メニュー
Compare two state snapshots to identify register and memory changes between two points in time
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/dariushoule/x64dbg-skills --skill state-diffコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Scan a state snapshot's memory dumps with YARA signatures to detect packers, crypto constants, malware, and more
Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis
Smart trace-based OEP finder for packed/protected PE executables. Traces through packer stubs using intelligent stepping, anti-debug evasion, and heuristic OEP detection, then captures a state snapshot at the original entry point.
SOC 職業分類に基づく
| name | state-diff |
| description | Compare two state snapshots to identify register and memory changes between two points in time |
| allowed-tools | Bash, Read |
Compare two debuggee state snapshots and produce a detailed change analysis — which registers changed, which memory regions were modified, and what the changes mean.
Follow these steps exactly:
List the available snapshots:
dir "${CLAUDE_PLUGIN_ROOT}\snapshots"
If there are fewer than two snapshots, tell the user they need at least two snapshots (captured via /state-snapshot) and stop.
If the user specified two snapshot paths, use those directly. Otherwise, present the available snapshots and ask the user to pick the before (earlier) and after (later) snapshots.
Execute the diff engine:
python "${CLAUDE_PLUGIN_ROOT}\skills\state-diff\state_diff.py" --before <before_snapshot_dir> --after <after_snapshot_dir>
The script writes diff_report.json into the after-snapshot directory by default. If the user specified a custom output path, pass --output <path>.
Use Read to load the generated diff_report.json.
Interpret the diff report for the user:
Register changes: Explain what each changed register suggests. For example:
Memory changes: Explain what modified regions likely represent:
Synthesize a narrative: Combine register and memory observations into a coherent explanation of what the program did between the two snapshots. For example: "The program called function X, which allocated Y bytes on the stack and wrote a string to a heap buffer."
Present the analysis in a clear, structured format with the raw evidence (hex values, addresses) supporting each conclusion.