Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add meltedinhex/analyst-ai-pack --skill debugging-malware-with-x64dbggit clone --depth 1 https://github.com/meltedinhex/analyst-ai-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/meltedinhex/analyst-ai-pack/debugging-malware-with-x64dbg)<a href="https://agentmods.dev/skills/meltedinhex/analyst-ai-pack/debugging-malware-with-x64dbg"><img src="https://agentmods.dev/badge/skills/meltedinhex/analyst-ai-pack/debugging-malware-with-x64dbg.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.00916 |
| Opus 5 | $0.00037 | $0.00458 |
| Sonnet 5 | $0.00015 | $0.00183 |
| Haiku 4.5 | $0.00007 | $0.00092 |
Grade A, and why
debugging-malware-with-x64dbg scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Debugging Malware with x64dbg
When to Use
- You need to observe a sample's runtime behavior at the instruction level on Windows.
- You are manually unpacking, decrypting strings, or reaching code guarded by anti-analysis.
- You want to dump a payload from memory after it is decoded but before it is hidden.
Do not use a debugger on a host you care about — debug only inside the isolated victim VM, and revert the snapshot after.
Prerequisites
- x64dbg (and the matching x32/x64 build for the sample's bitness) inside the victim VM.
- A clean snapshot; the lab's simulated internet.
- Familiarity with Windows APIs commonly used by malware.
Safety & Handling
- The sample executes under the debugger; this is detonation. Stay in the isolated VM.
- Revert the snapshot after the session; treat memory dumps as live samples.
Workflow
Step 1: Set strategic API breakpoints
Rather than stepping from the entry point, break on APIs that mark interesting moments:
VirtualAlloc / VirtualProtect -> unpacking buffer about to be written/executed
CreateProcessInternalW -> process hollowing target
WriteProcessMemory -> injection payload in a register/buffer
CryptDecrypt / lstrcpy -> decoded data available
ResumeThread -> hollowed process about to run
Use bp VirtualAlloc then inspect the return value (allocated base) on return.
Step 2: Step through unpacking
Run to the allocation, set a memory breakpoint on the new region, and continue until the unpacker writes and jumps to it. The tail jump to OEP marks the unpacked entry.
Step 3: Dump at the right moment
When the payload is decoded in memory (e.g. after VirtualProtect makes it executable), dump
the region with Scylla/the dump plugin and fix the import table for the unpacked PE.
Step 4: Defeat simple anti-debugging
Patch or skip checks like IsDebuggerPresent, PEB BeingDebugged, and timing checks (see the
anti-debugging skill). Set the return value to evade detection rather than removing the call.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 112 lines · 75 tokens per session scan A e2c8ff91c78c
debugging-malware-with-x64dbg is a skill published in the GitHub repository meltedinhex/analyst-ai-pack (22 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 75 tokens to every session and 916 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware…
analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF…
analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.
analyzing-malicious-pdf-with-peepdf
A Chinese-language skill for examining suspicious PDF files with peepdf, pdfid, and pdf-parser. It is intended for static malware analysis, which studies a file without running it.
analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.