x64dbg MCP

Measure latency of core bridge operations on the current debug session.

Pin the current workflow to a specific PID + image path + module base identity.

Delete the bookmark at an absolute runtime address. The operation is session-guarded and idempotent by resulting debugger state. ``deleted`` is false when no bookmark existed.

Get bookmark information for an absolute runtime address.

Enumerate bookmarks, optionally filtered by module, with pagination.

Set a bookmark at an absolute runtime address.

Return the authoritative debugger bridge and debug-session identity. Diagnostic only for a debugger that is already running. When a target EXE path is known, call InitDebuggee directly instead of using BridgeHello as a preflight check; InitDebuggee selects and starts x32dbg/x64dbg from the configured X64DBG_ROOT and waits for this bridge automatically. This is the identity used by every state-changing operation. ``ok`` is false for a legacy bridge because it cannot provide atomic stale-session protection.

Capture registers, expressions, memory ranges, and stack slots in one call. Args: registers_json: JSON array or comma/newline-separated register names. expressions_json: JSON array or newline-separated expressions. ranges_json: JSON array of `{label, expr, size, format}` specs. stack_slots_json: JSON array of `{label, expr, size, format}` specs.

Capture the debuggee's current top window or a specific hwnd and store a visual snapshot.

Capture a proven write-then-execute transition for one memory range. The workflow records the range, catches and steps over its first write, then arms an execute memory breakpoint. It accepts execution only when RIP/EIP points at a byte changed since the initial snapshot. The target remains paused at that instruction so a dump can be captured without a race.

Capture CLR/AppDomain/module/thread/stack/JIT state via a passive sidecar. The target must be paused for a coherent ClrMD read. The sidecar never claims the debug port and performs no target mutation. Optional token resolution is intentionally scoped to methods present on active managed stacks; unavailable pre-JIT methods are reported as not found.

Capture one or more memory ranges and store the snapshot in runtime history.

Capture a rich, structured snapshot of the current stop — registers, selected memory/stack slots, the call stack, and disassembly around the instruction pointer — in one payload. Ideal right after a breakpoint hit so the model gets full context in a single round-trip. Args: registers_json: Optional JSON array of register names to include (empty = the standard set). expressions_json: Optional JSON array of x64dbg expressions to evaluate. ranges_json: Optional JSON array of {label, expr, size, format} memory ranges to read. stack_slots_json: …

Resolve a symbolic target such as `module!func+0x10`, set a breakpoint, and return structured runtime context on hit.

Save a lightweight execution checkpoint (registers plus a small stack snapshot) that you can return to later with Rewind. Convenience alias for SaveState tuned for quick save/restore loops during exploration. Args: label: Optional human-readable label. Empty = an auto-generated id. Returns: {"ok": bool, ...} from SaveState including the snapshot id — pass that id to Rewind to restore.

Clear exception history for the guarded current session without changing policy.

Disable and clear the active session's exception policy atomically.

Clear retained native API events and pending shadow-stack state.

Delete retained native-trace evidence after the trace is no longer active.

Clear in-memory trace and breakpoint capture history.

Remove the current bound-session constraint.

Click inside the current foreground window using SendInput mouse events.

Click a GUI control, typically a Button.

Click inside a resolved debuggee window using coordinates relative to its client or window rect.

Bounded, retryable close of all retained launch workers and handles.

Close a launch pipe's write end, delivering deterministic EOF to the target.

Delete the comment at an absolute runtime address. The operation is session-guarded and idempotent by resulting debugger state. ``deleted`` is false when no comment existed.

Get the comment at the specified address. Parameters: addr: Address to query (hex format, e.g. "0x1400010a0") Returns: Dictionary with: - address: The queried address - found: Whether a comment exists - comment: The comment text

Enumerate comments, optionally filtered by module, with pagination.

Set a comment at the specified address in x64dbg. Comments appear in the disassembly view next to the instruction. Parameters: addr: Address to set the comment at (hex format, e.g. "0x1400010a0") text: Comment text Returns: Dictionary with success status and address

Compare two stored memory snapshots and summarize changed bytes per range.

Compare two stored window captures and summarize visual differences.

Continue the current exception with explicit debugger semantics. ``pass`` sends DBG_EXCEPTION_NOT_HANDLED to the debuggee; ``swallow`` sends DBG_CONTINUE. ``normal`` uses the debugger's ordinary run policy. The exception event sequence is guarded atomically by the bridge so a delayed agent call can never handle a newer exception accidentally.

Delete breakpoint at address using Script API Parameters: addr: Memory address (in hex format, e.g. "0x1000") Returns: Status message

Pause execution without blocking the MCP HTTP server. Returns: Status message

Resume execution without blocking the MCP HTTP server. This intentionally uses a non-blocking debugger command path so the bridge can continue to service Pause/Status requests while the target is running. Returns: Status message

Resume execution and wait until x64dbg pauses again. Use this only when you explicitly want a blocking wait for the next breakpoint, exception, or pause event. The bridge itself only performs short wait slices so status/pause requests from another client remain responsive; this tool owns the overall timeout.

Set breakpoint at address using Script API Parameters: addr: Memory address (in hex format, e.g. "0x1000") Returns: Status message

Step into the next instruction without blocking the MCP HTTP server. Returns: Command execution result

Step out of the current function without blocking the MCP HTTP server. Returns: Command execution result

Step over the next instruction without blocking the MCP HTTP server. Returns: Command execution result

Stop debugging using Script API Returns: Status message

Decode common structured layouts such as UNICODE_STRING, FILETIME, SOCKADDR, RECT, and simple Rust/C++ string/vector layouts.

Delete a hardware breakpoint at the specified address. Parameters: addr: Address of the hardware breakpoint to delete (hex format) Returns: Dictionary with success status and address

Delete a memory breakpoint by name or base address.

Delete a saved state snapshot.

Diff compatible coverage artifacts using stable block/edge keys.

