Can it detect changes in dynamic memory?

Yes, it compares memory regions to identify modifications in the heap, stack, and loaded modules, highlighting specific byte patterns.

What do I need to use the state-diff skill?

You need at least two state snapshots captured using the /state-snapshot command from the x64dbg-skills repository.

Does it require external tools?

It utilizes a Python script included in the plugin root to perform the heavy lifting of the snapshot comparison.

How does the skill explain the differences?

It synthesizes register and memory data to provide a plain-English explanation, such as identifying when a function has allocated local variables or modified a return value.

Which registers are included in the comparison?

The skill tracks all major CPU registers including instruction pointers (RIP/EIP), stack pointers (RSP/ESP), general-purpose registers, and flag changes.

x64dbg State Differential Analysis

Name: x64dbg State Differential Analysis
Author: dariushoule

bydariushoule

•

Security & Testing

Identifies and interprets register and memory changes between two x64dbg debugger snapshots to provide a detailed narrative of program behavior.

The state-diff skill provides deep visibility into program execution by comparing two distinct debuggee snapshots captured within x64dbg. It automatically identifies modifications to CPU registers, stack growth, heap allocations, and memory mutations, then synthesizes these data points into a coherent narrative. This is essential for reverse engineers, security researchers, and developers who need to understand exactly how a specific function call or block of code altered the system state between two execution points, removing the manual effort of hex-level comparison.

Key Features

01Detailed memory region delta analysis for stack, heap, and image segments

02Structured JSON report generation for auditing and further automated analysis

03Automated comparison of CPU register values including RIP, RSP, and RAX

0457 GitHub stars

05Python-powered diff engine for processing complex debuggee state snapshots

06Contextual reasoning to explain the semantic meaning of identified state changes

Use Cases

01Analyzing control flow transitions and stack frame modifications during malware analysis

02Tracking memory corruption or unexpected variable mutations between breakpoints

03Identifying side effects and return values of specific function calls during reverse engineering

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dariushoule/x64dbg-skills state-diff

For use in Claude.ai and ChatGPT

Download Skill