x64dbg Reverse Engineering

分类: 工具与效率 | 上传者: SetsunaYukiOvO | 下载: 0 | 版本: v1.0（最新）
当通过 MCP 使用 x64dbg 调试器执行二进制分析、调试、逆向工程、解包或漏洞研究时，应使用此技能。提供有关 x64dbg MCP 工具、Windows 内部结构、组装模式和逆向工程方法的专业知识。
更新日志: Source: GitHub https://github.com/SetsunaYukiOvO/x64dbg-mcp
目录结构

当前层级: tree/main/skills/skills/x64dbg-reverse-engineering/
📁 references/
- 📄 tool-reference.md 6.5 KB
📄 SKILL.md 7.5 KB
SKILL.md

---
name: x64dbg Reverse Engineering
description: This skill should be used when performing binary analysis, debugging, reverse engineering, unpacking, or vulnerability research with x64dbg debugger via MCP. Provides expert knowledge on x64dbg MCP tools, Windows internals, assembly patterns, and reverse engineering methodology.
version: 1.0.0
---

# x64dbg Reverse Engineering Skill

Expert knowledge base for reverse engineering with x64dbg debugger through MCP protocol.

## When to Use

Activate this skill when:
- Analyzing binary executables on Windows
- Debugging applications with x64dbg/x32dbg
- Unpacking protected binaries
- Hunting for vulnerabilities
- Reverse engineering algorithms or protocols
- Monitoring API calls and system behavior
- Patching binary code

## Available MCP Tools (79 total)

### Debug Control (10 tools)
- `debug_get_state` - Check debugger state (paused/running/stopped)
- `debug_init` - Start a new debug session by loading an executable (params: `path?`, `arguments?`, `current_dir?`)
- `debug_run` - Continue execution
- `debug_pause` - Break execution
- `debug_step_into` - Single step into calls
- `debug_step_over` - Single step over calls
- `debug_step_out` - Execute until function returns
- `debug_run_to` - Run to specific address (param: `address`)
- `debug_restart` - Restart the debug session
- `debug_stop` - Stop debugging

### Registers (4 tools)
- `register_get` - Read one register (param: `name`)
- `register_set` - Write register (params: `name`, `value`)
- `register_list` - List all registers (optional: `general_only`)
- `register_get_batch` - Read multiple registers (param: `names` array)

### Memory (7 tools)
- `memory_read` - Read memory (params: `address`, `size`; optional: `encoding`)
- `memory_write` - Write memory (params: `address`, `data`; optional: `encoding`)
- `memory_search` - Search pattern (param: `pattern`; optional: `start`, `end`, `max_results`)
- `memory_get_info` - Region info (param: `address`)
- `memory_enumerate` - List all regions
- `memory_allocate` - Allocate memory (param: `size`)
- `memory_free` - Free memory (param: `address`)

### Breakpoints (11 tools)
- `breakpoint_set` - Set breakpoint (param: `address`; optional: `type`, `enabled`)
- `breakpoint_delete` - Remove breakpoint (param: `address`)
- `breakpoint_enable` / `breakpoint_disable` / `breakpoint_toggle`
- `breakpoint_list` - List all breakpoints
- `breakpoint_get` - Get details (param: `address`)
- `breakpoint_delete_all` - Remove all
- `breakpoint_set_condition` - Set condition (params: `address`, `condition`)
- `breakpoint_set_log` - Set log message (params: `address`, `log_text`)
- `breakpoint_reset_hitcount` - Reset counter (param: `address`)

### Disassembly (3 tools)
- `disassembly_at` - Disassemble at address (params: `address`, `count`)
- `disassembly_function` - Disassemble entire function (param: `address`)
- `disassembly_range` - Disassemble range (params: `start`, `end`)

### Symbols (7 tools)
- `symbol_resolve` - Name to address (param: `symbol`)
- `symbol_from_address` - Address to name (param: `address`)
- `symbol_search` - Search symbols (param: `pattern`)
- `symbol_list` - List symbols (optional: `module`)
- `symbol_set_label` - Set label (params: `address`, `label`)
- `symbol_set_comment` / `symbol_get_comment`

### Modules (5 tools)
- `module_list` - All loaded modules
- `module_get` - Module info (param: `module`)
- `module_get_main` - Main executable module
- `module_get_exports` - List module exports (param: `module`)
- `module_get_imports` - List module imports (param: `module`)

### Threads (7 tools)
- `thread_list` - All threads
- `thread_get_current` - Current thread
- `thread_switch` - Switch thread (param: `thread_id`)
- `thread_get` - Thread info (param: `thread_id`)
- `thread_suspend` / `thread_resume` / `thread_get_count`