Disassemble a whole function starting at `addr` until a ret/int3/jmp. Returns compact rows {addr, ins, size}. Always tries fallthrough — does not follow conditional branches into separate paths.

Get disassembly of multiple instructions starting at the specified address Parameters: addr: Memory address (in hex format, e.g. "0x1000") count: Number of instructions to disassemble (default: 1, max: 100) Returns: Dict with address, count, and instructions[] list

Disassemble a raw address range without guessing function bounds. Pages resume from the opaque ``nextCursor`` address.

Drag the mouse inside a resolved debuggee window using coordinates relative to its client or window rect.

Dump a loaded module as a reloadable source-backed PE. Live executable sections are overlaid onto the original PE after reversing runtime relocations. Loader-critical headers, imports, TLS and writable CRT state remain pristine. Active software breakpoints in copied code fail the operation rather than being embedded into the output.

Export a normalized memory-map manifest with bounded provenance hashes.

Produce a VERIFIED unpacked dump of a module to disk. With find_oep=True (default) this drives the packer-agnostic OEP engine (FindOEP) — which works for the unpack-in-memory-then-jump class (UPX, ASPack, FSG, MPRESS, PECompact, Petite, simple crypters) — then dumps via Scylla and VERIFIES the result before reporting ok: the entry must have moved out of the packer stub to the real OEP, the IAT must resolve cleanly (no garbage descriptors), and the imports must be non-trivial. A dump that merely landed on disk is NOT a success. On failure it returns ok:false with a reason and keeps the raw memo…

Atomically dump any readable virtual-memory range, including arbitrary DLLs.

Wait for a supported debugger event and emit a verified dump artifact.

Reconstruct a disk-layout PE from a loaded memory-layout image. For destroyed/headerless images, `header_template_path` is accepted only after executable-section identity verification by default. Writable sections are reset from the bound template by default so CRT and loader state captured after DllMain cannot poison a later reload. `entry_rva_override` is bounded to an executable template section and can record a recovered manual-loader OEP without trusting stale headers. `source_layout=auto|memory|disk` also supports an embedded reflective raw PE staged inside a larger private allocation.

Ensure that the requested x64dbg/x32dbg instance is running and its HTTP bridge is reachable. Args: arch: Desired debugger architecture: auto, x64, or x86. timeout_ms: Maximum time to wait for the debugger bridge. restart: When true, terminate existing debugger processes before launching a fresh one.

One-call health check. Returns {ok, reasons[], hints[]}. Tells whether x64dbg is running, a process is loaded, it is paused, and whether analysis has been run.

Inject ScyllaHide into the current debuggee when analysis suggests anti-debug behavior or when forced.

Enumerate all open handles in the debugged process. Returns handle values, types, access rights, names, and type names. Useful for analyzing file handles, registry keys, mutexes, events, etc. Returns: Dictionary with: - count: Number of handles - handles: List of handle objects with handle (hex), typeNumber, grantedAccess (hex), name, and typeName

Enumerate all TCP connections of the debugged process. Useful for analyzing network activity, identifying C2 connections, etc. Returns: Dictionary with: - count: Number of connections - connections: List of connection objects with remoteAddress, remotePort, localAddress, localPort, and state

Evaluate a batch of expressions. Args: expressions_json: JSON array or newline/comma-separated expressions.

Execute a command in x64dbg and return its output Ensure that if the command has arguments, you comma separate the values, but not the command itself I.E. findallmem findallmem 0x140001000,CC,20480 Parameters for commands that use the Reference View: cmd: Command to execute offset: Pagination offset for reference view results (default: 0) limit: Maximum number of reference view rows to return (default: 100, max: 5000) Returns: Dictionary with: - success: Whether the command executed successfully - refView: References tab data populated by the command (if any), with: …

Export x64dbg analysis as a portable, deterministic module+RVA document. Labels, comments, bookmarks and inclusive function ranges are always exported. Breakpoints and patches are evidence only and are never applied by an import unless their explicit opt-in flags are set.

Export the schema-v2 tool catalog, profiles, annotations and side effects.

Export stable hash+RVA basic-block/edge coverage for an active trace.

Extract a bounded CLR metadata stream from a paused managed module. This is intentionally a metadata-stream artifact, not a claim that a dynamic assembly has been reconstructed into a runnable PE. Dynamic and non-PE modules are supported when ClrMD exposes a metadata address/length; provenance, target identity and an exact SHA-256 are retained.

Export canonical SHA-256-bound CLR metadata and bounded IL evidence.

Atomically export a session-bound CLR/JIT/stack capture.

Write a patched copy of a module's on-disk file, applying every byte patch made in the current x64dbg session. This turns in-debugger patches into a standalone patched executable (the classic final step of a crack/fix). Patches are read from GetPatchList; each runtime address is converted to a file offset via the module's PE section table (pefile), so the bytes land at the correct on-disk location regardless of ASLR. Args: output_path: Destination path for the patched file. Required. Parent directories are created if missing. module: Module name whose patches to appl…

Export static annotations plus hash+RVA runtime evidence for IDA.

Mark native shadow-stack entries without a return as finalized/unresolved.

Find contiguous pointer runs that resolve into loaded modules.

Find the Original Entry Point (OEP) of a packed executable and, optionally, produce a VERIFIED unpacked dump. Engine: a packer-agnostic dynamic approach for the unpack-in-memory-then-jump class (UPX, ASPack, FSG, MPRESS, PECompact, Petite, simple crypters): 1. ESP-anchor fast-forward -- a hardware breakpoint on the stub's saved register slot skips past the decompression loop and is immune to the page writes that defeat memory breakpoints. 2. Section-hop conditional trace -- single-steps in the engine until execution enters a non-stub executable section (the OEP). Virtualizi…

Repair a dump's load-time IAT slots conservatively and verify its PE structure.

