agentsclimarketplace

Debugging malware with x64dbg

Skill meltedinhex/analyst-ai-pack/skills/debugging-malware-with-x64dbg

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill debugging-malware-with-x64dbg

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints on APIs, stepping through unpacking and decryption, dumping memory at the right moment, and manipulating execution to reach hidden code. Activates for requests to debug malware with x64dbg, set API breakpoints, or step through unpacking in a debugger.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.8 KB, 672 tokens by cl100k_base, as published. Nobody here has run it

Debugging Malware with x64dbg

When to Use

  • You need to observe a sample's runtime behavior at the instruction level on Windows.
  • You are manually unpacking, decrypting strings, or reaching code guarded by anti-analysis.
  • You want to dump a payload from memory after it is decoded but before it is hidden.

Do not use a debugger on a host you care about — debug only inside the isolated victim VM, and revert the snapshot after.

Prerequisites

  • x64dbg (and the matching x32/x64 build for the sample's bitness) inside the victim VM.
  • A clean snapshot; the lab's simulated internet.
  • Familiarity with Windows APIs commonly used by malware.

Safety & Handling

  • The sample executes under the debugger; this is detonation. Stay in the isolated VM.
  • Revert the snapshot after the session; treat memory dumps as live samples.

Workflow

Step 1: Set strategic API breakpoints

Rather than stepping from the entry point, break on APIs that mark interesting moments:

VirtualAlloc / VirtualProtect  -> unpacking buffer about to be written/executed
CreateProcessInternalW         -> process hollowing target
WriteProcessMemory             -> injection payload in a register/buffer
CryptDecrypt / lstrcpy         -> decoded data available
ResumeThread                   -> hollowed process about to run

Use bp VirtualAlloc then inspect the return value (allocated base) on return.

Step 2: Step through unpacking

Run to the allocation, set a memory breakpoint on the new region, and continue until the unpacker writes and jumps to it. The tail jump to OEP marks the unpacked entry.

Step 3: Dump at the right moment

When the payload is decoded in memory (e.g. after VirtualProtect makes it executable), dump the region with Scylla/the dump plugin and fix the import table for the unpacked PE.

Step 4: Defeat simple anti-debugging

Patch or skip checks like IsDebuggerPresent, PEB BeingDebugged, and timing checks (see the anti-debugging skill). Set the return value to evade detection rather than removing the call.

Step 5: Record breakpoints and notes

Save a breakpoint plan and observations. The bundled script generates an x64dbg command script of API breakpoints to bootstrap a session.

python scripts/analyst.py breakpoints --preset unpacking > bp.txt

Validation

  • The dumped region is a valid PE (MZ/PE headers) and disassembles to real code.
  • API breakpoints fire in an order consistent with unpacking/injection.
  • Patched anti-debug checks no longer alter the execution path.

Pitfalls

  • Stepping blindly from the entry point instead of using API breakpoints — slow and easy to get lost.
  • Dumping too early (still encrypted) or too late (already executed/freed).
  • Removing anti-debug calls entirely, which can break control flow; prefer faking the result.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.