Agent skill

State Snapshot

by dariushoule in dariushoule/x64dbg-skills

Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis

MITAuto-check: notes

Install State Snapshot

skills CLI
$ npx skills add dariushoule/x64dbg-skills --skill state-snapshot -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install dariushoule/x64dbg-skills state-snapshot --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/dariushoule/x64dbg-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/state-snapshot .claude/skills/state-snapshot && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
state-snapshot
GitHub stars
209
Token cost
~526 tokens
SKILL.md length
243 words
Files
2
Skills in repo
7
Repo updated
First seen
Licence
MIT

At a glance

Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis

  • Works in 6 steps: Verify debugger connection → Pause the debuggee if running → Disconnect the MCP client → …
  • Tasks that involve MCP servers
  • Runs Python scripts from its folder; calls python

What it does

State Snapshot is an agent skill from dariushoule/x64dbg-skills. Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis

Its SKILL.md is about 530 tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `state_snapshot.py`).

It works with Model Context Protocol. The repository describes itself as: Claude Code plugin providing skills for x64dbg debugger automation. The licence is MIT.

When your agent uses it

  • Tasks that involve MCP servers

Example prompts

  • “/state-snapshot”

Requirements

  • Python 3
  • Pre-approved tools (allowed-tools): mcp__x64dbg__get_debugger_status, mcp__x64dbg__pause, mcp__x64dbg__disconnect, mcp__x64dbg__connect_to_session, mcp__x64dbg__go, Bash

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Verify debugger connection
  2. Pause the debuggee if running
  3. Disconnect the MCP client
  4. Run the snapshot script
  5. Reconnect the MCP client
  6. Report results

What it can do on your machine

Read from SKILL.md and the folder at commit 0409f53. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • mcp__x64dbg__get_debugger_status
    • mcp__x64dbg__pause
    • mcp__x64dbg__disconnect
    • mcp__x64dbg__connect_to_session
    • mcp__x64dbg__go
    • Bash

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships script files (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

State Snapshot loads about 526 tokens when it runs. Until then it costs about 33 tokens; SKILL.md has 243 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~33
When it runs · the whole SKILL.md, loaded when a task matches
~526

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: mcp__x64dbg__get_debugger_status, mcp__x64dbg__pause, mcp__x64dbg__disconnect, mcp__x64dbg__connect_

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from dariushoule/x64dbg-skills at commit 0409f53, republished under its MIT licence (© dariushoule). 243 words, ~526 tokens.

Download SKILL.mdSave it as .claude/skills/state-snapshot/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
state-snapshot
description
Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis
allowed-tools
mcp__x64dbg__get_debugger_status, mcp__x64dbg__pause, mcp__x64dbg__disconnect, mcp__x64dbg__connect_to_session, mcp__x64dbg__go, Bash

state-snapshot

Capture a full debuggee state snapshot — all committed memory regions as raw binary files plus the complete processor state as JSON.

Instructions

Follow these steps exactly:

1. Verify debugger connection

Call mcp__x64dbg__get_debugger_status to confirm the debugger is connected and a debuggee is loaded. Note the session PID and x64dbg path from the current MCP connection — you will need these to reconnect later.

If no debuggee is loaded, tell the user and stop.

2. Pause the debuggee if running

If the debugger status shows the debuggee is running (not paused), call mcp__x64dbg__pause to pause it. Remember that you auto-paused so you can resume later.

3. Disconnect the MCP client

Call mcp__x64dbg__disconnect to release the ZMQ connection. This is required because only one client can be connected to an x64dbg session at a time, and the Python script needs its own connection.

4. Run the snapshot script

Execute the snapshot script:

python "${CLAUDE_PLUGIN_ROOT}\skills\state-snapshot\state_snapshot.py" --x64dbg-path "<x64dbg_path>" --pid <session_pid>

Where:

  • <x64dbg_path> is the path to the x64dbg executable noted in step 1
  • <session_pid> is the debugger process PID noted in step 1

The script defaults output to ./snapshots/<timestamp>/. If the user specified a custom output directory, pass --output-dir <path>.

5. Reconnect the MCP client

Call mcp__x64dbg__connect_to_session with the x64dbg path and session PID saved from step 1 to restore the MCP connection.

6. Report results

Summarize what was captured:

  • Output directory path
  • Number of memory region files saved and total size
  • Whether registers were captured successfully
  • Any regions that failed to read

© dariushoule, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/state-snapshot of dariushoule/x64dbg-skills.

  • SKILL.md
  • state_snapshot.py

Open the folder on GitHubat commit 0409f53

Compare with similar skills

State Snapshot next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

State Snapshot compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
State Snapshot this skilldariushoule/x64dbg-skills209—~526Automated safety check: NotesMIT
MCP Server Builderanthropics/skills180k63 repos~2.3kAutomated safety check: PassApache-2.0
MCP Server BuildershareAI-lab/learn-claude-code78k5 repos~1.2kAutomated safety check: PassMIT
MCP Integration for Pluginsanthropics/claude-plugins-official38k11 repos~3.1kAutomated safety check: PassApache-2.0
MCP Developmentcoollabsio/coolify63k1 repos~949Automated safety check: PassMIT
Analyze Logsactivepieces/activepieces25k1 repos~1.6kAutomated safety check: PassMIT

Similar skills

  • MCP Server Builder

    anthropics/skills

    Official

    Guides the design and implementation of Model Context Protocol servers in TypeScript or Python, from tool naming and error messages to evaluation.