Get CPU flag value using TitanEngine Parameters: flag: Flag name (ZF, OF, CF, PF, SF, TF, AF, DF, IF) Returns: Flag value (True/False)

Set CPU flag value using Script API Parameters: flag: Flag name (ZF, OF, CF, PF, SF, TF, AF, DF, IF) value: Flag value (True/False) Returns: Status message

Focus the main debuggee window or its console host.

Wait for the most likely child process, optionally strip a foreign debug object, attach, and bind the session.

Add an x64dbg function range; ``end`` is inclusive.

Delete the x64dbg function range containing an absolute address. The operation is session-guarded and idempotent by resulting debugger state. ``deleted`` is false when no function range existed.

Enumerate x64dbg function ranges; returned ends are inclusive.

Read API trace log with pagination. Args: trace_id: Session id from StartApiTrace. offset: Start index (0-based). limit: Max calls to return (default 100, max 5000). func_filter: Optional case-insensitive substring for "module!func".

Return coverage summary: covered instruction addresses grouped with module-relative offsets. Useful for fuzzing feedback.

Get the destination address of a branch instruction (jmp, call, jcc, etc.). Resolves where the branch at the given address would jump/call to. Parameters: addr: Address of the branch instruction (hex format, e.g. "0x1400010a0") Returns: Dictionary with: - address: The queried instruction address - destination: The resolved target address - resolved: Whether the destination was successfully resolved

Return recent breakpoint-triggered structured captures.

Get list of all breakpoints currently set in the debugger. Parameters: type: Breakpoint type filter - "all" (default), "normal", "hardware", "memory", "dll", "exception" Returns: Dictionary with: - count: Number of breakpoints - breakpoints: List of breakpoint objects with type, addr, enabled, singleshoot, active, name, module, hitCount, fastResume, silent, breakCondition, logText, commandText

Get the current call stack of the debugged thread. Returns the full stack trace with addresses, return addresses, and comments. Returns: Dictionary with: - total: Number of stack frames - entries: List of call stack entries, each with: - addr: Current address in the frame - from: Return address (caller) - to: Called address (callee) - comment: Auto-generated comment (function name, etc.)

Return the child-process broker state for the currently selected bridge.

Collect a UI Automation tree snapshot for the current debuggee.

Enumerate top-level windows and child controls for the debuggee.

Return a consolidated view of debugger-side plugin installation and runtime status.

Get a normalized debugger state snapshot. Args: include_console: When true, read visible console text if available. include_callstack: When true, include the current call stack while paused. include_registers: When true, include the current register dump while paused. include_breakpoints: When true, include breakpoint lists and hit counts. include_session: When true, include the raw session payload from the bridge. max_console_chars: Maximum visible console characters to read.

Minimal debugger state for cheap polling. Returns: pid, state, rip, stopReason, exceptionCode, module, paused. ~20x smaller than GetDebugState. Prefer this during loops, keep GetDebugState for one-off full inspections.

Read cursor-paginated causal exception history for the current session.

Return the native exception policy and the session identity it is bound to.

Return the export table for a loaded module.

Return the current foreground window title/class/pid.

Fetch likely function arguments using the current calling convention. x64: rcx, rdx, r8, r9, then [rsp+0x28], [rsp+0x30]... x86: [esp+4], [esp+8]... Returns raw hex, plus string interpretation when the value looks like a readable ASCII/UTF-16 pointer.

Compact single-function report: bounds, size, caller refs, referenced strings/constants sampled from the body, and first/last instructions.

Reduce returned allocator calls into live resources and lifecycle evidence.

Return the import table for a loaded module. If `module` is empty, uses the current debuggee's main module. Each entry: {module, function, iatVa, thunkVa}. Falls back to QuerySymbols('Import*') if the plugin has no dedicated endpoint. Works on any PE loaded in the debugger.

Return recent keyboard/text input actions emitted by the bridge.

Return parsed interaction history across run/pause/input/gui/capture actions.

Return process, stream, child-policy, and cleanup state for one launch.

Return only CLR/CoreCLR exception events from native API trace evidence.

Report managed image metadata and the loaded CLR/CoreCLR runtime modules.

Get the full virtual memory map of the debugged process. Returns all memory pages with their base address, size, protection, type, and info. Returns: Dictionary with: - count: Number of memory pages - pages: List of page objects with base, size, protect (ERW/ER-/-RW/-R-/E--/---), type (IMG/MAP/PRV), and info (module name or description)

Return a previously stored memory snapshot by id.

List supported MiniDump presets and their exact MINIDUMP_TYPE masks.

Get list of loaded modules. Returns: Dictionary with count, modules (list of objects), and summary (human-readable lines).

Read native breakpoint entry/return evidence for an API trace session.

Read a trace using legacy offsets or independent event/hit watermarks. ``detail=summary`` keeps the explicitly requested event/hit page and removes only repeated trace-configuration fields. ``detail=full`` returns every historical field. Empty detail inherits the active tool profile.

Check if a specific address has been patched and get patch details. Parameters: addr: Address to check (hex format, e.g. "0x1400010a0") Returns: Dictionary with: - address: The queried address - patched: Whether the address is patched - module: Module name (if patched) - oldByte: Original byte value (if patched) - newByte: Patched byte value (if patched)

Enumerate all memory patches applied in the current debugging session. Shows original and patched byte values for each patched address. Returns: Dictionary with: - count: Number of patches - patches: List of patch objects with module, address, oldByte, newByte

Query ProcessDebugPort / ProcessDebugObjectHandle / ProcessDebugFlags for a PID. Args: pid: Target PID. Defaults to the current debuggee when omitted.

Return the most recent bridge log lines. Args: lines: Maximum number of log lines to return.

Get a complete dump of all CPU registers in one call. Returns general purpose registers, segment registers, debug registers, flags, and last error/status information. Much more efficient than reading registers individually. Returns: Dictionary with all register values (cax/ccx/cdx/cbx/csp/cbp/csi/cdi, r8-r15 on x64, cip, eflags, segment regs, debug regs, flags object, lastError, lastStatus)

Inspect ScyllaHide installation, configured profile, and whether the hook is loaded in the current debuggee.

