is code | | `allocate` | Allocate new memory | | `free` | Free allocated memory | | `protect` | Change memory protection | | `map` | Map file into memory | ### 4. Stack Analysis **x64dbg_stack** - Call stack and stack memory | Action | Description | |--------|-------------| | `get_call_stack` | Unwind and display call stack | | `read` | Read raw stack memory | | `pointers` | Get stack pointers | | `seh_chain` | Get SEH (Structured Exception Handler) chain | | `return_address` | Get return address at offset | | `comment` | Get comment at stack address | ### 5. Disassembly **x64dbg_disassembly** - Disassemble code | Action | Description | |--------|-------------| | `at_address` | Disassemble at specific address | | `function` | Disassemble entire function | | `info` | Get instruction info (operands, etc.) | | `assemble` | Assemble instructions to bytes | ### 6. Breakpoints **x64dbg_breakpoints** - Full breakpoint management | Action | Description | |--------|-------------| | `set_software` | Set software breakpoint (int3) | | `set_hardware` | Set hardware breakpoint | | `set_memory` | Set memory breakpoint | | `delete` | Delete breakpoint | | `enable` | Enable breakpoint | | `disable` | Disable breakpoint | | `toggle` | Toggle breakpoint state | | `set_condition` | Set breakpoint condition | | `set_log` | Set breakpoint log message | | `reset_hit_count` | Reset breakpoint hit counter | | `get` | Get breakpoint info | | `list` | List all breakpoints | | `configure` | Configure breakpoint options | | `configure_batch` | Configure multiple breakpoints | ### 7. Tracing **x64dbg_tracing** - Execution tracing | Action | Description | |--------|-------------| | `into` | Trace into instructions | | `over` | Trace over instructions | | `run` | Run with tracing enabled | | `stop` | Stop tracing | | `animate` | Animate execution with tracing | | `conditional_run` | Run with conditions | | `log_setup` | Configure trace logging | | `hitcount` | Set hit count conditions | | `type` | Set trace type | ### 8. Symbols & Labels **x64dbg_symbols** - Symbol and label management | Action | Description | |--------|-------------| | `resolve` | Resolve symbol at address | | `address` | Get address of symbol name | | `search` | Search for symbols | | `list_module` | List symbols in module | | `get_label` | Get label at address | | `set_label` | Set label at address | | `get_comment` | Get comment at address | | `set_comment` | Set comment at address | | `bookmark` | Manage bookmarks | ### 9. Search Operations **x64dbg_search** - Search for patterns | Action | Description | |--------|-------------| | `pattern` | Search byte pattern (AOB) | | `string` | Search for strings | | `string_at` | Find string at address | | `symbol_auto_complete` | Auto-complete symbols | | `encode_type` | Encode data types | ### 10. Modules **x64dbg_modules** - Module information | Action | Description | |--------|-------------| | `list` | List loaded modules | | `get_info` | Get module information | | `get_base` | Get module base address | | `get_section` | Get section info | | `get_party` | Get module classification (user/system) | ### 11. Threads **x64dbg_threads** - Thread management | Action | Description | |--------|-------------| | `list` | List all threads | | `current` | Get current thread | | `count` | Get thread count | | `info` | Get thread detailed info | | `teb` | Get Thread Environment Block address | | `name` | Get/set thread name | | `switch` | Switch to thread | | `suspend` | Suspend thread | | `resume` | Resume thread | ### 12. Process Information **x64dbg_process** - Process details | Action | Description | |--------|-------------| | `basic` | Basic process info | | `detailed` | Detailed process info | | `cmdline` | Get command line | | `elevated` | Check elevation status | | `dbversion` | Get debugger version | | `set_cmdline` | Set command line | ### 13. Anti-Debug **x64dbg_antidebug** - Anti-debug detection/bypass | Action | Description | |--------|-------------| | `peb` | Get PEB fields | | `teb` | Get TEB fields | | `dep` | Check DEP status | | `hide_debugger` | Hide debugger from detection | ### 14. Exceptions **x64dbg_exceptions** - Exception handling | Action | Description | |--------|-------------| | `set` | Set exception breakpoint | | `delete` | Delete exception breakpoint | | `list` | List exception breakpoints | | `list_codes` | List known exception codes | | `skip` | Skip exception | ### 15. Analysis **x64dbg_analysis** - Code analysis | Action | Description | |--------|-------------| | `function` | Analyze function | | `xrefs_to` | Get cross-references to address | | `xrefs_from` | Get cross-references from address | | `basic_blocks` | Get basic blocks | | `source` | Get source information | | `mnemonic_brief` | Get instruction reference | **x64dbg_control_flow** - Control flow analysis | Action | Description | |--------|-------------| | `cfg` | Get control flow graph | | `branch_dest` | Get branch destination | | `is_jump_taken` | Check if jump was taken | | `loops` | Detect loops in function | | `func_type` | Determine function type | | `add_function` | Add function definition | | `delete_function` | Delete function definition | ### 16. Patching **x64dbg_patches** - Code patching | Action | Description | |--------|-------------| | `list` | List applied patches | | `apply` | Apply patch | | `restore` | Restore original bytes | | `export` | Export patches | ### 17. Dumping **x64dbg_dumping** - PE dumping | Action | Description | |--------|-------------| | `pe_header` | Dump PE header | | `sections` | Dump sections | | `imports` | Dump import table | | `exports` | Dump export table | | `entry_point` | Dump entry point | | `relocations` | Dump relocations | | `dump_module` | Dump entire module | | `fix_iat` | Fix import address table | | `export_patch_file` | Export as patch file | ### 18. Handles **x64dbg_handles** - Handle inspection | Action | Description | |--------|-------------| | `list_handles` | List open handles | | `list_tcp` | List TCP connections | | `list_windows` | List windows | | `list_heaps` | List heaps | | `get_name` | Get handle name | | `close` | Close handle | ### 19. Command Execution **x64dbg_command** - Execute x64dbg commands | Action | Description | |--------|-------------| | `execute` | Execute single command | | `script` | Execute script | | `evaluate` | Evaluate expression | | `format` | Format value | | `set_init_script` | Set initialization script | | `get_init_script` | Get initialization script | | `get_hash` | Get debugger hash | | `get_events` | Get debug events | ## Workflow ### 1. Session Start ``` Always begin with: 1. x64dbg_debug state - Verify debugger is ready 2. x64dbg_process basic - Understand the target 3. x64dbg_modules list - See loaded modules ``` ### 2. Setting Breakpoints ``` Common breakpoint patterns: Function entry: x64dbg_breakpoints set_software address="0x401000" API call: x64dbg_breakpoints set_software address="kernel32.CreateFileW" (use actual VA) Memory breakpoint on variable: x64dbg_breakpoints set_memory address="0x404000" size=4 Conditional breakpoint: x64dbg_breakpoints set_condition bp_id=1 condition="EAX != 0" ``` ### 3. Execution Control ``` Stepping patterns: Step into (enter function): x64dbg_debug step_into