Giving Claude "Hands": Exoproc Open-Source MCP Server Enables Live Process Hooking

After Static Analysis, Claude Needs to "Take Action"

The REA project demonstrated Claude's ability to read decompiled code, but static analysis can only tell you what the code "might" do—it cannot observe real runtime behavior. A developer has released Exoproc on Reddit—a stdio-based open-source MCP server that lets Claude Code connect directly to live Windows x64 processes.

Static decompilation gave Claude "eyes"; dynamic hooking gives it "hands." The core idea behind Exoproc is simple: rather than having Claude simulate execution flows through prompts, let it directly manipulate live memory.

Bypassing EDR: Thread Hijacking Instead of DLL Injection

Traditional DLL injection is too noisy and easily triggers EDR alerts. Exoproc adopts a thread hijacking approach: suspend the target thread, move RIP to a sleep stub, and execute code within the existing context.

The clever part is that it doesn't write new DLL files into the target process or open network ports, reducing the likelihood of detection by security software. The author mentions that Exoproc can handle 5-byte JMP trampolines and 14-byte far relay gates, and uses TinyCC to compile C code directly into in-memory shellcode.

Thread Hijacking vs. DLL Injection

DLL injection typically requires writing a DLL file path or full image into the target process, then having the target load and execute the new module via LoadLibrary, CreateRemoteThread, or APC injection. This process calls APIs like VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, and may leave DLL files on disk or generate new module load records, making it easily caught by EDR API hooks and module load monitoring.

Thread hijacking is different: it uses OpenThread, SuspendThread, and GetThreadContext/SetThreadContext to modify the instruction pointer (RIP/RVC) of an existing thread, redirecting it to execute code placed in process memory (such as a sleep stub or shellcode), then restores the original context afterward. The entire process creates no new threads, loads no new modules, and doesn't rely on CreateRemoteThread, thus bypassing common detection points targeting remote thread injection. The trade-off is greater dependence on target thread scheduling timing and higher precision requirements for thread context register operations, making stability and compatibility harder to guarantee than DLL injection.

MCP (Model Context Protocol) and stdio Transport

MCP is an open protocol proposed by Anthropic that enables AI models to invoke external tools and data sources in a standardized way. It uses a client-server architecture: Claude Code acts as the MCP client, communicating with the MCP server via JSON-RPC messages, while the server exposes capabilities like "reading process memory" and "setting hooks" as tools that the model can invoke on demand.

Exoproc is based on stdio transport, meaning the client launches the server as a subprocess and both parties exchange JSON-RPC messages through standard input/output without opening network ports—consistent with its design goal of "not opening network connections." The value of MCP lies in encapsulating dynamic analysis capabilities into a tool interface that the model can discover and invoke, enabling Claude to directly make tool calls and receive structured results rather than relying on prompt-based simulation.

What It Can Actually Do: A Hooking Example

The author's typical usage example: have Claude hook the SetWindowTextW function in PID 4120, use a 5-byte trampoline to record the string buffer, and restore the original bytes when done.

Claude's operations include: hooking at the function prologue, reading UTF-16 strings from live memory, and cleanly unhooking at the end. The entire process leaves no DLL files on disk and opens no network connections. This means Claude can not only "understand" code but also "observe"—within controlled bounds—what arguments are actually passed and which branches are taken at runtime.

Technical Background: Inline Hooks, Trampolines, and Far Relay Gates

Inline hooking (also known as trampoline hooking) is a classic instrumentation technique that overwrites several bytes at the target function entry to redirect execution to a custom handler. Since x64 functions need at least 5 bytes for a JMP rel32 instruction, if the function prologue lacks sufficient space, a longer jump scheme is needed.

The 14-byte far relay gate corresponds to the FF 25 00000000 plus 8-byte absolute address form, enabling jumps anywhere in the 64-bit address space—suitable for scenarios where the target function and shellcode are more than ±2GB apart. Hooking requires first saving the overwritten original bytes, then restoring them after executing custom logic—the so-called "clean unhooking." SetWindowTextW is the Unicode version of the Win32 function for setting window titles, whose second parameter is a UTF-16 string pointer, so hooking at this function entry intercepts all incoming title strings, making it a typical target for demonstrating string buffer recording.

TinyCC as an In-Memory JIT Compiler

TinyCC (tcc) is a lightweight C compiler that can be embedded into other programs, compiling C source code directly to machine code at runtime. Exoproc uses it to compile C code into position-independent shellcode and write it into target process memory, eliminating the need to build a DLL locally and then inject it.

Compared to MSVC or GCC, TinyCC compiles faster, has fewer dependencies, and can be linked as a library—suitable for scenarios requiring on-the-fly generation of small code snippets. However, its optimization capabilities are limited, and the generated code size and performance are inferior to mainstream compilers, making it better suited for short logic like hook handlers rather than complex modules.

Security and Boundary Considerations

Exoproc extends AI agent capabilities from static analysis to dynamic instrumentation—both a capability enhancement and a new security consideration. Thread hijacking is itself a sensitive technique; although the author emphasizes its EDR-evasion characteristics, such tools have legitimate uses in legal reverse engineering, malware analysis, and software debugging.

For security researchers, letting Claude directly manipulate live processes can significantly reduce token consumption from repeatedly describing execution flows in prompts, allowing focus on analysis conclusions. However, when using such tools, it's still essential to ensure the target process and operating environment fall within authorized scope.

Exoproc is open-sourced on GitHub at github.com/w0ldan/exoproc. For developers exploring AI-assisted reverse engineering and dynamic analysis, this is an experimental tool worth watching.