Return the currently selected bridge/session identity without secrets.

Return the currently bound session identity and whether it matches the live state.

Return full contents of a state snapshot (registers + memory ranges).

Get the Thread Environment Block (TEB) address for a specific thread. Use GetThreadList first to discover thread IDs. Args: tid: Thread ID (decimal integer string, e.g. "1234") Returns: Dictionary with tid and tebAddress fields

Get list of all threads in the debugged process with detailed information. Returns: Dictionary with: - count: Number of threads - currentThread: Index of the currently focused thread - threads: List of thread objects with threadNumber, threadId, threadName, startAddress, localBase, cip, suspendCount, priority, waitReason, lastError, cycles

Return recent StepWithSnapshot history.

Return TraceRecord session info. By default returns summary; set include_addrs=true to include observed addresses (paginated by `limit`).

Return metadata for a previously stored window capture.

Return metadata for recent captured windows/screens.

Plan or apply portable analysis evidence to the active module. The default is a read-only dry run. Hash and architecture mismatches fail closed. Breakpoints and patches require separate explicit opt-in flags; imported breakpoint commands/log actions are never executed.

Import only static labels/comments/bookmarks/functions from runtime evidence.

Preferred first call when the target executable path is known. Reliably start a new debuggee with retries and state verification. This tool detects the target architecture, resolves X64DBG_ROOT, starts the matching x32dbg/x64dbg instance, waits for its authenticated bridge, and opens the target. Do not preflight BridgeHello, probe port 8888, or search debugger installation paths manually before calling InitDebuggee. Args: exe_path: Absolute path to the executable. timeout_ms: Maximum total time to spend retrying. retries: Maximum number of init attempts. stop_first: When true…

Inspect CLR metadata, type/method tokens and optional bounded IL bytes.

Compare the attached process image in memory with its on-disk identity and select a likely hollowed/manual child payload using PID-bound module, memory-map, PE-header and immutable-code evidence.

Inspect live IAT slots and classify each pointer against loaded modules.

Invoke a UI Automation element with InvokePattern.

Check if debugger is active (running) Returns: True if running, False otherwise

Check if x64dbg is debugging a process Returns: True if debugging, False otherwise

Delete the label at an absolute runtime address. The operation is session-guarded and idempotent by resulting debugger state. ``deleted`` is false when no label existed.

Get the label at the specified address. Parameters: addr: Address to query (hex format, e.g. "0x1400010a0") Returns: Dictionary with: - address: The queried address - found: Whether a label exists at that address - label: The label text (empty if not found)

Get all labels defined in the current debugging session. Returns: Dictionary with: - count: Number of labels - labels: List of label objects with module, rva, text, and manual fields

Set a label at the specified address in x64dbg. Labels appear in the disassembly view and are useful for marking important addresses. Parameters: addr: Address to set the label at (hex format, e.g. "0x1400010a0") text: Label text (e.g. "main_decrypt_loop") Returns: Dictionary with success status, address, and label text

Preferred one-shot entrypoint for opening a target under x64dbg/x32dbg. This tool is intentionally explicit for agents: it ensures the matching debugger is running, opens the target executable under it, and returns the resulting debug-session payload. Use this before falling back to any shell-based debugger discovery. Args: exe_path: Absolute path to the target executable. arch: Desired debugger architecture. Auto prefers the target PE architecture. restart_debugger: When true, restart the debugger before opening the target. timeout_ms: Maximum total wait budget. retries:…

Ensure the right debugger is running and launch a target executable under it. Args: exe_path: Absolute path to the target executable. arch: Desired debugger architecture. Auto prefers the target PE architecture. restart_debugger: When true, restart the debugger before launching the target. timeout_ms: Maximum total wait budget. retries: Maximum init attempts for the target. stop_first: When true, stop the active debug session before launching the target. use_scyllahide: off (default), auto (same as off), or force (explicit injection). scyllahide_profile: Option…

List all API trace sessions with summary.

List active workflow breakpoint leases and ownership/cleanup metadata.

List child or descendant processes of the current debuggee/launch source and rank likely runtime candidates.

List authenticated x32/x64dbg bridge instances and broker sessions. The result never exposes bearer tokens. ``root_launch_id`` or ``broker_id`` can restrict the list to one typed-launch process tree.

List saved state snapshots (most recent first).

Load a DLL into the debuggee via x64dbg's 'loadlib' (it runs a small stub that calls LoadLibrary inside the target). Useful to force-load a helper / instrumentation DLL or a delay-loaded dependency. Args: path: DLL name or full path to load into the target. Required. Returns: {"ok", "command", "success", "error"?}. Confirm the library appeared with GetModuleList. Requires an active, paused debug session.

Download and/or load debug symbols (PDB) for a module, so that later symbol queries and disassembly resolve function/variable names. Args: module: Module name, with or without extension (e.g. "target.exe", "ntdll"). Empty applies to all loaded modules. symbol_store: Optional symbol-store URL. Empty uses x64dbg's configured default store (typically the Microsoft symbol server). download: When True (default) run 'symdownload' to fetch symbols from the store first; when False only 'symload' already-present symbols. Returns: {"ok", "com…

Invoke an MCP tool by name with arguments.

List available MCP tool functions and their parameters.

