x64dbg-mcp-server, the community x64dbg MCP plugin by duty1g

• Opens a program in the debugger to start a new session

  Opens a program in the debugger and pauses it at the system breakpoint. Any session already running is ended first.

  Try: “Load C:\samples\app.exe in the debugger”

  Runs code · LoadBinary

• Attaches the debugger to a program that is already running

  Attaches the debugger to a running process by its process ID.

  Try: “Attach to process 4312”

  Runs code · AttachProcess

• Says whether a program is loaded, running or paused, and where

  Shows whether a program is loaded, whether it is running or paused, its process ID, the current instruction and module.

  Try: “What is the debugger doing right now?”

  Read · GetDebugState

• Stops the program at an address or a function such as CreateFileW

  Sets a normal breakpoint at an address or a Windows API function name, so the program pauses there.

  Try: “Break on CreateFileW”

  Write · SetBreakpoint

• Resumes the program and waits until it pauses again

  Resumes the program and waits until it hits a breakpoint, an exception or exits, up to a timeout.

  Try: “Run until the next breakpoint”

  Runs code · run

• Runs one instruction, stepping over calls

  Runs a single instruction and steps over any function call it meets, like F8.

  Try: “Step over the next instruction”

  Runs code · StepOver

• Runs one instruction, going into calls

  Runs a single instruction and goes into any function call it meets, like F7.

  Try: “Step into this call”

  Runs code · StepInto

• Runs until the current function returns

  Keeps running until the current function returns to its caller, like Ctrl+F9.

  Try: “Run until this function returns”

  Runs code · StepOut

• Runs the program until it reaches a given address

  Sets a one-time breakpoint at an address, resumes and waits for the program to reach it.

  Try: “Run to 0x401000”

  Runs code · RunToAddress

• Pauses the running program

  Pauses the program while it is running, like F12.

  Try: “Pause the program”

  Write · PauseDebug

• Ends the debugging session and closes the program

  Stops debugging and terminates the program being debugged.

  Try: “Stop debugging and close it”

  Delete · StopDebug

• Restarts the program from the beginning

  Restarts the current debugging session from the start.

  Try: “Restart the program”

  Runs code · RestartDebug

• Shows the assembly instructions at an address

  Shows assembly instructions starting at an address, ten from the current position by default.

  Try: “Disassemble 20 instructions at the current address”

  Read · Disassemble

• Shows the full assembly of one function

  Shows every instruction of a function, using the boundaries from code analysis.

  Try: “Show me the whole function at 0x401230”

  Read · DisassembleFunction

• Shows where the program is paused, with its module and label

  Shows the current instruction pointer, the module it belongs to and any label or comment there.

  Try: “Where are we paused?”

  Read · GetCurrentAddress

• Shows the values of all CPU registers

  Lists the current values of all general-purpose CPU registers.

  Try: “Show me the registers”

  Read · GetAllRegisters

• Reads memory at an address as a hex and text dump

  Reads bytes from the program's memory at an address and shows them as hex with text alongside.

  Try: “Read 64 bytes at RSP”

  Read · ReadMemory

• Shows the call stack of the current thread

  Shows the chain of function calls that led to the current position.

  Try: “Show the call stack”

  Read · GetCallStack

• Reads the arguments of the function you are paused in

  Reads function arguments from the stack on 32-bit or from registers on 64-bit at the current position.

  Try: “What arguments was this function called with?”

  Read · GetArguments

• Lists loaded DLLs and EXEs with their addresses and sizes

  Lists every module the program has loaded, with base address and size.

  Try: “Which DLLs are loaded?”

  Read · ListModules

• Shows which functions a module imports

  Shows the import table of a loaded module.

  Try: “What does this EXE import?”

  Read · GetImports

• Shows which functions a module exports

  Shows the export table of a loaded module.

  Try: “List the exports of crypt32.dll”

  Read · GetExports

• Pulls readable text strings out of a module

  Scans a module's memory for readable text and returns each string with its address.

  Try: “Show the strings in the main module”

  Read · GetStrings

• Searches the program's memory for a piece of text

  Searches process memory for a text string and returns where it occurs.

  Try: “Find where 'password' appears in memory”

  Read · SearchForStrings

• Searches a module for a byte pattern with wildcards

  Scans module memory for a byte pattern, with ?? as wildcards, and returns matching addresses.

  Try: “Find the pattern E8 ?? ?? ?? ?? 85 C0 74”

  Read · FindPattern

• Finds calls and jumps to an address

  Finds the CALL and JMP instructions in a module that point to a target address.

  Try: “What calls this function?”

  Read · GetReferences

• Lists the functions found in a module

  Lists analysed functions in a module with their start, size and label. Needs code analysis first.

  Try: “List the functions in the main module”

  Read · GetFunctions

• Runs code analysis so functions and references can be listed

  Runs x64dbg's code analysis on a module or range, which fills in the function list and cross-references.

