Xhuma Umsizi we-AI ku-x64dbg usebenzisa i-x64dbg-MCP Server

Uyini i-x64dbg-MCP Server?

I-x64dbg-MCP Server iyi-plugin yomdabu ye-Model Context Protocol ye-x64dbg. Iveza imisebenzi ye-x64dbg nge-JSON-RPC nge-HTTP, okwenza umsizi we-AI ohambisana ne-MCP akwazi ukulawula izikhathi zokudebug-a ngokohlelo.

Umsizi angalayisha noma axhume kwinqubo, abeke ama-breakpoint, adlule emiyalweni ngesinyathelo, ahlole ama-register, afunde futhi alungise inkumbulo, ahlole ama-module nama-thread, akhiphe ama-string, alandele izinkomba, ahlaziye izakhiwo ze-PE, futhi enze eminye imisebenzi eminingi ye-reverse engineering.

I-plugin ibhalwe nge-Zig futhi isebenza ngqo ngaphakathi kwe-x64dbg. Ayidingi i-Python, i-.NET, noma i-runtime ehlukile. Isekela ukucaciswa kwe-MCP 2024-11-05 nge-Streamable HTTP kanye nama-transport e-SSE ayifa.

Sebenzisa le software kuphela ku-reverse engineering esemthethweni, ekuhlaziyeni i-malware, ocwaningweni lwezokuphepha, kwezemfundo, noma komunye umsebenzi ogunyazwe ngokusobala.

Izici Ezibalulekile

• Ukulawula okubanzi kwe-debugger: Amathuluzi ahlanganisa i-disassembly, ukusebenzisa, ama-breakpoint, ama-register, inkumbulo, ama-module, ama-thread, ama-call stack, ama-symbol, izinkomba, ukuhlaziywa kwe-PE, i-tracing, i-dumping, ukuhlolwa kwe-PEB, nokunye.
• Ukurekhodwa kwemicimbi ye-debugger: I-plugin irekhoda imicimbi ehlanganisa ukuqaliswa, ukumiswa, ama-breakpoint, ama-exception, ukwenza ngesinyathelo, ukuxhunywa kwenqubo, umsebenzi wama-DLL, nomsebenzi wama-thread.
• Ukufakwa komdabu: I-plugin ayinakho ukuncika ku-runtime noma ku-framework yangaphandle.
• Ukusekelwa kwe-x32 ne-x64: I-codebase eyodwa yakha ama-plugin azo zombili izinhlobo ze-x64dbg.
• Ama-transport amabili e-MCP: I-Streamable HTTP iyanconywa, kanti i-SSE isekela amaklayenti e-MCP ayifa.
• Ukuqinisekiswa okuyimpoqo: Zonke izicelo kufanele ziphathe i-Bearer token evumelekile.
• Ukuqalisa okuzenzakalelayo: Iseva iqala lapho i-x64dbg iqala.
• Ukulungiselelwa okwakhelwe ngaphakathi: Imenyu ye-x64dbg Plugins inezilungiselelo zekheli lokubopha, i-port, ne-token.
• Ukuhlanganisa ezinkundleni ezahlukene: I-Zig ingakha ama-plugin e-Windows kusuka ku-Windows, WSL, Linux, noma macOS.

Indlela Ukuhlanganiswa Okusebenza Ngayo

Lapho i-x64dbg iqala, i-plugin ithola ama-symbol e-debugger API ku-x64bridge.dll naku-x64dbg.dll. Bese iqala iseva ye-HTTP ku-thread esebenza ngemuva. Iklayenti le-MCP lithumela izicelo ze-JSON-RPC eziqinisekisiwe, futhi ithuluzi ngalinye le-MCP lihambisana nezingcingo ze-x64dbg SDK, njengokusetha i-breakpoint, ukufunda inkumbulo, noma ukuqhubeka nokusebenza.

Ngenxa yokuthi i-plugin isebenza ngaphakathi kwenqubo ye-x64dbg, ixhumana ngqo ne-debugger API. Akudingeki inqubo yomsizi yangaphandle noma isevisi yokupoll-a.

Faka i-Plugin

Inketho 1: Faka i-Release

1. Landa iphakheji yakamuva kuma-GitHub releases ephrojekthi.
2. Khipha okuqukethwe kwephakheji.
3. Kopisha okuqukethwe komkhombandlela wayo we-dist/ uye kumkhombandlela oyimpande wokufakwa kwe-x64dbg.
4. Qalisa uhlelo lwe-x32 noma lwe-x64 lwe-x64dbg.

