From x64dbg-skills
Scans debuggee memory snapshots with YARA signatures to detect packers, crypto constants, anti-debug tricks, malware families, and more. For reverse engineering workflows.
npx claudepluginhub dariushoule/x64dbg-skillsThis skill is limited to using the following tools:
Scan debuggee memory (via a state snapshot) against a large YARA signature database to identify packers, crypto constants, anti-debug tricks, malware families, and more.
Uses YARA rules to hunt malware, suspicious files, and IOCs across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and threat intel feeds.
Scans filesystems and memory dumps for malware and IOCs using YARA rules. Includes rule authoring, yara-python scanning, and threat intel integration.
Guides acquiring and analyzing memory dumps with Volatility 3, WinPmem, LiME on Windows/Linux/macOS/VMs for incident response and malware analysis.
Share bugs, ideas, or general feedback.
Scan debuggee memory (via a state snapshot) against a large YARA signature database to identify packers, crypto constants, anti-debug tricks, malware families, and more.
Follow these steps exactly:
Run pip show yara-python via Bash. If not installed, tell the user to run pip install yara-python and stop.
Run git --version via Bash. If not installed, tell the user to install Git and stop.
Check if the directory ${CLAUDE_PLUGIN_ROOT}\yarasigs exists (use dir). If it does not exist, clone it:
git clone --recurse-submodules https://github.com/x64dbg/yarasigs "${CLAUDE_PLUGIN_ROOT}\yarasigs"
If the directory exists but looks incomplete (missing Yara-Rules or citizenlab subdirectories), update submodules:
git -C "${CLAUDE_PLUGIN_ROOT}\yarasigs" submodule update --init --recursive
The YARA database contains many rule categories. If the user specified what they want to scan for in their invocation, use that. Otherwise, ask the user what they want to scan for using AskUserQuestion with these options:
Map the selection to rule category paths:
| Selection | Rule paths (relative to yarasigs/) |
|---|---|
| Packers & compilers | packer.yara, packer_compiler_signatures.yara, Yara-Rules/packers/ |
| Crypto constants | crypto_signatures.yara, Yara-Rules/crypto/ |
| Anti-debug / anti-VM | Yara-Rules/antidebug_antivm/ |
| All signatures | All .yar and .yara files recursively |
Check if a recent snapshot exists in ${CLAUDE_PLUGIN_ROOT}\snapshots (use dir).
To take a fresh snapshot, invoke the state-snapshot skill via Skill("state-snapshot"). After it completes, note the snapshot directory path.
Execute the scan script:
python "${CLAUDE_PLUGIN_ROOT}\skills\yara-sigs\yara_scan.py" --snapshot-dir <snapshot_path> --yarasigs-dir "${CLAUDE_PLUGIN_ROOT}\yarasigs" --categories <category> [--module-filter <module_name>]
Where <category> is one of: packers, crypto, antidebug, or all.
Module filtering: If the user asks to focus on a specific module (e.g. the main executable), pass --module-filter <name> where <name> is a substring of the module name as shown in the memory map (e.g. secret_encryptor). This merges all of the module's sections into a single buffer before scanning, which is critical for YARA rules whose patterns span multiple PE sections (e.g. MD5 init constants in .text + T-table in .rdata). Always prefer using --module-filter when scanning a specific module rather than relying on per-region scanning.
The script writes results to <snapshot_path>/yara_results.json and prints a summary to stdout.
Read <snapshot_path>/yara_results.json if it exists and the stdout summary is not sufficient.
Present findings organized by:
memory_map.json)If no matches were found, tell the user and suggest trying a broader category (e.g., "all").