# AI use cases for X64 DBG MCP Server (duty1g/x64dbg-mcp-server) Repo: [duty1g/x64dbg-mcp-server](https://github.com/duty1g/x64dbg-mcp-server) | Use cases: 3 | Page: https://dedupedai.com/use-cases/duty1g-x64dbg-mcp-server/ A native Windows plugin for the x64dbg debugger that exposes its debugging functions as MCP tools over HTTP, so AI assistants can control the debugger. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Find the original entry point of a packed binary: https://dedupedai.com/use-cases/duty1g-x64dbg-mcp-server/find-original-entry-point-of-packed-binary/ - Step through a live process with an AI assistant: https://dedupedai.com/use-cases/duty1g-x64dbg-mcp-server/step-and-inspect-live-process-with-assistant/ - Triage a binary by strings, patterns, and references: https://dedupedai.com/use-cases/duty1g-x64dbg-mcp-server/triage-binary-strings-patterns-and-references/ ## How to find the original entry point of a packed binary with X64 DBG MCP Server Repo: [duty1g/x64dbg-mcp-server](https://github.com/duty1g/x64dbg-mcp-server) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Use an AI assistant to load a packed executable in x64dbg, detect its OEP, and dump the module to disk. **Who it is for:** A malware analyst or reverse engineer who has a packed executable and needs the unpacked code for static review. **The problem:** Packed executables hide their real code behind a loader, so manual unpacking in the debugger takes many steps and careful tracing. **The outcome:** The assistant reports the detected Original Entry Point and the path of a dumped module file that can be examined further. ### Steps 1. Build the plugin with `zig build -Doptimize=ReleaseSafe --prefix dist` or download the latest release. 2. Copy the contents of `dist/` into your x64dbg root folder. 3. Launch x64dbg. The MCP server starts automatically on `0.0.0.0:9094` for x64. 4. Copy the Bearer token from Plugins > x64dbg-MCP Server > Configure MCP Server... and add the Streamable HTTP config with the `Authorization` header to your MCP client config. 5. Ask the assistant to load the target, call DetectOEP, then call DumpModule. ### Prompt to paste into your agent ```text Using the x64dbg-MCP-Server MCP tools at http://localhost:9094/ with my Bearer token, load , call DetectOEP, then call DumpModule. Report the Original Entry Point address and the dump file path. Verify that the dump file exists on disk. ``` ### Caveat The README lists DetectOEP and DumpModule as tools, but it does not describe their output format, so check the returned values against the dump file. Risk, reverse engineering: Unpacking and dumping third-party executables should only be done with authorization and for lawful analysis. Risk, credentials: The Bearer token grants full debugger control, so keep it private and rotate it with Generate if it is exposed. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/duty1g-x64dbg-mcp-server/find-original-entry-point-of-packed-binary/ ## How to step through a live process with an AI assistant with X64 DBG MCP Server Repo: [duty1g/x64dbg-mcp-server](https://github.com/duty1g/x64dbg-mcp-server) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Set breakpoints, step through code, and read registers and memory by describing the goal in plain language. **Who it is for:** A reverse engineer who wants to hand routine stepping and register checks to an AI assistant while staying in control of the analysis. **The problem:** Repeating breakpoint setup, stepping, and register dumps by hand is slow when you are following one code path. **The outcome:** The assistant sets breakpoints, runs to them, and reports registers, the call stack, and the bytes at the current instruction. ### Steps 1. Build or download the plugin and copy `dist/` into your x64dbg root folder. 2. Launch x64dbg and open Plugins > x64dbg-MCP Server > Configure MCP Server... to confirm the bind address and port. 3. Add the `x64dbg` server entry to your MCP client config with the `Authorization: Bearer` header. 4. Ask the assistant to load a binary, set a breakpoint, run, and wait for the pause. 5. Ask for the registers, the call stack, and a memory read at the instruction pointer. ### Prompt to paste into your agent ```text Using the x64dbg-MCP-Server tools at http://localhost:9094/ with my Bearer token, load , set a breakpoint at
, run, and call WaitForPause. Then report GetAllRegisters and GetCallStack output. Verify that the reported instruction pointer matches the breakpoint address. ``` ### Caveat The README says the server has full debugger control, so only run it on a trusted machine and keep the default bind address unless you need remote access. Risk, reverse engineering: Controlling a live process's execution and memory should only be done on software you are authorized to analyze. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/duty1g-x64dbg-mcp-server/step-and-inspect-live-process-with-assistant/ ## How to triage a binary by strings, patterns, and references with X64 DBG MCP Server Repo: [duty1g/x64dbg-mcp-server](https://github.com/duty1g/x64dbg-mcp-server) | Difficulty: Advanced | Time: 60 minutes | Basis: From the README Use an AI assistant to scan a loaded module for strings, byte patterns, and call or jump references. **Who it is for:** A security researcher who needs a fast first pass over an unfamiliar module before choosing where to debug. **The problem:** Finding interesting strings, byte sequences, and callers across a module by hand takes time, especially in unfamiliar code. **The outcome:** The assistant returns matching strings, pattern hits, and xrefs to a target address, which helps you choose breakpoints and functions to study. ### Steps 1. Build or download the plugin and copy `dist/` into your x64dbg root folder. 2. Launch x64dbg and load the target so the module is in memory. 3. Add the MCP server entry to your client config with the Bearer token. 4. Ask the assistant to run GetStrings, FindPattern with ?? wildcards, and GetReferences on an address of interest. 5. Ask for GetFunctions to map the results to analyzed functions. ### Prompt to paste into your agent ```text Using the x64dbg-MCP-Server tools at http://localhost:9094/ with my Bearer token, run GetStrings and FindPattern with ?? wildcards on , then GetReferences for . Report the matching strings, pattern hits, and callers. Verify that each reported address falls inside the module range from ListModules. ``` ### Caveat The README describes these tools by name and short summary only, so confirm the output format for GetStrings and FindPattern on your own target before relying on it. Risk, reverse engineering: Triage of malware or proprietary binaries should follow your organization's authorization and handling rules. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/duty1g-x64dbg-mcp-server/triage-binary-strings-patterns-and-references/