Ukusatshalaliswa kulandela isakhiwo semikhombandlela ye-x64dbg, ngakho ukukukopisha empandeni kufaka womabili ama-plugin aqondene nohlobo lwe-architecture:

dist/
├── x32/
│   └── plugins/
│       └── x64dbg-MCP-Server.dp32
└── x64/
    └── plugins/
        └── x64dbg-MCP-Server.dp64

Iseva iqala ngokuzenzakalelayo. Ama-port ayo azenzakalelayo yilawa:

• x64: 0.0.0.0:9094
• x32: 0.0.0.0:9095

Inketho 2: Yakha Kusuka Kukhodi Yomthombo

Ukwakha kudinga i-Zig 0.16-dev noma entsha. Usuka empandeni ye-repository, sebenzisa:

zig build -Doptimize=ReleaseSafe --prefix dist

Umyalo udala amafayela womabili ama-plugin e-x32 ne-x64 ngaphansi kwe-dist/. Kopisha okuqukethwe kwalowo mkhombandlela uye kufolda eyimpande ye-x64dbg njengoba ubungenza ngephakheji ye-release.

Lungiselela Iseva Nokuqinisekiswa

Ku-x64dbg, vula Plugins > x64dbg-MCP Server > Configure MCP Server.... Ibhokisi lengxoxo likuvumela ukuba ushintshe ikheli lokubopha, i-port, ne-token yokuqinisekisa.

• Sebenzisa 127.0.0.1 lapho iklayenti le-MCP lisebenza ohlelweni olufanayo lwe-Windows futhi ukufinyelela okukude kungadingeki.
• Sebenzisa 0.0.0.0 lapho uxhuma usuka ku-WSL noma komunye umshini okufanele ufinyelele umsingathi ngenethiwekhi.
• Khetha Copy ukuze ukopishe i-token yamanje.
• Khetha Generate ukuze ushintshe i-token.

I-Bearer token ikhiqizwa ngokuzenzakalelayo ekuqaliseni kokuqala. Izicelo ezingenayo i-token efanele zithola 401 Unauthorized. Izinguquko ezigciniwe zisebenza ngokushesha ngoba iseva iqala kabusha ngokuzenzakalelayo. Ukulungiselelwa kugcinwa ku-mcp_config.json eduze kwe-executable ye-x64dbg.

Iseva inikeza ukufinyelela kokufunda nokubhala inkumbulo, ukulawula izinqubo, nokusebenzisa imiyalo ye-debugger nge-HTTP engabetheliwe. Ungayivezi kunethiwekhi engathenjwa, nakuba ukuqinisekiswa kwe-Bearer kuyimpoqo.

Xhuma Iklayenti le-MCP

Ukulungiselelwa Okunconywayo kwe-Streamable HTTP

Faka okufakiwe kweseva ekulungiselelweni kweklayenti lakho le-MCP, njenge-.mcp.json. Ku-port ye-x64 ezenzakalelayo, sebenzisa:

{
  "mcpServers": {
    "x64dbg": {
      "type": "http",
      "url": "http://localhost:9094/",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

Shintsha i-YOUR_TOKEN_HERE ufake i-token ekopishwe ebhokisini lokulungiselela le-plugin. Uma usebenzisa i-x32dbg, shintsha i-port ezenzakalelayo ibe ngu-9095.

Ukulungiselela i-SSE Kumaklayenti Amadala

Uma iklayenti lakho le-MCP lisekela i-SSE kuphela, khetha ezokuthutha sse bese wengeza /sse ekugcineni kwe-endpoint:

{
  "mcpServers": {
    "x64dbg": {
      "type": "sse",
      "url": "http://localhost:9094/sse",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

Uma usebenzisa i-WSL noma ukufinyelela okukude, shintsha i-localhost ufake ikheli le-IP lekhompyutha ephethe i-Windows, futhi uqinisekise ukuthi iseva iboshelwe ku-0.0.0.0.

Qalisa Iseshini Eyisisekelo Yokulungisa Amaphutha Esekelwa yi-AI

Ngemva kokuxhuma iklayenti, vula i-x64dbg bese ucela umsizi ukuthi enze uchungechunge oluncane lwemisebenzi yokulungisa amaphutha. Iseshini ejwayelekile ingaqala kanje:

Layisha i-calc.exe bese ume endaweni yokuqala yokungena.

Umsizi angahlanganisa i-LoadBinary, i-SetBreakpoint, i-run, kanye ne-WaitForPause ukuze alayishe okusebenzisekayo, aqhubeke nokusebenza, futhi alinde kuze kufinyelelwe endaweni yokumisa.

Hlola Ama-Register

Uma okuqondiwe sekumisiwe, buza:

Ngibonise ama-register amanje e-CPU.

Umsizi angabiza i-GetAllRegisters. Ukuze ushintshe inani phakathi neseshini yokulungisa amaphutha egunyaziwe, angasebenzisa i-SetRegister.