Find the base address and size of a module containing the given address Parameters: addr: Memory address (in hex format, e.g. "0x7FF12345") Returns: Dictionary containing base_address and size of the module

Get memory protection flags Parameters: addr: Memory address (in hex format, e.g. "0x1000") Returns: Protection flags in hex format

Check if memory address is valid Parameters: addr: Memory address (in hex format, e.g. "0x1000") Returns: True if valid, False otherwise

Read memory using enhanced Script API Parameters: addr: Memory address (in hex format, e.g. "0x1000") size: Number of bytes to read Returns: Hexadecimal string representing the memory contents

Allocate memory in the debuggee's address space. Useful for code injection, shellcode testing, or creating data buffers. Parameters: size: Size in bytes to allocate (hex format, e.g. "0x1000") addr: Preferred base address (hex format, default "0" for any address) Returns: Dictionary with: - address: The allocated memory address - size: The requested size

Free memory previously allocated in the debuggee's address space via MemoryRemoteAlloc. Parameters: addr: Address of the memory to free (hex format, e.g. "0x1000") Returns: Dictionary with success status

Write memory using enhanced Script API Parameters: addr: Memory address (in hex format, e.g. "0x1000") data: Hexadecimal string representing the data to write Returns: Structured write/verification result from bridge v2 (legacy bridges may still return a status string).

Merge compatible coverage artifacts by stable block/edge identity.

Parse expression using Script API (numeric / duint result only NO STRINGS). Parameters: expression: Expression to parse (e.g. "[rsp+8]" or "cip") Returns: Parsed value in hex format

Get remote procedure address using Script API Parameters: module: Module name (e.g. "kernel32.dll") api: API name (e.g. "GetProcAddress") Returns: Function address in hex format

Find pattern in memory using Script API Parameters: start: Start address (in hex format, e.g. "0x1000") size: Size to search IN DECIMAL pattern: Pattern to find (e.g. "48 8B 05 ?? ?? ?? ??") Returns: Found address in hex format or error message

Enumerate symbols for a specific module. Use GetModuleList first to discover module names. Returns imports, exports, and user-defined function symbols for the given module. Args: module: Module name to query symbols for (e.g. "kernel32.dll", "ntdll.dll"). Required. offset: Pagination offset - number of symbols to skip (default: 0) limit: Maximum number of symbols to return per page (default: 5000, max: 50000) Returns: Dictionary with: - total: Total number of symbols in the module - module: The module name queried - offset: Current offset - limit: Current limi…

Read text from a specific GUI control using Unicode and ANSI fallbacks.

Read the visible text from the debuggee console window. Args: pid: Optional debuggee PID. When omitted, the current target is inferred. max_chars: Maximum visible console characters to read. wait_ms: If the console has not been painted yet, keep retrying up to this long for non-empty text. This removes the need for callers to sleep after resuming the target before reading a freshly printed prompt. poll_ms: Retry interval while waiting for console text to appear.

Snapshot the current frame. Args: base_expr: Frame base expression, usually `rbp`/`ebp`. slots_json: JSON array of `{label, expr, size, format}` stack slot specs. expressions_json: Extra expressions to evaluate. ranges_json: Extra memory ranges to read. registers_json: Optional register names to include.

Read binary-safe captured stdout/stderr using an absolute ring cursor.

Read a buffer/string from a ptr+len pair without manual address arithmetic.

Read a memory range in a RE-friendly format. Args: addr: Address or expression such as `0x401000`, `module!func+0x10`, or `[rbp+0x20]`. size: Number of bytes to read. ty: One of `hex`, `bytes`, `ascii`, `utf8`, `utf16`, `u8`, `u16`, `u32`, `u64`. max_chars: Text decoding limit for ascii/utf8/utf16 views.

Read multiple memory ranges in one call. regions_json: JSON list of {addr, size, ty?, max_chars?}. Supported ty: hex (default), bytes, ascii, utf8, utf16, u8..u64.

Repair an existing raw PE dump's imports using the paused live process. An explicit ``iat_start`` + ``iat_size`` is authoritative. Otherwise the exact source PE IAT directory is preferred when it is populated; Scylla search is the final fallback. The input dump is never modified in place.

Recover comparison candidates from exact API-trace operand evidence. This consumes completed strcmp/strncmp/memcmp/wide-string calls. With a known probe it distinguishes the user-controlled operand and recovers a direct peer or a single-byte-XOR-transformed peer. A returned candidate must still be verified with an independent launch of the target.

Recover a custom/runtime IAT from exact live export evidence. The target must be paused after its resolver populated a contiguous pointer table. Select that table by absolute ``table_base`` or exported ``table_symbol`` and provide the exact non-null slot count. Every pointer is matched to an exact, non-forwarded export. When ``trace_id`` is supplied, each reconstructed slot must also be backed by a complete custom-resolver return observation with no dropped calls. Set ``output_path`` to rebuild a loader-valid PE import directory. Supply an existing ``raw_dump_path`` or let the tool create a …

Get a register value. Register names are normalized: arch-neutral (cax/cbp/cip), 32-bit (eax/ebp/eip), 64-bit (rax/rbp/rip) and bare (bp/ip) forms all work regardless of the target architecture. If the bridge rejects the direct query, the value is recovered from the full register dump. Parameters: register: Register name (e.g. "eip", "rip", "cip", "ebp", "cbp"). Returns: Register value in hex format.

Set a register value. Register names are normalized across arch-neutral, 32-bit, 64-bit and bare forms (see RegisterGet). Parameters: register: Register name (e.g. "eip", "rip", "cip", "ebp", "cbp"). value: Value to set (in hex format, e.g. "0x1000"). Returns: Status message

Release one reference. The final reference compare-deletes only a workflow-created breakpoint; preexisting or user-modified points are kept.

Release this MCP client's active session mutation lease idempotently.

Attempt to detach an inherited/foreign debug object from a process. Args: pid: Target PID. Defaults to the current debuggee when omitted.

Renew one breakpoint lease without changing its ownership or reference count.

Renew this MCP client's active session mutation lease.

Pseudo-time-travel: find a saved state snapshot where rip/eip == target_addr and restore it. Must pair with snapshots saved during the original run — call SaveState at interesting points to build a replay timeline. Args: target_addr: Address to rewind to. label_prefix: Optional label prefix to restrict search (useful when you've tagged related snapshots). Returns {ok, snapshotId, restoredTo} or error with hint.

