x64dbg-x32dbg-reverse-engineering

name x64dbg/x32dbg Reverse Engineering description This skill should be used when performing binary analysis, debugging, reverse engineering, unpacking, or vulnerability research with x64dbg or x32dbg via MCP. Provides expert knowledge on x64dbg/x32dbg MCP tools, Windows internals, assembly patterns, and reverse engineering methodology. version 1.0.11 x64dbg/x32dbg Reverse Engineering Skill Expert knowledge base for reverse engineering with x64dbg or x32dbg through MCP. When to Use Activate this skill when: Analyzing binary executables on Windows Debugging applications with x64dbg/x32dbg Unpacking protected binaries Hunting for vulnerabilities Reverse engineering algorithms or protocols Monitoring API calls and system behavior Patching binary code Available MCP Tools (79 total) Debug Control (10 tools) debug_get_state - Check debugger state (paused/running/stopped) debug_init - Start a new debug session by loading an executable (params: path? , arguments? , current_dir? ) debug_run - Continue execution debug_pause - Break execution debug_step_into - Single step into calls debug_step_over - Single step over calls debug_step_out - Execute until function returns debug_run_to - Run to specific address (param: address ) debug_restart - Restart the debug session debug_stop - Stop debugging Registers (4 tools) register_get - Read one register (param: name ) register_set - Write register (params: name , value ) register_list - List all registers (optional: general_only ) register_get_batch - Read multiple registers (param: names array) Memory (7 tools) memory_read - Read memory (params: address , size ; optional: encoding ) memory_write - Write memory (params: address , data ; optional: encoding ) memory_search - Search pattern (param: pattern ; optional: start , end , max_results ) memory_get_info - Region info (param: address ) memory_enumerate - List all regions memory_allocate - Allocate memory (param: size ) memory_free - Free memory (param: address ) Breakpoints (11 tools) breakpoint_set - Set breakpoint (param: address ; optional: type , enabled ) breakpoint_delete - Remove breakpoint (param: address ) breakpoint_enable / breakpoint_disable / breakpoint_toggle breakpoint_list - List all breakpoints breakpoint_get - Get details (param: address ) breakpoint_delete_all - Remove all breakpoint_set_condition - Set condition (params: address , condition ) breakpoint_set_log - Set log message (params: address , log_text ) breakpoint_reset_hitcount - Reset counter (param: address ) Disassembly (3 tools) disassembly_at - Disassemble at address (params: address , count ) disassembly_function - Disassemble entire function (param: address ) disassembly_range - Disassemble range (params: start , end ) Symbols (7 tools) symbol_resolve - Name to address (param: symbol ) symbol_from_address - Address to name (param: address ) symbol_search - Search symbols (param: pattern ) symbol_list - List symbols (optional: module ) symbol_set_label - Set label (params: address , label ) symbol_set_comment / symbol_get_comment Modules (5 tools) module_list - All loaded modules module_get - Module info (param: module ) module_get_main - Main executable module module_get_exports - List module exports (param: module ) module_get_imports - List module imports (param: module ) Threads (7 tools) thread_list - All threads thread_get_current - Current thread thread_switch - Switch thread (param: thread_id ) thread_get - Thread info (param: thread_id ) thread_suspend / thread_resume / thread_get_count Stack (4 tools) stack_get_trace - Call stack trace stack_read_frame - Read stack frame (params: address , size ) stack_get_pointers - RSP/RBP values on x64, ESP/EBP values on x86 stack_is_on_stack - Check address (param: address ) Dump (5 tools) dump_module - Dump module to file with PE rebuild and optional OEP override dump_memory_region - Dump raw memory region dump_analyze_module - PE analysis with entropy and packer detection dump_detect_oep - Detect Original Entry Point via pattern analysis dump_get_dumpable_regions - List dumpable regions Script (3 tools) script_execute - Run an x64dbg/x32dbg command (param: command ) script_execute_batch - Run batch commands (param: commands array) script_get_last_result - Get last result Context Snapshots (3 tools) context_get_snapshot - Full state capture context_get_basic - Quick register + state check context_compare_snapshots - Diff two snapshots Expression Evaluation (1 tool) eval_expression - Evaluate x64dbg/x32dbg expressions (param: expression ) — supports math, symbols, native registers, and architecture-neutral aliases such as cip / csp (for example, [csp+8] ) Cross-References (1 tool) xref_get - Get cross-references to an address (param: address ) Function Analysis (2 tools) function_list - List all recognized functions (optional: module filter) function_get - Get function boundaries at address (param: address ) Assembler (1 tool) assembler_assemble - Assemble instruction to bytes (params: instruction , address ; optional: write_to_memory ) Bookmarks (3 tools) bookmark_set - Set bookmark (param: address ) bookmark_delete - Delete bookmark (param: address ) bookmark_list - List all bookmarks Patch Management (2 tools) patch_list - List all applied byte-level patches patch_restore - Restore original bytes at address (param: address ) x64dbg/x32dbg Log Format Syntax When using breakpoint_set_log , format strings use these placeholders: {REG} - Register value in hex (e.g., {RAX} , {RCX} ) {REG:x} - Explicit hex format {[ADDR]} - Dereference pointer at address {[ADDR]:us} - Read as Unicode string {[ADDR]:as} - Read as ASCII string {[REG+OFFSET]} - Register + offset dereference x64 fastcall parameter logging "FuncName: p1={RCX} p2={RDX} p3={R8} p4={R9} ret={[RSP]:x}" x86 stdcall parameter logging "FuncName: p1={[ESP+4]:x} p2={[ESP+8]:x} p3={[ESP+C]:x}" Common Reverse Engineering Patterns Identifying Calling Conventions x64 fastcall (Windows): RCX, RDX, R8, R9, then stack. Return in RAX. x86 cdecl : All params on stack, caller cleans. Return in EAX. x86 stdcall (WinAPI): All params on stack, callee cleans. Return in EAX. x86 thiscall (C++): ECX = this pointer, rest on stack. Recognizing Crypto Constants Constant Algorithm 0x67452301, 0xEFCDAB89 MD5 / SHA-1 init 0x6A09E667, 0xBB67AE85 SHA-256 init 0x61707865 ("expa") ChaCha20 / Salsa20 0xEDB88320 CRC32 (reflected) 0x04C11DB7 CRC32 (normal) 0x9E3779B9 TEA / XTEA golden ratio Windows Debug Heap Fill Patterns Pattern Meaning 0xCCCCCCCC Uninitialized stack (MSVC debug) 0xCDCDCDCD Uninitialized heap (MSVC debug) 0xDDDDDDDD Freed heap memory 0xFEEEFEEE Freed heap (Windows debug heap) 0xFDFDFDFD Heap guard bytes (buffer boundaries) 0xBAADF00D LocalAlloc uninitialized 0xDEADBEEF Common debug marker Anti-Debug Detection Points kernel32.IsDebuggerPresent - Check PEB.BeingDebugged ntdll.NtQueryInformationProcess - ProcessDebugPort (0x7) kernel32.CheckRemoteDebuggerPresent PEB.NtGlobalFlag (0x70 = debugger attached) Timing checks: rdtsc , QueryPerformanceCounter , GetTickCount