Funda Futhi Uhlukanise Imiyalelo Yenkumbulo

Buza umsizi ukuthi ahlole ikhodi ezungeze i-instruction pointer yamanje:

Funda amabhayithi angu-64 ku-instruction pointer yamanje bese uhlukanisa imiyalelo engu-10 elandelayo.

Lokhu kungasebenzisa i-GetCurrentAddress, i-ReadMemory, kanye ne-Disassemble. Ukuze uhlole umsebenzi ophelele ohlaziyiwe, cela i-DisassembleFunction.

Landela Ikhodi Isinyathelo Ngesinyathelo

Amathuluzi okusebenzisa ahambisana nezenzo ezijwayelekile ze-x64dbg:

• I-StepInto ingena kumakholi njenge-F7.
• I-StepOver yeqa amakholi njenge-F8.
• I-StepOut iyaqhubeka kuze kubuye umsebenzi wamanje.
• I-run iqhubekisela phambili ukusebenza njenge-F9.
• I-PauseDebug imisa okuqondiwe.
• I-RunToAddress iyaqhubeka kuze kufinyelelwe ekhelini elishiwo.

Isibonelo:

Yeqa imiyalelo emithathu elandelayo, bese ungibonisa ikheli lamanje nesitaki samakholi.

Umsizi angabiza i-StepOver kathathu, alandelwe yi-GetCurrentAddress kanye ne-GetCallStack.

Sebenzisa Izindawo Zokumisa Ngempumelelo

I-plugin isekela izindawo zokumisa ezijwayelekile zesofthiwe, izindawo zokumisa zehadiwe, izindawo zokumisa zenkumbulo, izindawo zokumisa ezinemibandela, nezindawo zokumisa ezihlobene nama-exception.

Isibonelo Sendawo Yokumisa Enemibandela

Setha indawo yokumisa kumsebenzi oqondiwe, kodwa ume kuphela uma umbandela we-x64dbg oshiwo uyiqiniso.

Umsizi angasebenzisa i-SetConditionalBreakpoint enenkulumo yombandela ye-x64dbg kanye nesenzo sokuloga esingakhethwa. Amathuluzi ahlobene angavula, avale, aguqule, asuse, noma asethe kabusha inani lokushaywa kwendawo yokumisa.

Izindawo Zokumisa Zehadiwe Nezenkumbulo

Sebenzisa i-SetHardwareBreakpoint ukuqapha ukufunda, ukubhala, noma ukwenza ngokusebenzisa ama-debug register atholakalayo. Sebenzisa i-SetMemoryBreakpoint lapho ukuqapha ukufunda, ukubhala, noma ukwenza ezingeni lekhasi kufaneleka kangcono uphenyo.

Ngaphambi kokudala ezinye izindawo zokumisa, cela umsizi abize i-ListBreakpoints. Lokhu kusiza ukugwema isimo esiphindaphindiwe noma esiphikisanayo se-debugger.

Hlaziya Amamojuli, Izimpawu, Nezinkomba

Iseva inikeza amathuluzi amaningi okusuka ekulungiseni amaphutha ezingeni eliphansi uye ekuhlaziyweni okubanzi kohlelo:

• I-ListModules ibika amamojuli alayishiwe, amakheli esisekelo, namasayizi.
• I-AnalyzeModule ihlola izigaba ze-PE, indawo yokuqala yokungena, nosayizi wesithombe.
• I-GetImports ne-GetExports zihlola amathebula okungenisa nokuthekelisa.
• I-SearchSymbols ithola izimpawu ezihambisana nephethini.
• I-GetFunctions ibala imisebenzi namalebula ahlaziyiwe.
• I-GetReferences ithola izinkomba ze-CALL ne-JMP eziya ekhelini eliqondiwe.
• I-FindPattern iskena inkumbulo yemojuli futhi isekela ama-wildcard e-??.
• I-GetStrings ikhipha amayunithi ezinhlamvu e-ASCII enkumbulweni yemojuli.
• I-DetectOEP isiza ukuthola indawo yokuqala yokungena yoqobo yezinto ezisebenzisekayo ezipakiwe.

Isicelo esisebenzayo sokuhlaziya singaba:

Bala amamojuli alayishiwe, hlaziya okusebenzisekayo okuyinhloko, khipha amayunithi ezinhlamvu e-ASCII, bese ubonisa izinkomba eziya emsebenzini okhethiwe.

Amathiphu Athuthukile

Sebenzisa Ukugeleza Komsebenzi Okuqaphela Imicimbi

Gwema ukucabanga ukuthi okuqondiwe kumile ngokushesha ngemva kokuqhubeka nokusebenza. Sebenzisa i-WaitForPause noma i-WaitForEvent ngemva kwe-run, kwemisebenzi yezindawo zokumisa, noma kwezinye izenzo ze-debugger ezenzeka ngokungavumelani nesikhathi. I-GetEventLog ingabuyekeza izindawo zokumisa zakamuva, ama-exception, ukulayishwa kwama-DLL, nemicimbi ehlobene.

