w0ldan/exoproc

选用指南

AI 根据 README 整理 · 2026/10/29 17:42:13

适用场景

适用于在 Windows x64 环境下检查运行中进程、读写内存、安装钩子、执行远程线程调用、编译 C 代码为 shellcode、捕获桌面截图、分析 JVM 等场景。

查看 README 依据

> Exoproc targets native **Windows x64** process runtime. Development and offline operations (C-to-shellcode JIT compilation, machine code simulation, and MCP schema generation) run cross-platform. Live instrumentation commands (`nthread`, `minhook`, memory manipulation, desktop inspection) run natively on Windows x64. --- See a feature in a native Windows application that you want to inspect or reverse engineer? Want your AI agent to debug a live process, read internal state, or intercept API calls in real time?

## What you can inspect & instrument | Capability | What Exoproc Provides | Underlying Mechanism | | :-------------------------- | :------------------------------------------------------------------------------- | :------------------------------------------------------- | | **Live Win32 Processes** | Discover PIDs, thread counts, command lines, module bases, and architecture | `CreateToolhelp32Snapshot`, `Process32NextW` |

| **Virtual Memory** | Read, write, allocate, protect, and query memory regions | `VirtualAllocEx`, `VirtualProtectEx`, `VirtualQueryEx` | | **AOB Pattern Scanning** | Fast pattern scanning with wildcards (`?`) across module regions | Optimized SIMD-accelerated byte search (`memmem`) | | **Function Detours** | Intercept Win32 APIs and internal functions with 5-byte relative JMP trampolines | `minhook` with Capstone prologue relocation & far relays |

目标用户

主要面向 AI 编码代理（如 Claude Code、Cursor 等）和开发者，用于连接 AI 代理到 Windows 进程内部进行调试和自动化。

查看 README 依据

**Exoproc connects your AI coding agent directly to Windows x64 process internals.** It equips agents (Claude Code, Cursor, Windsurf, Claude Desktop, Antigravity, VS Code Cline, OpenCode, Zed) with a 22-tool Model Context Protocol (MCP) server and a standalone terminal CLI. Analysis and instrumentation run locally with **zero DLL injection** and **no `CreateRemoteThread`**. --- ## Quick start ### Installation & Agent Setup **Windows (Command Prompt / PowerShell - Recommended):**

The wizard automatically discovers installed agents on your machine, writes portable stdio MCP configurations with automatic backups, and installs tailored agent instructions and skills. Restart your agent afterward. Setup supports Claude Code, Cursor, Windsurf, Claude Desktop, Antigravity, VS Code Cline, OpenCode, and Zed. ### Ask your agent Once configured, ask your AI agent to inspect or automate any running application: ```text Find the running Notepad process, inspect its main Edit control, read the text, install a MinHook detour on its message handler, and take a screenshot. ```

使用方式

通过命令行（CLI）和 MCP 服务器使用，可通过命令提示符或 PowerShell 安装，也可零安装直接运行，支持交互式或非交互式设置。

查看 README 依据

[Quick start](#quick-start) · [How Exoproc works](#how-exoproc-works) · [What you can inspect & instrument](#what-you-can-inspect--instrument) · [Showcases](#showcases) · [MCP tool catalog](#mcp-tool-catalog) · [CLI reference](#cli-reference) · [FAQ](#faq) · [Architecture](#architecture) ```cmd powershell -c "irm https://exoproc.woldan.me/install.ps1|iex" ``` </div> > [!IMPORTANT]

Installs Bun if missing, sets up the global `exoproc` CLI runner, and launches the AI agent configuration wizard: ```cmd powershell -c "irm https://exoproc.woldan.me/install.ps1|iex" ``` **Zero Install (Directly with `bun x`):** Runs the setup wizard directly in your terminal without manual installation: ```bash bun x exoproc ``` To auto-approve all detected agents non-interactively: ```bash bun x exoproc setup --yes ```

部署要求

需要 Windows x64 平台，且要求安装 Bun（版本 >=1.0）。部分外部依赖（如 capstone.dll、ECJ 编译器 JAR 等）首次使用时需要下载到缓存并验证校验和。

查看 README 依据

[](server.json) [](https://bun.sh) [](LICENSE) [](#architecture)

4. **Embedded TinyCC JIT:** Compiles C snippets directly into raw x86_64 machine code, ready for execution, simulation, or remote process injection. 5. **Deterministic Simulation:** Emulates x86_64 CPU instructions and NT syscalls completely in memory for offline verification. 6. **On-Demand Binary Caching & Integrity:** External binaries (`capstone.dll`, ECJ compiler JARs, Tiny-Remapper) are downloaded lazily on first use into `~/.cache/exoproc/deps/` with full SHA-1/SHA-256 cryptographic checksum verification. Published npm packages remain ultra-lightweight (<1MB). ---

已知限制

主要用于 Windows x64 原生进程，但不适用于其他平台或非原生进程；运行时操作（如线程注入、内存修改）仅在 Windows x64 上可用，开发或离线操作可跨平台。

查看 README 依据

> Exoproc targets native **Windows x64** process runtime. Development and offline operations (C-to-shellcode JIT compilation, machine code simulation, and MCP schema generation) run cross-platform. Live instrumentation commands (`nthread`, `minhook`, memory manipulation, desktop inspection) run natively on Windows x64. --- See a feature in a native Windows application that you want to inspect or reverse engineer? Want your AI agent to debug a live process, read internal state, or intercept API calls in real time?