Resolve an active managed method to JIT/NGen native ranges and IL maps.

Resolve a MethodDef token/name to IL RVA and the loaded module address.

Resolve one runtime address or RVA to a stable image-SHA-256+RVA key.

Restart x64dbg/x32dbg and, by default, reload the target that was being debugged so the debug session comes back. Without reload the debugger app restarts with no target loaded, leaving a 'not_debugging' state. Args: arch: Desired debugger architecture after restart: auto, x64, or x86. timeout_ms: Maximum time to wait for the restarted debugger bridge. reload_target: When true (default), re-launch the previously debugged target after the debugger restarts, paused at its entry point.

Lease-serialise and execute one complete state restore workflow.

Resume every previously suspended thread in the debuggee. Returns: Uniform action envelope: {"ok", "command", "success", "error"?}.

Resume a previously suspended thread (decrements its suspend count). Args: tid: Thread ID (decimal, as GetThreadList reports it, or 0x-hex). Empty string resumes the currently active thread. Returns: Uniform action envelope: {"ok", "command", "success", "error"?}.

Restore a previously saved checkpoint (registers and captured memory), rewinding the debuggee to that state. Convenience alias for RestoreState. Args: snapshot_id: The id returned by Checkpoint/SaveState. Required. Returns: {"ok": bool, ...} from RestoreState.

Run the debuggee and collect API calls into the given trace session. Blocks until either `max_calls` calls are recorded, `timeout_ms` elapses, or the debuggee exits. Returns compact summary; use GetApiTraceLog for per-call details.

Check which bridge/binaries are live and whether source/live/cache/vendor/runtime copies drift.

Drive a heap trace until explicit allocation lifecycle evidence is met.

Drive an armed native trace with x64dbg conditional tracing and return evidence. Summary mode returns progress/counts/cursors only; the retained evidence is read through ``GetNativeTrace``. Full mode preserves the historical nested command, wait and evidence objects.

Strict variant of WaitForUserCode: only succeeds when paused in user code.

Run the debuggee while accumulating BB coverage into the given trace. Blocks until max_hits or timeout or debuggee exit.

Run until a condition is met. `target`: "ret" (step-out style), "call" (next call instruction), a hex/symbolic address, or a module!sym reference.

Resume if needed and wait until the requested module/DLL appears.

Drive the current session to the original entry point using the existing OEP helper.

Dump an arbitrary memory region of the debuggee to a file on disk (x64dbg 'savedata'). Use this to extract a decrypted/unpacked payload, injected shellcode, a config blob, or any private/heap buffer — unlike DumpModule, which dumps a whole PE module via Scylla. Args: output_path: Destination file path (on the debugger machine). Required. addr: Start address (hex "0x..." or an x64dbg expression). Required. size: Number of bytes to save. Required, must be > 0. Returns: {"ok", "output", "addr", "size", "exists", "sizeOnDisk", "command", ...}. `ok` is true only if the file wa…

Snapshot debuggee state: all GP registers + eflags + (optionally) memory ranges. Args: label: Optional human-readable label. ranges_json: Optional JSON array of `{label, expr, size}` memory ranges to capture. Typical use is `[{"label":"stack","expr":"esp","size":256}]`. Omit to snapshot only registers. Returns summary: {ok, snapshotId, label, registerCount, rangeCount, createdAt}. Use RestoreState(snapshotId) to revert, GetStateSnapshot(snapshotId) for full contents.

Find ordinary, embedded reflective/manual-map and template-matched headerless PE images without trusting the debugger module list. `include_embedded` scans every captured region prefix for valid MZ/PE headers, not just offset zero. Supplying `header_template_path` also derives candidate image bases from executable section RVAs and reports destroyed/headerless images only when immutable section bytes match the template above `minimum_template_similarity`.

Scan process memory for printable ASCII and/or UTF-16LE strings. Reads raw memory, so unlike SearchStrings (which only finds code-referenced `strref` strings in one module) it also surfaces strings in decrypted/unpacked heap or private buffers. Args: addr: Start address/expression of a single region to scan. Empty walks the whole readable committed memory map. size: Size of the single region (required when addr is given). min_length: Minimum string length to report (default 4). encodings: Comma list of "ascii" and/or "utf16" (default both). max_bytes: Total byte …

Send a mouse wheel event to the current foreground window.

Send a mouse wheel event to a resolved debuggee window.

Search ASCII/UTF-16 strings referenced by the current debuggee module. Uses x64dbg's strref view under the hood, then filters client-side. Returns deterministic pages of matches with module/RVA identity. ``detail=full`` adds scan diagnostics but does not bypass pagination.

Select one exact authenticated bridge instance for subsequent tools. At least one selector is required and the match must be unique. The descriptor PID, creation time, architecture, port and bridge UUID are revalidated against Bridge/Hello before the global MCP target changes.

Send one or more key presses/combinations to the current foreground window.

Type text into the current foreground window using WinAPI SendInput. Args: text: The text to type. submit: When true, also presses Enter after typing. delay_ms: Optional delay between characters in milliseconds. Returns: Dictionary with the target hwnd, pid, title, and the number of sent events.

Write text into the console input buffer of the debugged process. This works even when the console window is not focused. It is especially useful for console crackmes or CLI tools launched under x64dbg. Args: text: The text to inject into stdin. submit: When true, appends Enter to the injected input. pid: Optional debuggee PID. When omitted, the newest child process of x64dbg/x32dbg is used. Returns: Dictionary with the target PID, optional conhost PID, and written event count.

Focus the debuggee window (or its console host when applicable) and type text into it. Args: text: The text to type. submit: When true, also presses Enter after typing. delay_ms: Optional delay before focusing and between characters in milliseconds. pid: Optional debuggee PID. When omitted, the newest child process of x64dbg/x32dbg is used. Returns: Dictionary describing the targeted window and the sent input events.

Set a breakpoint, wait for it to hit, and capture structured context.