  Try: “Analyse the main module”

  Write · AnalyzeCode

• Searches symbol names in a module

  Searches labels and symbols in a module that match a pattern.

  Try: “Find symbols containing Crypt”

  Read · SearchSymbols

• Lists the exported symbols of a module

  Lists the exported symbols of a module.

  Try: “List symbols in ntdll”

  Read · ListSymbols

• Shows a program's file structure: sections, entry point, size

  Shows the PE structure of a module: sections, entry point, image size and flags.

  Try: “Analyse the PE sections of this EXE”

  Read · AnalyzeModule

• Tries to find the real entry point of a packed program

  Looks at section characteristics to guess the original entry point of a packed executable.

  Try: “Find the original entry point of this packed sample”

  Read · DetectOEP

• Shows all memory regions with their size and protection

  Shows every memory region with base address, size, protection and owning module.

  Try: “Show the memory map”

  Read · GetMemoryMap

• Lists memory regions that can be dumped

  Lists committed, readable memory regions for a module or the whole process.

  Try: “Which regions can I dump?”

  Read · GetDumpableRegions

• Follows a chain of pointers and shows each step

  Follows a pointer several levels deep and shows each address, value and module.

  Try: “Follow the pointer at RCX three levels”

  Read · FollowPointer

• Works out an expression such as an address, register or sum

  Evaluates an x64dbg expression, such as a register, symbol or arithmetic, and returns it in hex and decimal.

  Try: “What is rsp+0x28?”

  Read · EvalExpression

• Works out several expressions at once

  Evaluates several x64dbg expressions in one call and returns all results.

  Try: “Show rax, rcx and [rsp+8]”

  Read · WatchExpressions

• Lists the program's threads

  Lists every thread with its ID, current instruction and name.

  Try: “List the threads”

  Read · GetThreads

• Switches the debugger to another thread

  Makes another thread the active one for registers and stepping.

  Try: “Switch to thread 2240”

  Write · SwitchThread

• Suspends one thread

  Suspends a thread by its ID.

  Try: “Suspend thread 2240”

  Write · SuspendThread

• Resumes a suspended thread

  Resumes a thread that was suspended.

  Try: “Resume thread 2240”

  Write · ResumeThread

• Reads the process environment block, such as the being-debugged flag

  Reads key fields of the Process Environment Block: image base, being-debugged flag, heaps, global flags, image path and command line.

  Try: “Is the being-debugged flag set?”

  Read · GetPEB

• Walks the exception handler chain (32-bit only)

  Walks the structured exception handler chain and shows each handler's address and module. 32-bit programs only.

  Try: “Show the SEH chain”

  Read · GetSEHChain

• Sets a hardware breakpoint on read, write or execute

  Sets a breakpoint using the CPU debug registers, triggered on read, write or execute.

  Try: “Break when this address is written”

  Write · SetHardwareBreakpoint

• Breaks when a memory range is read, written or run

  Sets a memory breakpoint using guard pages. It covers larger ranges than hardware breakpoints but is slower.

  Try: “Break when this buffer is read”

  Write · SetMemoryBreakpoint

• Sets a breakpoint that only stops when a condition is true

  Sets a breakpoint with a condition and optional log text.

  Try: “Break on CreateFileW only when rcx is not zero”

  Write · SetConditionalBreakpoint

• Runs a debugger command each time a breakpoint is hit

  Sets an x64dbg command to run whenever a breakpoint is hit, for example to log a register.

  Try: “Log eax every time this breakpoint hits”

  Runs code · SetBreakpointCommand

• Makes a breakpoint keep running after it hits

  Makes a breakpoint continue automatically after it hits. With a breakpoint command it becomes a logging breakpoint.

  Try: “Make that breakpoint log and keep going”

  Write · SetBreakpointFastResume

• Chooses whether an exception stops the debugger or passes through

  Sets how an exception code is handled: break into the debugger or pass it to the program.

  Try: “Ignore C++ exceptions”

  Write · SetExceptionBreakpoint

• Removes an exception rule and restores default handling

  Removes an exception breakpoint so that exception code is handled the default way again.

  Try: “Remove the rule for C++ exceptions”

  Delete · DeleteExceptionBreakpoint

• Lists all breakpoints

  Lists every active breakpoint: software, hardware and memory.

  Try: “List my breakpoints”

  Read · ListBreakpoints

• Turns a breakpoint back on

  Enables a breakpoint at an address.

  Try: “Enable the breakpoint at 0x401000”

  Write · EnableBreakpoint

• Turns a breakpoint off without removing it

  Disables a breakpoint at an address but keeps it.

  Try: “Disable that breakpoint for now”

  Write · DisableBreakpoint

• Switches a breakpoint between on and off

  Toggles a breakpoint between enabled and disabled.

  Try: “Toggle the breakpoint at 0x401000”

  Write · ToggleBreakpoint

• Resets a breakpoint's hit counter

  Sets the hit counter of a breakpoint back to zero.

