X64dbg Reverse Engineering

x64dbg Reverse Engineering Skill

Expert knowledge base for reverse engineering with x64dbg debugger through MCP protocol.

When to Use

Activate this skill when:

• Analyzing binary executables on Windows
• Debugging applications with x64dbg/x32dbg
• Unpacking protected binaries
• Hunting for vulnerabilities
• Reverse engineering algorithms or protocols
• Monitoring API calls and system behavior
• Patching binary code

Available MCP Tools (79 total)

Debug Control (10 tools)

• debug_get_state - Check debugger state (paused/running/stopped)
• debug_init - Start a new debug session by loading an executable (params: path?, arguments?, current_dir?)
• debug_run - Continue execution
• debug_pause - Break execution
• debug_step_into - Single step into calls
• debug_step_over - Single step over calls
• debug_step_out - Execute until function returns
• debug_run_to - Run to specific address (param: address)
• debug_restart - Restart the debug session
• debug_stop - Stop debugging

Registers (4 tools)

• register_get - Read one register (param: name)
• register_set - Write register (params: name, value)
• register_list - List all registers (optional: general_only)
• register_get_batch - Read multiple registers (param: names array)

Memory (7 tools)

• memory_read - Read memory (params: address, size; optional: encoding)
• memory_write - Write memory (params: address, data; optional: encoding)
• memory_search - Search pattern (param: pattern; optional: start, end, max_results)
• memory_get_info - Region info (param: address)
• memory_enumerate - List all regions
• memory_allocate - Allocate memory (param: size)
• memory_free - Free memory (param: address)

Breakpoints (11 tools)

• breakpoint_set - Set breakpoint (param: address; optional: type, enabled)
• breakpoint_delete - Remove breakpoint (param: address)
• breakpoint_enable / breakpoint_disable / breakpoint_toggle
• breakpoint_list - List all breakpoints
• breakpoint_get - Get details (param: address)
• breakpoint_delete_all - Remove all
• breakpoint_set_condition - Set condition (params: address, condition)
• breakpoint_set_log - Set log message (params: address, log_text)
• breakpoint_reset_hitcount - Reset counter (param: address)

Disassembly (3 tools)

• disassembly_at - Disassemble at address (params: address, count)
• disassembly_function - Disassemble entire function (param: address)
• disassembly_range - Disassemble range (params: start, end)

Symbols (7 tools)

• symbol_resolve - Name to address (param: symbol)
• symbol_from_address - Address to name (param: address)
• symbol_search - Search symbols (param: pattern)
• symbol_list - List symbols (optional: module)
• symbol_set_label - Set label (params: address, label)
• symbol_set_comment / symbol_get_comment

Modules (5 tools)

• module_list - All loaded modules
• module_get - Module info (param: module)
• module_get_main - Main executable module
• module_get_exports - List module exports (param: module)
• module_get_imports - List module imports (param: module)

Threads (7 tools)

• thread_list - All threads
• thread_get_current - Current thread
• thread_switch - Switch thread (param: thread_id)
• thread_get - Thread info (param: thread_id)
• thread_suspend / thread_resume / thread_get_count

Stack (4 tools)

• stack_get_trace - Call stack trace
• stack_read_frame - Read stack frame (params: address, size)
• stack_get_pointers - RSP/RBP values
• stack_is_on_stack - Check address (param: address)

Dump (5 tools)

• dump_module - Dump module to file with PE rebuild and optional OEP override
• dump_memory_region - Dump raw memory region
• dump_analyze_module - PE analysis with entropy and packer detection
• dump_detect_oep - Detect Original Entry Point via pattern analysis
• dump_get_dumpable_regions - List dumpable regions

Script (3 tools)

• script_execute - Run x64dbg command (param: command)
• script_execute_batch - Run batch commands (param: commands array)
• script_get_last_result - Get last result

Context Snapshots (3 tools)

• context_get_snapshot - Full state capture
• context_get_basic - Quick register + state check
• context_compare_snapshots - Diff two snapshots

Expression Evaluation (1 tool)

• eval_expression - Evaluate x64dbg expression (param: expression) — supports math, symbols, registers, memory dereferences like [rsp+8]

Cross-References (1 tool)

• xref_get - Get cross-references to an address (param: address)

Function Analysis (2 tools)

• function_list - List all recognized functions (optional: module filter)
• function_get - Get function boundaries at address (param: address)

Assembler (1 tool)

• assembler_assemble - Assemble instruction to bytes (params: instruction, address; optional: write_to_memory)

Bookmarks (3 tools)

• bookmark_set - Set bookmark (param: address)
• bookmark_delete - Delete bookmark (param: address)
• bookmark_list - List all bookmarks

Patch Management (2 tools)

• patch_list - List all applied byte-level patches
• patch_restore - Restore original bytes at address (param: address)

x64dbg Log Format Syntax

When using breakpoint_set_log, format strings use these placeholders:

• {REG} - Register value in hex (e.g., {RAX}, {RCX})
• {REG:x} - Explicit hex format
• {[ADDR]} - Dereference pointer at address
• {[ADDR]:us} - Read as Unicode string
• {[ADDR]:as} - Read as ASCII string
• {[REG+OFFSET]} - Register + offset dereference

x64 fastcall parameter logging

"FuncName: p1={RCX} p2={RDX} p3={R8} p4={R9} ret={[RSP]:x}"

x86 stdcall parameter logging

"FuncName: p1={[ESP+4]:x} p2={[ESP+8]:x} p3={[ESP+C]:x}"

Common Reverse Engineering Patterns

Identifying Calling Conventions

• x64 fastcall (Windows): RCX, RDX, R8, R9, then stack. Return in RAX.
• x86 cdecl: All params on stack, caller cleans. Return in EAX.
• x86 stdcall (WinAPI): All params on stack, callee cleans. Return in EAX.
• x86 thiscall (C++): ECX = this pointer, rest on stack.

Recognizing Crypto Constants

Windows Debug Heap Fill Patterns

Anti-Debug Detection Points

• kernel32.IsDebuggerPresent - Check PEB.BeingDebugged
• ntdll.NtQueryInformationProcess - ProcessDebugPort (0x7)
• kernel32.CheckRemoteDebuggerPresent
• PEB.NtGlobalFlag (0x70 = debugger attached)
• Timing checks: rdtsc, QueryPerformanceCounter, GetTickCount

Source: SetsunaYukiOvO/x64dbg-mcp — distributed by TomeVault.