From x64dbg-skills
Traces x64dbg execution into or over calls for N steps or until condition, logs full instruction trace, and analyzes it for debugging flows.
npx claudepluginhub dariushoule/x64dbg-skillsThis skill is limited to using the following tools:
Trace debuggee execution — stepping into or over calls — for a specified number of instructions or until a condition is met. The full instruction log is captured to a file and then analyzed.
Hunts vulnerabilities in x64dbg debuggees: analyzes imports/exports, triages I/O attack surfaces, tests bugs like overflows/wraps, generates PoCs.
Traces code reading or writing to a memory address via hardware watchpoints, breakpoint logs, and disassembly. For debugging memory access or reverse engineering x86 binaries.
Manages IDA Pro debugger operations: CRUD breakpoints with conditions, patch/revert bytes, maintain patch inventories for binary analysis.
Share bugs, ideas, or general feedback.
Trace debuggee execution — stepping into or over calls — for a specified number of instructions or until a condition is met. The full instruction log is captured to a file and then analyzed.
Follow these steps exactly:
Call mcp__x64dbg__get_debugger_status to confirm the debugger is connected and a debuggee is loaded and paused. If it is running, call mcp__x64dbg__pause. If no debuggee is loaded, tell the user and stop.
Ask the user for the following if not already provided:
1000)cip == 0x7FF6A0001000, rax != 0)If the user provides a symbol or address for the stop condition, resolve it with mcp__x64dbg__eval_expression and build the break_condition expression (e.g. cip == <resolved_addr>).
When the user only specifies a step count N and no explicit break condition, use break_condition 0 (never true — the trace runs until max_steps is hit).
Call mcp__x64dbg__get_all_registers and mcp__x64dbg__disassemble at the current instruction pointer to record the starting state. Note the starting address.
Prepare the output log path: ./traces/trace_<timestamp>.log (create the traces directory if it doesn't exist via Bash).
Call the appropriate trace tool (mcp__x64dbg__trace_into or mcp__x64dbg__trace_over) with:
| Parameter | Value |
|---|---|
break_condition | The user's condition, or 0 if only a step count was given |
max_steps | The user's step count, or 50000 if only a condition was given |
log_text | `{p:cip} {i:cip} |
log_file | The output log path from above |
wait_timeout | Scale with max_steps — use max(60, max_steps // 500) seconds |
Read the trace log file. The log contains one line per executed instruction in the format:
<address> <disassembly> | Label=<label> Comment=<comment>
Ignore when Labels or Comments say [Formatting Error], it just means there is no label or comment at that instruction.
Analyze the trace and present a summary to the user:
Use mcp__x64dbg__get_symbol to resolve notable addresses to symbol names where possible.
If the trace log is very large (>2000 lines), read it in chunks and summarize progressively.
After presenting the summary, ask the user if they would like any follow-up actions such as:
mcp__x64dbg__set_comment / mcp__x64dbg__set_label