### Stack (4 tools)
- `stack_get_trace` - Call stack trace
- `stack_read_frame` - Read stack frame (params: `address`, `size`)
- `stack_get_pointers` - RSP/RBP values
- `stack_is_on_stack` - Check address (param: `address`)

### Dump (5 tools)
- `dump_module` - Dump module to file with PE rebuild and optional OEP override
- `dump_memory_region` - Dump raw memory region
- `dump_analyze_module` - PE analysis with entropy and packer detection
- `dump_detect_oep` - Detect Original Entry Point via pattern analysis
- `dump_get_dumpable_regions` - List dumpable regions

### Script (3 tools)
- `script_execute` - Run x64dbg command (param: `command`)
- `script_execute_batch` - Run batch commands (param: `commands` array)
- `script_get_last_result` - Get last result

### Context Snapshots (3 tools)
- `context_get_snapshot` - Full state capture
- `context_get_basic` - Quick register + state check
- `context_compare_snapshots` - Diff two snapshots

### Expression Evaluation (1 tool)
- `eval_expression` - Evaluate x64dbg expression (param: `expression`) — supports math, symbols, registers, memory dereferences like `[rsp+8]`

### Cross-References (1 tool)
- `xref_get` - Get cross-references to an address (param: `address`)

### Function Analysis (2 tools)
- `function_list` - List all recognized functions (optional: `module` filter)
- `function_get` - Get function boundaries at address (param: `address`)

### Assembler (1 tool)
- `assembler_assemble` - Assemble instruction to bytes (params: `instruction`, `address`; optional: `write_to_memory`)

### Bookmarks (3 tools)
- `bookmark_set` - Set bookmark (param: `address`)
- `bookmark_delete` - Delete bookmark (param: `address`)
- `bookmark_list` - List all bookmarks

### Patch Management (2 tools)
- `patch_list` - List all applied byte-level patches
- `patch_restore` - Restore original bytes at address (param: `address`)

## x64dbg Log Format Syntax

When using `breakpoint_set_log`, format strings use these placeholders:
- `{REG}` - Register value in hex (e.g., `{RAX}`, `{RCX}`)
- `{REG:x}` - Explicit hex format
- `{[ADDR]}` - Dereference pointer at address
- `{[ADDR]:us}` - Read as Unicode string
- `{[ADDR]:as}` - Read as ASCII string
- `{[REG+OFFSET]}` - Register + offset dereference

### x64 fastcall parameter logging
```
"FuncName: p1={RCX} p2={RDX} p3={R8} p4={R9} ret={[RSP]:x}"
```

### x86 stdcall parameter logging
```
"FuncName: p1={[ESP+4]:x} p2={[ESP+8]:x} p3={[ESP+C]:x}"
```

## Common Reverse Engineering Patterns

### Identifying Calling Conventions
- **x64 fastcall** (Windows): RCX, RDX, R8, R9, then stack. Return in RAX.
- **x86 cdecl**: All params on stack, caller cleans. Return in EAX.
- **x86 stdcall** (WinAPI): All params on stack, callee cleans. Return in EAX.
- **x86 thiscall** (C++): ECX = this pointer, rest on stack.

### Recognizing Crypto Constants
| Constant | Algorithm |
|----------|-----------|
| 0x67452301, 0xEFCDAB89 | MD5 / SHA-1 init |
| 0x6A09E667, 0xBB67AE85 | SHA-256 init |
| 0x61707865 ("expa") | ChaCha20 / Salsa20 |
| 0xEDB88320 | CRC32 (reflected) |
| 0x04C11DB7 | CRC32 (normal) |
| 0x9E3779B9 | TEA / XTEA golden ratio |

### Windows Debug Heap Fill Patterns
| Pattern | Meaning |
|---------|---------|
| 0xCCCCCCCC | Uninitialized stack (MSVC debug) |
| 0xCDCDCDCD | Uninitialized heap (MSVC debug) |
| 0xDDDDDDDD | Freed heap memory |
| 0xFEEEFEEE | Freed heap (Windows debug heap) |
| 0xFDFDFDFD | Heap guard bytes (buffer boundaries) |
| 0xBAADF00D | LocalAlloc uninitialized |
| 0xDEADBEEF | Common debug marker |

### Anti-Debug Detection Points
- `kernel32.IsDebuggerPresent` - Check PEB.BeingDebugged
- `ntdll.NtQueryInformationProcess` - ProcessDebugPort (0x7)
- `kernel32.CheckRemoteDebuggerPresent`
- PEB.NtGlobalFlag (0x70 = debugger attached)
- Timing checks: `rdtsc`, `QueryPerformanceCounter`, `GetTickCount`
登录后下载/点赞/收藏 ❤ 146 | ★ 0
x64dbg Reverse Engineering

目录结构

SKILL.md

举报内容

提示
