Diff register and memory changes from before/after state snapshots.
npx skills add https://github.com/dariushoule/x64dbg-skills --skill state-diff
Please help me install this Agent Skill. Skill: state-diff Source: https://github.com/dariushoule/x64dbg-skills/tree/main/skills/state-diff Command: npx skills add https://github.com/dariushoule/x64dbg-skills --skill state-diff
Diff two debuggee state snapshots to identify register and memory changes between two points in time, enabling precise post-mortem analysis and debugging.
Run the state-diff tool to compare two captured snapshots and generate diff_report.json.
High-intent search queries and answers about installing and using this skill.
Diffing debuggee state snapshots requires reading registers.json and memory_map.json from before and after directories. The tool computes per-register differences and detects added, removed, resized, or modified memory regions to pinpoint changes between two points in time.
Detecting added or resized memory regions during malware analysis is done by diffing before and after memory maps. This approach identifies byte-level memory modifications, generating a structured diff_report.json with a summary of all memory region alterations.
Comparing registers.json files involves reading the captured register states from two separate snapshot directories. The tool computes the exact per-register differences between the before and after states, outputting the results into a structured diff_report.json.
Memory map diffing is highly effective for post-mortem debugging and forensic analysis. By comparing two captured snapshots, it detects byte-level memory changes and generates a narrative summary to support reverse engineering and precise forensic investigations.
Running a state snapshot diff requires capturing registers.json and memory_map.json files. You must save these files into separate before and after directories to ensure the tool can accurately read and compare the two debuggee states.
dariushouleCapture committed memory regions and processor state from x64dbg sessions.
salmanabdurrahmanAnalyze RAM images for malicious activity and process anomalies.
anouar1991Detect frontend frameworks and snapshot component state for diffing.
AlexZio00Audit codebase, docs, and config areas with Python scripts and manual review.
