1. "List processes"                           → find the game PID
2. "List modules for game.exe"                → find module bases
3. "Scan for RTTI classes in game.exe"        → discover class names + vtables
4. "Find the GNames signature in game.exe"    → locate UE globals
5. "Dump the UE5 SDK with GNames and GObjects"→ generate C++ headers

"Find pointer chains from module bases to 0x1a2b3c4d in game.exe"
→ [[game.exe+0x1234]+0x10]+0x48   (depth 2)
→ [[game.exe+0x5678]+0x20]+0x100  (depth 2)

"Find all xrefs to 0x7ff6a013580 in game.exe"
→ Code: 0x7ff6a012345 [rip_rel_7] 48 8b 05 35 12 00 00  (.text)
→ Data: 0x7ff6a101000 (.rdata)

git clone https://github.com/Neverdecel/nevercheese-pcileech-memprocfs-mcp.git
cd nevercheese-pcileech-memprocfs-mcp

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

sudo apt install libusb-1.0-0-dev libfuse-dev openssl libssl-dev liblz4-dev

{
  "device": {
    "type": "fpga",
    "remote": "",
    "extra_args": []
  }
}

claude mcp add -s user nevercheese-pcileech-memprocfs-mcp -- \
  /path/to/nevercheese-pcileech-memprocfs-mcp/.venv/bin/python \
  /path/to/nevercheese-pcileech-memprocfs-mcp/main.py

{
  "mcpServers": {
    "nevercheese-pcileech-memprocfs-mcp": {
      "command": "/path/to/.venv/bin/python",
      "args": ["/path/to/main.py"]
    }
  }
}

Read 256 bytes from physical address 0x1000
Write 90909090 (NOPs) to 0x7ff7f3a90000 in PID 1234
Search for the MZ header in the first 16MB of memory
Take a snapshot of 256 bytes at 0x1a000000, then diff after taking damage

List all processes on the target system
Show me modules loaded by explorer.exe
Show the exports of engine2.dll in cs2.exe
List PE sections of game.exe with protection flags

Scan for AOB pattern "48 8B 05 ?? ?? ?? ?? 48 85 C0" in game.exe
Resolve the signature "48 8D 05 ?? ?? ?? ?? EB 27" to find GNames
Scan for RTTI classes in client.dll
Analyze the struct at address 0x1a000000 — identify field types

Find pointer chains from module bases to address 0x1a2b3c4d in PID 1234
Find all code and data references to 0x7ff6a013580 in game.exe
Follow the pointer chain [[game.exe+0x1A8B230]+0x50]+0x100 and read 4 bytes

Dump the UE5 GNames table at 0x7ff6a500000 from the game process
Generate a C++ SDK from the UE game with GObjects at 0x... and GNames at 0x...
Dump IL2CPP metadata from the Unity game process to /tmp/dump.cs

source .venv/bin/activate
python test_server.py

Claude Code / MCP Client
    |
    | (MCP stdio transport)
    |
main.py                 ← 34 tool schemas + async handlers + output formatting
    |
vmm_wrapper.py          ← Device init, memory ops, process/module enumeration
    |
    ├── pointer_scanner.py  ← Pointer chain discovery + cross-reference scanning
    ├── engine_tools.py     ← UE4/UE5 SDK dump + Unity IL2CPP extraction
    |
    ├── memprocfs           ← High-level API: processes, virtual memory, modules
    |     └── vmmpyc.so → libvmm.so → libleechcore.so
    |
    └── leechcorepyc        ← Low-level API: physical memory, FPGA, TLP
          └── leechcore.so