Shellcode Analyzer

by dariushoule

Shellcode Analyzer is a Quality skill for Claude Code, published by dariushoule in x64dbg-skills.

203 stars16 forkson dariushoule/x64dbg-skillsAdded 2026/09/05Repository updated 2026/03/13

View source on GitHub Download repo ZIP

claude-codemcpskillsx64dbg

Install in seconds

Install Shellcode Analyzer

Copy Shellcode Analyzer into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/dariushoule/x64dbg-skills/tree/main/skills/shellcode-analyzer ~/.claude/skills/shellcode-analyzer

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/dariushoule/x64dbg-skills.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/shellcode-analyzer/SKILL.md in dariushoule/x64dbg-skills
Installs to: ~/.claude/skills/shellcode-analyzer
Collection: One of 8 skills cataloged from this repository
Category: Quality — 1662 skills

What Shellcode Analyzer does

Shellcode Analyzer loads a raw shellcode blob into x64dbg for unpacking, static review, and dynamic tracing. Use it when analyzing encoded or encrypted shellcode and identifying imports, anti-debugging, or payload behavior.

Shellcode Analyzer is cataloged under Quality on DirSkills. Shellcode Analyzer comes from a repository tagged claude-code, mcp, skills and x64dbg.

Documentation

README

Excerpt

shellcode-analyzer

Load a raw shellcode blob into x64dbg using a sacrificial process, then optionally unpack, statically analyze, and dynamically analyze it.

Instructions

1. Gather input

Ask the user (via AskUserQuestion) for:

Shellcode path — absolute path to the raw shellcode file on disk
x64dbg path — absolute path to the x64dbg/x32dbg binary (if not in memory)
Bitness — 64-bit or 32-bit (default: 64, but one is not recommended over the other; it depends on the shellcode being analyzed)

Determine the CIP register name: rip for 64-bit, eip for 32-bit. Determine the debugger variant: x64dbg.exe for 64-bit, x32dbg.exe for 32-bit.

2. Read the shellcode

Read the raw shellcode file as hex via Bash:

This is the opening of the README. Read the full README on GitHub.

Commands Shellcode Analyzer provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

/yara-sigs
/tracealyzer

Frequently asked about Shellcode Analyzer

What else does dariushoule publish alongside Shellcode Analyzer?
Shellcode Analyzer is one of 8 skills that DirSkills catalogs from dariushoule/x64dbg-skills, the repository it ships in. Its siblings there include Decompile, Find OEP and State Diff. Each one is a separate skill with its own page in this directory, installs the same way Shellcode Analyzer does, and is maintained by dariushoule in that same repository. The rest of the collection is listed on the dariushoule/x64dbg-skills page.
How does Shellcode Analyzer compare to other Quality skills?
Shellcode Analyzer ranks #1504 by stars among the 1662 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Shellcode Analyzer against them. Open each page to compare what they document and how they install.