Exoproc: Reverse Engineer & Instrument Any Process

One unified CLI and Model Context Protocol (MCP) server for Windows x64 reverse engineering, thread hijacking, function detours, live memory manipulation, and C-to-shellcode compilation.

Inspect a running process. Intercept functions, redirect threads, modify memory, and compile C to shellcode—without DLL injection.

Quick start · How Exoproc works · What you can inspect & instrument · Showcases · MCP tool catalog · CLI reference · FAQ · Architecture

# Node.js
npx -y exoproc

# Bun
bun x exoproc

# Windows (PowerShell)
powershell -c "irm https://exoproc.woldan.me/install.ps1|iex"

[!IMPORTANT] Exoproc targets native Windows x64 process runtime. Development and offline operations (C-to-shellcode JIT compilation, machine code simulation, and MCP schema generation) run cross-platform. Live instrumentation commands (nthread, minhook, memory manipulation, desktop inspection) run natively on Windows x64.

See a feature in a native Windows application that you want to inspect or reverse engineer? Want your AI agent to debug a live process, read internal state, or intercept API calls in real time?

Exoproc connects your AI coding agent directly to Windows x64 process internals. It equips agents (Claude Code, Cursor, Windsurf, Claude Desktop, Antigravity, VS Code Cline, OpenCode, Zed) with a 22-tool Model Context Protocol (MCP) server and a standalone terminal CLI.

Analysis and instrumentation run locally with zero DLL injection and no CreateRemoteThread.

Quick start

Installation & Agent Setup

Choose your preferred way to run or configure Exoproc:

Option 1: Zero-Install via Node.js (npx)

Works out-of-the-box on machines with Node.js (>=18.0.0). Transparently fetches the native Windows x64 AOT engine without requiring Bun:

# Interactive setup wizard
npx -y exoproc

# Auto-configure all detected AI agents
npx -y exoproc setup --yes

Option 2: Zero-Install via Bun (bun x)

Runs natively with Bun for high performance:

# Interactive setup wizard
bun x exoproc

# Auto-configure all detected AI agents
bun x exoproc setup --yes

Option 3: Windows Automated Installer (PowerShell)

Installs Bun if missing, sets up the global exoproc CLI command in your PATH, and runs the agent setup wizard:

powershell -c "irm https://exoproc.woldan.me/install.ps1|iex"

Option 4: Standalone Windows x64 Native Binary (exoproc.exe)

No Node.js and no Bun required! Download the pre-compiled Ahead-Of-Time (AOT) executable directly from GitHub Releases and run:

exoproc.exe setup --yes

The wizard automatically discovers installed agents on your machine, writes portable stdio MCP configurations with automatic backups, and installs tailored agent instructions and skills. Restart your agent afterward.

Setup supports Claude Code, Cursor, Windsurf, Claude Desktop, Antigravity, VS Code Cline, OpenCode, and Zed.

Ask your agent

Once configured, ask your AI agent to inspect or automate any running application:

Find the running Notepad process, inspect its main Edit control, read the text,
install a MinHook detour on its message handler, and take a screenshot.

Your agent will seamlessly invoke list_processes, attach with open_accessor, execute Win32 code via execute_code, capture a screenshot, and cleanly detach with close_accessor.

Use the terminal

Exoproc provides a unified command-line tool for developers:

# List running processes on the system
exoproc ps

# Enumerate desktop windows and child edit controls
exoproc windows

# Compile C code directly into standalone x86_64 machine code / shellcode
exoproc compile -s "int add(int a, int b) { return a + b; }"

# Execute C-style Win32 code inside a target process
exoproc exec "MessageBoxW(0, L'Hello from Exoproc', L'Exoproc', 0);" --pid 1234

# Capture a desktop or window screenshot (PNG)
exoproc screenshot screen.png

# Check system health and configured AI agents
exoproc doctor

Once installed globally, the exoproc command is immediately available in your PATH. Alternatively, run any command ad-hoc via npx or bun x:

# Node.js
npx exoproc ps
npx exoproc windows
npx exoproc doctor

# Bun
bun x exoproc ps
bun x exoproc windows
bun x exoproc doctor

Update Exoproc

To update Exoproc and refresh all agent configurations:

# Node.js
npx -y exoproc@latest setup --yes

# Bun
bun x exoproc@latest setup --yes

# PowerShell
powershell -c "irm https://exoproc.woldan.me/install.ps1|iex"

How Exoproc works

Your agent communicates with Exoproc through the standard Model Context Protocol (MCP) over pure stdio. Exoproc executes native Windows x64 operations directly using thread context redirection, memory allocation, and JIT compilation:

┌─────────────────────────────────────────────────────────────┐
│  AI Agents (Claude Code, Cursor, Antigravity, Windsurf)     │
└──────────────────────────────┬──────────────────────────────┘
                               │  stdio (JSON-RPC 2.0)
┌──────────────────────────────▼──────────────────────────────┐
│  Exoproc Unified CLI & MCP Server (exoproc)                 │
├─────────────────────────────────────────────────────────────┤
│  • Memory Engine (read, write, alloc, scan AOB)             │
│  • MinHook Detours (5-byte JMP + far relay trampolines)     │
│  • NThread Engine (thread hijacking via Get/SetThreadCtx)   │
│  • TinyCC JIT (C source → relocatable x86_64 shellcode)     │
│  • Win32 C-Style Scripting & Struct Marshalling             │
│  • Desktop Window Discovery & PNG Capture                   │
└──────────────────────────────┬──────────────────────────────┘
                               │  Win32 Debug / Memory APIs
┌──────────────────────────────▼──────────────────────────────┐
│  Target Windows x64 Process (zero DLL injection)            │
└─────────────────────────────────────────────────────────────┘

Core Architecture Highlights

1. Zero DLL Injection: Never drops a DLL to disk or forces LoadLibrary into target processes.
2. No CreateRemoteThread Required: nthread executes remote calls by temporarily parking an existing thread at a system sleep stub (jmp $), updating RIP/registers via SetThreadContext, and returning safely via a ret stub.
3. 5-Byte JMP Trampoline Detours (minhook): True MinHook-style 5-byte relative JMP hooks with automatic prologue decoding via Capstone, branch relocation, and 14-byte far-detour relays (jmp [rip+0]) for arbitrary distances (>2GB).
4. Embedded TinyCC JIT: Compiles C snippets directly into raw x86_64 machine code, ready for execution, simulation, or remote process injection.
5. Deterministic Simulation: Emulates x86_64 CPU instructions and NT syscalls completely in memory for offline verification.
6. On-Demand Binary Caching & Integrity: External binaries (capstone.dll, ECJ compiler JARs, Tiny-Remapper) are downloaded lazily on first use into ~/.cache/exoproc/deps/ with full SHA-1/SHA-256 cryptographic checksum verification. Published npm packages remain ultra-lightweight (<1MB).

What you can inspect & instrument