From x64dbg-skills
Compares debuggee state snapshots to diff registers and memory, analyzes changes (e.g., stack growth, flag updates), and narrates program behavior between snapshots.
npx claudepluginhub dariushoule/x64dbg-skillsThis skill is limited to using the following tools:
Compare two debuggee state snapshots and produce a detailed change analysis — which registers changed, which memory regions were modified, and what the changes mean.
Compares function disassembly between binary sessions: generates byte signatures to relocate functions after updates, disassembles, and reports changes. Useful for tracking patches.
Runs or continues differential debugging sessions between implementations, traces, captures, or outputs. Records artifact identities, commands, mismatches, findings, validation, and next probes in durable session logs.
Captures full x64dbg debuggee state snapshot—all committed memory regions as binaries + processor state as JSON—to disk for offline analysis.
Share bugs, ideas, or general feedback.
Compare two debuggee state snapshots and produce a detailed change analysis — which registers changed, which memory regions were modified, and what the changes mean.
Follow these steps exactly:
List the available snapshots:
dir "${CLAUDE_PLUGIN_ROOT}\snapshots"
If there are fewer than two snapshots, tell the user they need at least two snapshots (captured via /state-snapshot) and stop.
If the user specified two snapshot paths, use those directly. Otherwise, present the available snapshots and ask the user to pick the before (earlier) and after (later) snapshots.
Execute the diff engine:
python "${CLAUDE_PLUGIN_ROOT}\skills\state-diff\state_diff.py" --before <before_snapshot_dir> --after <after_snapshot_dir>
The script writes diff_report.json into the after-snapshot directory by default. If the user specified a custom output path, pass --output <path>.
Use Read to load the generated diff_report.json.
Interpret the diff report for the user:
Register changes: Explain what each changed register suggests. For example:
Memory changes: Explain what modified regions likely represent:
Synthesize a narrative: Combine register and memory observations into a coherent explanation of what the program did between the two snapshots. For example: "The program called function X, which allocated Y bytes on the stack and wrote a string to a heap buffer."
Present the analysis in a clear, structured format with the raw evidence (hex values, addresses) supporting each conclusion.