Set a breakpoint with a condition / log text / command hook. Args: addr: Breakpoint address. condition: Expression evaluated each hit. Example "rax==0xDEAD" — BP only fires when the condition is true. Leave empty for always-fire. log_text: Optional log template printed on hit (uses x64dbg {expr} syntax, e.g. "rax={rax}, [rsp+8]={[rsp+8]}"). Useful as tracepoint. command: Optional x64dbg command run on hit (e.g. "DebugRun" to auto-continue). name: Optional BP name. singleshot: If true, BP is removed after first hit. Returns {ok, addr, condition, logText…

Set text for a GUI control, typically an Edit control.

Compatibility adapter for the native session-scoped exception policy. Legacy ``skip`` maps to ``handled``, ``pass`` maps to ``not_handled``, and ``stop`` maps to ``pause``. Unlike the historical implementation, automatic disposition happens in the native exception callback and is therefore independent of WaitForPause/WaitForUserCode polling.

Atomically configure session-scoped first/second-chance exception policy. ``rules_json`` is a JSON rule object or array. Each rule accepts ``ruleId``, ``codes`` (exact codes, ``value/mask`` selectors, or ``*``), ``chance`` (first/second/any), ``action`` (pause/handled/not_handled), integer ``priority`` and boolean ``enabled``. Exact selectors outrank masked selectors, which outrank wildcard rules; priority breaks equal-specificity ties. The native bridge applies handled/not_handled policy directly from the exception callback, so it does not depend on an active WaitForPause call.

Set a hardware breakpoint at the specified address. Hardware breakpoints use CPU debug registers (limited to 4 simultaneous). Parameters: addr: Address to set the breakpoint at (hex format, e.g. "0x1400010a0") type: Breakpoint type - "execute" (default), "access" (read/write), or "write" (write only) Returns: Dictionary with success status and address

Set a native x64dbg breakpoint on an already-JIT/NGen managed method.

Set a memory-range breakpoint using native x64dbg memory breakpoint commands.

Set a memory watchpoint, wait for it to hit, and capture the causing instruction plus runtime context.

Set memory page protection rights at a given address Args: addr: Virtual address (hex string, e.g. "0x401000") rights: Rights string (e.g. "rwx", "rx", "rw") Returns: True if successful, False otherwise

Update the configured ScyllaHide profile for the selected debugger installation.

Set a thread's scheduling priority. Args: tid: Thread ID (decimal, as GetThreadList reports it, or 0x-hex). Required. priority: One of "Normal", "AboveNormal", "BelowNormal", "Highest", "Lowest", "Idle", "TimeCritical" (or an integer Windows priority value). Returns: Uniform action envelope: {"ok", "command", "success", "error"?}.

Set a UI Automation ValuePattern target.

Peek at stack value using Script API Parameters: offset: Stack offset (default: "0") Returns: Stack value in hex format

Pop value from stack using Script API Returns: Popped value in hex format

Push value to stack using Script API Parameters: value: Value to push (in hex format, e.g. "0x1000") Returns: Previous top value in hex format

Set up (but do not yet run) an API call trace session. Enumerates imports matching `filter_json` in `modules_json` and sets silent+continue-on-hit breakpoints on each target. Use RunApiTrace to drive the debuggee and collect calls. Args: modules_json: JSON array of module names (e.g. `["kernel32.dll","ws2_32.dll"]`). Empty → typical OS modules (kernel32/user32/advapi32/ws2_32/wininet/ntdll). filter_json: JSON array of substrings to match `module!func`. Empty → DEFAULT_API_FILTERS (file I/O, memory, process, net, crypto, etc.) custom_targets_json: Strict JSON array…

Start a heap/resource lifecycle session over Win32/NT heap, virtual memory, COM task memory, Local/Global, CRT and common MSVC new/delete families. Returns {ok, heapTraceId, apiTraceId}. The underlying machinery uses the API tracer — to drive it, call RunApiTrace(apiTraceId). Live heap state is exposed via GetHeapState(heapTraceId).

Arm the bridge's native ``CB_TRACEEXECUTE`` recorder. The recorder is bound to the exact guarded debug session and must be armed while the target is paused. ``instruction`` keeps the ordered CIP/thread tape, ``coverage`` keeps only address hit counts, and ``both`` keeps both. Optional ``range_start`` + ``range_size`` restrict evidence to one module or function while ``max_steps`` still bounds all executed trace steps.

Begin a full run trace to a reloadable .trace file (x64dbg 'StartRunTrace'). Records executed instructions plus register deltas as the target runs/steps — far richer than the in-memory bitmap coverage (StartTraceRecord) or the step-limited TraceInstructionTape. After starting, run or step the target, then call StopRunTrace to flush the file. Args: output_path: Destination trace file. If it has no extension, the correct '.trace64'/'.trace32' for the active arch is appended. Returns: {"ok", "output", "command", ...}. Requires an active, paused debug session.

Enable native instruction recording for the main module. The bridge keeps an enriched instruction tape and reconstructs basic blocks/edges from decoded branch boundaries. Legacy address-hit snapshots remain available through GetTraceRecord. Args: mode: "bitmap" (record unique addresses) or "hitcount" (addr → hits). label: Optional label for humans. max_steps: Hard native-instruction ceiling (1..10,000,000). stop_on_limit: Pause the target when the hard ceiling is reached. Returns {ok, traceId, nativeTraceId, mode, moduleBase, moduleSize, maxSteps}. Use RunTraceRecord to driv…

Step into the next instruction and return both step result and current instruction disassembly. Returns: Dictionary containing step result and current instruction info

Step once and capture before/after context snapshots.

Stop a running API trace and optionally delete its breakpoints.

Stop an armed native trace while preserving its retained evidence.

Stop the run trace started with StartRunTraceToFile and flush the .trace file to disk (x64dbg 'StopRunTrace'). Open the resulting file in x64dbg's Trace view to replay the recorded instructions and register history. Returns: {"ok", "command", "success", "error"?}.