  Try: “Reset the hit count on that breakpoint”

  Write · ResetHitCount

• Removes a breakpoint

  Removes a breakpoint at an address or function name.

  Try: “Remove the breakpoint on CreateFileW”

  Delete · DeleteBreakpoint

• Removes every breakpoint

  Removes all normal, hardware and memory breakpoints.

  Try: “Clear all breakpoints”

  Delete · DeleteAllBreakpoints

• Steps through up to 100 instructions and records each one

  Single-steps a number of instructions, up to 100, going into calls, and records each address and instruction.

  Try: “Trace the next 50 instructions”

  Runs code · TraceInto

• Steps through instructions over calls and records each one

  Steps a number of instructions, stepping over calls, and records each address and instruction.

  Try: “Trace 30 instructions, stepping over calls”

  Runs code · TraceOver

• Changes a CPU register's value

  Sets a CPU register to a new value.

  Try: “Set rax to 1”

  Write · SetRegister

• Patches the running program's memory with new bytes

  Writes raw bytes to an address in the live process, changing its memory.

  Try: “Patch 0x401000 with 90 90”

  Write · WriteMemToAddress

• Writes a new instruction at an address, replacing the old bytes

  Assembles an instruction at an address and overwrites the bytes there.

  Try: “Change the jump at 0x401020 to jmp 0x401050”

  Write · Assemble

• Lists the memory patches you have made

  Lists all memory patches applied to the program.

  Try: “What have we patched?”

  Read · GetPatches

• Undoes all memory patches

  Restores every patched byte to its original value.

  Try: “Undo all patches”

  Write · RestorePatches

• Allocates a block of memory inside the program

  Allocates a block of memory in the program being debugged.

  Try: “Allocate 4 KB in the target”

  Write · AllocateMemory

• Frees memory you allocated inside the program

  Frees a memory block that was allocated in the program.

  Try: “Free the block we allocated”

  Delete · FreeMemory

• Saves a memory region to a file

  Saves a region of the program's memory to a file on disk.

  Try: “Dump this region to a file”

  Files · DumpMemory

• Saves a whole loaded module to a file

  Dumps an entire loaded module to a file on disk, for example after unpacking.

  Try: “Dump the unpacked main module”

  Files · DumpModule

• Adds a comment or label in the disassembly

  Adds a comment or a label at an address in the disassembly.

  Try: “Label 0x401230 as decrypt_config”

  Write · CommentOrLabelAtAddress

• Bookmarks an address

  Sets a bookmark at an address.

  Try: “Bookmark this address”

  Write · SetBookmark

• Lists your bookmarks

  Lists all bookmarks with their addresses and labels.

  Try: “Show my bookmarks”

  Read · ListBookmarks

• Removes a bookmark

  Deletes a bookmark at an address.

  Try: “Remove that bookmark”

  Delete · DeleteBookmark

• Saves your labels, comments and breakpoints for next time

  Saves the x64dbg database for the current module so labels, comments, breakpoints and analysis persist.

  Try: “Save my work on this module”

  Write · SaveDatabase

• Runs any x64dbg command

  Runs a native x64dbg command string. This can do anything the debugger's command line can.

  Try: “Run the x64dbg command analr”

  Runs code · ExecuteDebuggerCommand

• Shows recent debugger events such as exceptions and DLL loads

  Shows the last debugger events, such as exceptions, breakpoints, DLL loads and thread events. It keeps the last 64.

  Try: “What events happened since the last step?”

  Read · GetEventLog

• Clears the event log

  Empties the list of recent debugger events.

  Try: “Clear the event log”

  Write · ClearEventLog

• Used by the assistant behind the scenes

  Waits until the program stops

  Waits until the program pauses at a breakpoint, an exception or exit, and says why.

  Try: “Wait until it stops”

  Read · WaitForPause

• Waits for the next debugger event

  Waits until a debugger event fires or a timeout passes, for clients that cannot receive pushed events.

  Try: “Wait for the next breakpoint hit”

  Read · WaitForEvent

• Lists the tools this server offers

  Lists the available tools, optionally for one category.

  Try: “Which tools do you have for memory?”

  Read · ListCommandsByCategory

• Sends your input straight back, to test the connection

  Echoes the input back to check the connection works.

  Try: “Test the debugger connection”

  Read · Echo

Watch out for

• It can run any debugger command and patch memory

  The assistant can start programs, attach to processes, write memory and run raw x64dbg commands. Use it only inside an isolated analysis VM. github.com

• Check which network address it listens on

  The README says it listens on 0.0.0.0, every network the machine is on, but the code defaults to 127.0.0.1. Check the address in the config dialog and set 127.0.0.1 unless you connect from WSL or another machine. github.com

• Traffic is plain HTTP

  The token and debugger data travel unencrypted. Do not expose the port to untrusted networks. github.com

• Dumps write files to disk

  Memory and module dumps save files on the debugging machine. Keep them inside the VM. github.com

Security advisories

In their words