State Snapshot

---
name: state-snapshot
description: Capture a full debuggee state snapshot (all committed memory regions + processor state) to disk for offline analysis
allowed-tools: mcp__x64dbg__get_debugger_status, mcp__x64dbg__pause, mcp__x64dbg__disconnect, mcp__x64dbg__connect_to_session, mcp__x64dbg__go, Bash
---

# state-snapshot

Capture a full debuggee state snapshot — all committed memory regions as raw binary files plus the complete processor state as JSON.

## Instructions

Follow these steps exactly:

### 1. Verify debugger connection

Call `mcp__x64dbg__get_debugger_status` to confirm the debugger is connected and a debuggee is loaded. Note the **session PID** and **x64dbg path** from the current MCP connection — you will need these to reconnect later.

If no debuggee is loaded, tell the user and stop.

### 2. Pause the debuggee if running

If the debugger status shows the debuggee is running (not paused), call `mcp__x64dbg__pause` to pause it. Remember that you auto-paused so you can resume later.

### 3. Disconnect the MCP client

Call `mcp__x64dbg__disconnect` to release the ZMQ connection. This is **required** because only one client can be connected to an x64dbg session at a time, and the Python script needs its own connection.

### 4. Run the snapshot script

Execute the snapshot script:

```
python "${CLAUDE_PLUGIN_ROOT}\skills\state-snapshot\state_snapshot.py" --x64dbg-path "<x64dbg_path>" --pid <session_pid>
```

Where:
- `<x64dbg_path>` is the path to the x64dbg executable noted in step 1
- `<session_pid>` is the debugger process PID noted in step 1

The script defaults output to `./snapshots/<timestamp>/`. If the user specified a custom output directory, pass `--output-dir <path>`.

### 5. Reconnect the MCP client

Call `mcp__x64dbg__connect_to_session` with the **x64dbg path** and **session PID** saved from step 1 to restore the MCP connection.

### 6. Report results

Summarize what was captured:
- Output directory path
- Number of memory region files saved and total size
- Whether registers were captured successfully
- Any regions that failed to read