dariushoule/x64dbg-skills

Decompile turns a function in a debugged binary into C-like pseudocode using angr. Use it to inspect code when you have an address, symbol, or the current instruction pointer.

Find OEP traces packed or protected PE executables to locate the original entry point and capture a debugger state snapshot. Use it when a binary needs unpacking, anti-debug evasion, or handoff for reconstruction and analysis.

Shellcode Analyzer loads a raw shellcode blob into x64dbg for unpacking, static review, and dynamic tracing. Use it when analyzing encoded or encrypted shellcode and identifying imports, anti-debugging, or payload behavior.

State Diff compares two debuggee snapshots and reports register and memory changes between them. Use it to see what executed, what memory was modified, and what the changes suggest.

State Snapshot captures all committed memory regions and the full processor state from a live debuggee for offline analysis. Use it when you need a disk snapshot of memory and registers from x64dbg.

Tracealyzer records x64dbg execution step-by-step into or over calls for a set count or stop condition, then analyzes the instruction log. Use it to inspect control flow, loops, and key instructions during debugging.

Vuln Hunter analyzes a paused program in x64dbg, maps imports and exports, and triages attack surface by input source. It then probes for memory, integer, and logic bugs and helps build proof-of-concept exploits.

YARA Signatures scans a state snapshot's memory dumps with YARA rules to find packers, crypto constants, anti-debug techniques, and malware-family markers. Use it when you need to classify code or inspect modules in a debuggee snapshot.