Disable TraceRecord coverage (removes the memory BP).

Retrieve the string at a given address in the debugged process. Uses x64dbg's internal string detection (same as the disassembly view). Parameters: addr: Memory address (in hex format, e.g. "0x1400010a0") Returns: Dictionary with: - address: The queried address - found: Whether a string was detected at that address - string: The string content (empty if not found)

Populate an Edit control and click a Button in the debuggee GUI. Set verbose=True to include full pre/post GUI snapshots. Default False returns only the chosen controls, actions, and a compact summary.

Fill UI Automation value targets and invoke a likely submit element.

Summarize recent trace and breakpoint-capture history into a compact RE-oriented view.

Suspend every thread in the debuggee at once (freeze the target). Returns: Uniform action envelope: {"ok", "command", "success", "error"?}. Undo with ResumeAllThreads.

Suspend a thread in the debuggee (increments its Windows suspend count). Args: tid: Thread ID (decimal, as GetThreadList reports it, or 0x-prefixed hex). Empty string suspends the currently active thread. Returns: Uniform action envelope: {"ok", "command", "success", "error"?}. Undo with ResumeThread. Requires an active debug session.

Make the given thread the active/current thread so register reads/writes and stepping operate on it. Combine with RegisterSet to modify a specific thread's context (x64dbg has no single set-thread-context command). Args: tid: Thread ID (decimal, as GetThreadList reports it, or 0x-hex). Required. Returns: Uniform action envelope: {"ok", "command", "success", "error"?}.

Dry-run or apply enabled software breakpoints from static/runtime evidence.

One-shot API trace: configure, run for a short window, then remove breakpoints.

Record a compact per-instruction execution tape while stepping.

Start a step-INTO trace that runs until a break condition is true, optionally logging an expression at every traced step (x64dbg 'ticnd'). This is x64dbg's classic conditional trace: it single-steps INTO calls while the break condition is false and stops the moment it becomes true. Add a log expression to record register/memory state along the way, and a log file to persist it. Args: condition: x64dbg expression that stops the trace when non-zero, e.g. "eip==0x401000" or "eax==0". Required. log_text: Optional log format string evaluated each step and appended to …

Start a step-OVER trace that runs until a break condition is true, optionally logging an expression at every traced step (x64dbg 'tocnd'). Same as TraceIntoConditional but steps OVER calls instead of into them — use this to trace within the current function without descending into callees. Args: condition: x64dbg expression that stops the trace when non-zero. Required. log_text: Optional per-step log format string, e.g. "{eax} {ecx}". log_file: Optional path to also write the trace log to a file. max_steps: Optional cap on the number of steps (0 = configured maximum). Return…

Validate portable module-identity + RVA evidence without changing x64dbg.

Validate PE structure/imports and optionally run a bounded smoke process. The optional isolated run is placed in a kill-on-close Windows Job Object so descendants cannot outlive the validation. ``network_policy`` remains an explicit policy marker; this process-local harness does not pretend to be a firewall sandbox.

Validate live IAT descriptors, slot reads and target-module membership.

Independently validate an MDMP file and summarize streams/modules without loading it.

Validate a dumped PE structurally and reject corrupt/unresolved IAT output. When ``source_path`` is supplied, every source import must remain represented unless ``strict_source_imports`` is disabled. ``expected_entrypoint`` accepts an RVA or runtime VA (with ``module_base``) and is checked exactly.

Wait until a breakpoint is hit. Args: addr: Optional breakpoint address filter. name: Optional breakpoint name filter. timeout_ms: Maximum time to wait. poll_ms: Poll interval.

Wait for a breakpoint hit and capture structured context immediately after the stop.

Wait for a breakpoint and capture a structured stop snapshot: regs, stack, call stack, disasm.

Wait for a breakpoint and return the normalized event structure.

Wait for a likely child/descendant runtime process to appear after launch or during debugging.

Wait until the debuggee's GUI thread reaches an input-idle state.

Wait until a debuggee window matching the requested title/class appears.

Wait until a debuggee window both exists and becomes stable enough for automation.

Wait until the debuggee exits.

Wait until the foreground window changes.

Wait until the GUI changes compared to a previous snapshot.

Wait for a specific module/DLL to load, using session history plus the live module list.

Wait until the debuggee reaches a paused state or exits.

Progress through startup noise until execution reaches a useful runtime state. By default the helper auto-skips common first-chance startup exceptions such as the initial loader breakpoint (`0x80000003`) and WOW64 startup notifications (`0x4000001F` / `0x4000001E`).

Wait until the target window's visual content changes by a meaningful amount.

Wait for a native trace to finish without monopolizing the HTTP bridge.

Capture memory before and after one or more debugger steps and summarize byte-level changes.

Write one canonical-base64 chunk to a launch configured with stdin=pipe.

Write and verify a guarded process MiniDump from the active debug session. ``dump_type`` is normal, triage, analysis (recommended), full, or a numeric MINIDUMP_TYPE mask. ``custom_flags`` supplies an exact mask and overrides the preset. The native bridge requires a paused target for a coherent dump; this tool can pause it and only resumes when ``resume_after`` is explicit.

Get the count of cross-references to the specified address. This is a lightweight check that doesn't fetch the full reference list. Parameters: addr: Target address to count references for (hex format, e.g. "0x1400010a0") Returns: Dictionary with: - address: The queried address - count: Number of cross-references

Get all cross-references (xrefs) TO the specified address. Returns the list of addresses that reference the target address, along with the type of each reference (data, jmp, call). Note: Results depend on x64dbg's analysis database. Run analysis first for comprehensive results. Parameters: addr: Target address to find references to (hex format, e.g. "0x1400010a0") offset: Zero-based reference offset for compatibility pagination. limit: Maximum references to return (1..5000). detail: summary or full. Empty inherits the active tool profile. Returns: Dictionary with: - …