    180k GitHub starsUsed in 63 repos~2.3k tokens
    Agent WorkflowsAuto-check passed
  • MCP Server Builder

    shareAI-lab/learn-claude-code

    Walks through building MCP servers in Python or TypeScript that expose tools, resources and prompts to Claude, with templates, registration and testing.

    78k GitHub starsUsed in 5 repos~1.2k tokens
    Agent WorkflowsAuto-check passed
  • MCP Integration for Plugins

    anthropics/claude-plugins-official

    Official

    Explains how to bundle Model Context Protocol servers in a Claude Code plugin, covering config files, stdio, SSE, HTTP and WebSocket server types, and authentication.

    38k GitHub starsUsed in 11 repos~3.1k tokens
    Agent WorkflowsAuto-check passed
  • MCP Development

    coollabsio/coolify

    A skill your agent uses for Laravel MCP development. An agent skill from coollabsio/coolify.

    63k GitHub starsUsed in 1 repo~949 tokens
    Frontend & DesignAuto-check passed
  • Analyze Logs

    activepieces/activepieces

    Analyze application logs from the .evlog/logs/ directory. An agent skill from activepieces/activepieces.

    25k GitHub starsUsed in 1 repo~1.6k tokens
    DevelopmentAuto-check passed
  • Composio

    ComposioHQ/composio

    Route and complete Composio work across Composio For You and Composio Platform.

    30k GitHub starsUsed in 1 repo~1.7k tokens
    Productivity & AutomationAuto-check passed

More from dariushoule/x64dbg-skills

  • Decompile

    dariushoule/x64dbg-skills

    Decompile a function to C-like pseudocode using angr. An agent skill from dariushoule/x64dbg-skills.

    209 GitHub stars~626 tokensUpdated 6 mo ago
    Auto-check: notes
  • State Diff

    dariushoule/x64dbg-skills

    Compare two state snapshots to identify register and memory changes between two points in time

    209 GitHub stars~594 tokensUpdated 6 mo ago
    Auto-check: notes
  • Tracealyzer

    dariushoule/x64dbg-skills

    Trace execution (into or over calls) for N steps or until a condition, then analyze the recorded instruction log

    209 GitHub stars~1k tokensUpdated 6 mo ago
    Auto-check: notes
  • Vuln Hunter

    dariushoule/x64dbg-skills

    Hunt for vulnerabilities in a running debuggee by analyzing imports/exports, triaging attack surface, and iteratively testing for bugs with PoC generation.

    209 GitHub stars~3.9k tokensUpdated 6 mo ago
    Auto-check: notes
  • Yara Sigs

    dariushoule/x64dbg-skills

    Scan a state snapshot's memory dumps with YARA signatures to detect packers, crypto constants, malware, and more

    209 GitHub stars~1.1k tokensUpdated 6 mo ago
    Auto-check: notes
  • Find Oep

    dariushoule/x64dbg-skills

    Smart trace-based OEP finder for packed/protected PE executables.

    209 GitHub stars~2.5k tokensUpdated 6 mo ago
    Auto-check: notes

Questions about State Snapshot

What does State Snapshot do?

Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis. State Snapshot is an agent skill from dariushoule/x64dbg-skills.

When should I use State Snapshot?

State Snapshot fits situations like: tasks that involve MCP servers.

How do I install State Snapshot in Claude Code?

Run `npx skills add dariushoule/x64dbg-skills --skill state-snapshot -a claude-code`. Or copy the skill folder (skills/state-snapshot in dariushoule/x64dbg-skills) into .claude/skills/state-snapshot in your project. Claude Code loads it when a task matches its description.

How do I install State Snapshot in Codex?

Run `npx skills add dariushoule/x64dbg-skills --skill state-snapshot -a codex`. Or copy the skill folder (skills/state-snapshot in dariushoule/x64dbg-skills) into .agents/skills/state-snapshot in your project. Codex loads it when a task matches its description.

Can I use State Snapshot in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add dariushoule/x64dbg-skills --skill state-snapshot -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/state-snapshot, .gemini/skills/state-snapshot, .github/skills/state-snapshot and .opencode/skills/state-snapshot in your project.

What does State Snapshot need to run?

Going by SKILL.md and its folder, State Snapshot needs Python for the scripts in its folder and the command-line tools its instructions call (python). Our summary lists: Python 3. Its frontmatter pre-approves these tools: mcp__x64dbg__get_debugger_status, mcp__x64dbg__pause, mcp__x64dbg__disconnect, mcp__x64dbg__connect_to_session, mcp__x64dbg__go, Bash.

Does State Snapshot access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is State Snapshot safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does State Snapshot use?

State Snapshot is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does State Snapshot use?

About 526 tokens (SKILL.md is roughly 2.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to State Snapshot?

Skills that share tags, products or a category with State Snapshot: MCP Server Builder (anthropics/skills, 180k stars), MCP Server Builder (shareAI-lab/learn-claude-code, 78k stars), MCP Integration for Plugins (anthropics/claude-plugins-official, 38k stars) and MCP Development (coollabsio/coolify, 63k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains State Snapshot?

dariushoule (a GitHub user) maintains it in dariushoule/x64dbg-skills, which has 209 GitHub stars. The repository holds 7 skills in this directory. The repository was last updated on March 13, 2026.

Source: dariushoule/x64dbg-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.