Landelela Esikhundleni Sokuphinda Izinyathelo Ngazinye

Ukuze uthole umlando omfushane wemiyalelo, sebenzisa i-TraceInto ukuze urekhode amakheli nokuhlukaniswa kwemiyalelo ngenkathi ungena kumakholi. Sebenzisa i-TraceOver lapho amakholi kufanele eqiwe. Lokhu kulula kunokuthumela izicelo eziningi ezihlukene zezinyathelo.

Ukuhlola Izinkulumo Ngenqwaba

I-EvalExpression ihlola inkulumo ye-x64dbg efana nekheli, i-register, noma inkulumo yezibalo. Uma amanani amaningi kufanele aqashwe ndawonye, sebenzisa i-WatchExpressions ukuze uhlole izinkulumo eziningi ngesicelo esisodwa.

Gcina Futhi Buyisela Isimo Sokuhlaziya

Sebenzisa i-CommentOrLabelAtAddress namathuluzi wamabhukhimakhi ukuze ubhale amanothi ezindaweni ezibalulekile. Biza i-SaveDatabase ukuze ugcine isizindalwazi se-x64dbg njengefayela le-.dd64 noma le-.dd32.

Lungisa Ngokuqapha

WriteMemToAddress ilungisa ama-byte, kanti Assemble ibhala umyalelo ohlanganisiwe ekhelini. Hlola ama-byte akhona bese ugcina irekhodi lezinguquko ngaphambi kokulungisa. Sebenzisa GetPatches ukuze ubuyekeze izinguquko, bese usebenzisa RestorePatches ukubuyisela ama-byte okuqala.

Hlola Izakhiwo Zenqubo

Sebenzisa GetPEB ukuhlola izinkambu ze-Process Environment Block, GetSEHChain ukuthola uchungechunge lwe-Structured Exception Handler lwe-x32, kanye GetArguments ukuhlola izimpikiswano zomsebenzi ezivela kuma-register noma ku-stack. FollowPointer ingalandela uchungechunge lwama-pointer ngokususa ama-pointer ngenani lamazinga elicacisiwe.

Gcina Ukuvezwa Kwenethiwekhi Kuncane

Khetha 127.0.0.1 ngaphandle kwalapho kudingeka ukuxhumana okukude. Uma kufanele ubophe ku-0.0.0.0, nciphisa ukufinyelela usebenzisa izilawuli zenethiwekhi ezethembekile, vikela i-token, futhi uyishintshe uma kusolwa ukuthi ivele obala. Khumbula ukuthi indlela yokuthutha yi-HTTP, hhayi i-HTTPS ebethelwe.

Amathuluzi Awusizo Okusebenza

• GetDebugState ihlola ukuthi iseshini yokulungisa amaphutha iyasebenza yini futhi ibike i-PID kanye ne-instruction pointer.
• AttachProcess ixhuma i-x64dbg kunqubo esebenzayo isebenzisa i-PID.
• ExecuteDebuggerCommand isebenzisa umyalo we-x64dbg ngqo.
• ListCommandsByCategory isiza iklayenti le-MCP ukuthola amathuluzi atholakalayo.
• GetThreads, SwitchThread, SuspendThread, kanye ResumeThread zilawula umongo wama-thread.
• GetMemoryMap kanye GetDumpableRegions zikhomba izifunda zememori ngaphambi kokuzifunda noma ukuzidumpa.
• DumpMemory igcina ububanzi bememori obukhethiwe, kanti DumpModule igcina imojuli yonke.
• StopDebug iqeda iseshini yamanje, kanti RestartDebug iyayiqalisa kabusha.

Isiphetho

x64dbg-MCP Server ixhuma amandla omdabu okulungisa amaphutha e-x64dbg kubasizi be-AI abahambisana ne-MCP ngaphandle kokudinga i-runtime yangaphandle. Ngemva kokufaka ama-plugin alungile e-x32 ne-x64, ukukopisha i-Bearer token ekhiqiziwe, nokumisa i-endpoint ye-HTTP noma ye-SSE, ungakwazi ukulawula izinqubo eziphelele zokulungisa amaphutha usebenzisa izicelo zolimi lwemvelo.

Qala ngekheli lokubopha elisebenza endaweni kuphela kanye nemisebenzi elula yokuhlola efundwayo kuphela. Bese uqhubekela ekunyatheleni okuqaphela imicimbi, kuma-breakpoint anemibandela, ekulandeleni, ekuhlaziyeni i-PE, nasekulungiseni imemori okulawulwa ngokucophelela. Hlala usebenzisa iseva ezindaweni ogunyaziwe futhi ugweme ukuveza isixhumi sayo se-HTTP esingabetheliwe kumanethiwekhi angathembekile.