·7 read·Author: aegisSoft

Reverse Engineering Toolkit: Comprehensive Setup and Usage Guide

Every tool used in the aegisSoft reverse engineering workspace: what it does, how to install it, how to configure it, and daily operational workflows — together with generalized AGENTS.md and PROMPTS.md templates.

#reverse-engineering#security#tooling#android#windows#network
Setup Prompt

Both languages are identical (synchronized). Copy the prompt into your AI agent to set up everything described in this post, using only the official links.

Reverse Engineering Toolkit: Comprehensive Setup and Usage Guide

This post collects every tool used in the aegisSoft reverse engineering workspace in one place. For each tool it explains what it does, how to install it, how to configure it, and how it is used in a typical operation. It ships with generalized AGENTS.md and PROMPTS.md templates:

0. Workspace Philosophy

The most common mistake in reverse engineering is installing tools first and asking "what is where" later. Core principle: tools must be callable independent of location, no script may contain a hardcoded absolute path, and every project carries its own PROJECT.md. All paths resolve relatively or through environment variables; nothing is hardcoded.

Recommended top-level layout:

<WORKSPACE_ROOT>/
├── Tools/                 # All analysis tools (junction/symlink for version independence)
├── Projects/              # Each project in its own subdirectory
│   └── <project_name>/
│       └── PROJECT.md
├── evidence/              # Forensic outputs, pcap, db, strings
├── AGENTS.md
└── PROMPTS.md

1. Tool Inventory

ToolLocationEntryPurpose
REATools/rea/MCPPrimary autonomous RE, ADB and binary analysis bridge
Detect It EasyTools/die/diec.exe, die.exePacker/compiler/protection/entropy detection
dnSpyTools/dnspy/dnSpy.exe.NET decompile (C#), CIL patch, runtime debug
Il2CppDumperTools/il2cppdumper/Il2CppDumper.exeUnity IL2CPP symbols (dump.cs, script.json, il2cpp.h)
x64dbg/x32dbgTools/x64dbg/x96dbg.exeNative user-mode debugger
System InformerTools/systeminformer/SystemInformer.exeKernel-level process/DLL/memory/PE
Process Hacker 2Tools/processhacker/ProcessHacker.exeProcess/service/socket inspection
SysinternalsTools/sysinternals/procmon64.exe etcLive events, persistence, strings
CFF ExplorerTools/cff-explorer/CFF Explorer.exePE headers, ASLR/DEP, IAT
Cheat EngineTools/cheatengine/Cheat Engine.exeMemory/pointer/AOB/Lua
7-ZipTools/7zip/7z.exeMulti-format extraction
SQLite ToolsTools/sqlite-tools/sqlite3, sqldiff, sqlite3_analyzerDB query/diff/B-Tree
WakaruTools/wakaru/wakaru.exeJS bundle unpack/decompile
Wireshark/TSharkTools/wireshark/tshark.exePacket capture/DPI/TLS
Sigrok-CLI/ZadigTools/sigrok-cli/sigrok-cli.exeLogic analyzer/protocols/drivers
JADXTools/jadx/jadx.batDEX to Java
ApktoolTools/apktool.batAPK decode/rebuild
Cutter/RizinTools/cutter/cutter.exeELF/PE/Mach-O reversing
GhidraTools/ghidra/ghidraRun.batDecompiler/headless
ScrcpyTools/scrcpy/scrcpy.exeAndroid mirroring
PerfettoTools/perfetto/perfetto.exeSystem profiling
Frida ServerTools/frida-server-*.exeDynamic hook/injection
Burp SuiteTools/BurpSuiteCommunity/BurpSuiteCommunity.exeWeb proxy/testing
mitmproxyTools/mitmproxy/mitmproxy.exeTLS intercepting proxy
OWASP ZAPTools/ZAP/ZAP.exeWeb scanner/fuzzer
wabtTools/wabt/bin/wasm2wat.exeWASM decompile
PlaywrightSystemnpx playwrightBrowser automation
synchronySystemsynchronyJS deobfuscation

2. Setup Principles

  1. Collect all tools under one Tools/ root; use junctions/symlinks for version-independent calls.
  2. No hardcoded absolute paths in scripts; use %~dp0, $PSScriptRoot or relative resolution.
  3. Keep device IDs, IP/port and API keys out of version control in a local git-ignored config.
  4. Every tool on PATH should be callable directly from the CLI.

3. Tool-by-Tool Setup

SQLite Tools

sqlite3, sqldiff, sqlite3_analyzer on PATH. Query with sqlite3 app_data.db, .schema, .tables. Export CSV/JSON. Diff with sqldiff. B-Tree map with sqlite3_analyzer.

Wakaru

wakaru on PATH. wakaru -u auto -o output_dir bundle.js; strict unpack; Vue SFC; Bun extraction; source map extraction; DCE.

Sigrok-CLI & Zadig

sigrok-cli and zadig.exe on PATH. Scan, capture, decode I2C/SPI/UART, assign WinUSB/libusb via Zadig.

Wireshark & TShark

tshark, dumpcap, editcap, mergecap, capinfos on PATH. Capture, ring buffer, filter, TLS decryption with SSLKEYLOGFILE, export objects, split/merge.

Detect It Easy

diec, die, diel on PATH. Basic, entropy, deep scan, JSON report, GUI.

Il2CppDumper

Il2CppDumper.exe on PATH. Command: Il2CppDumper.exe <libil2cpp.so/GameAssembly.dll> <global-metadata.dat> <output_dir>. Outputs dump.cs, script.json, il2cpp.h, stringliteral.json. Import symbols into Ghidra via ghidra_with_struct.py.

dnSpy

dnSpy.exe, dnSpy.Console.exe on PATH. Open assembly, edit method (C#), edit IL, attach debugger.

x64dbg

x96dbg.exe, x64dbg.exe, x32dbg.exe on PATH. Architecture selector, breakpoints F2/F7/F8/F9, Ctrl+G, hardware bp bph, API bp bp.

System Informer & Process Hacker

SystemInformer.exe, ProcessHacker.exe, peview.exe on PATH. PE view, token inspection, live strings, handle search.

Sysinternals

procmon64.exe, procexp64.exe, autoruns64.exe, strings64.exe, handle64.exe, tcpview64.exe on PATH. Strings, Procmon capture/open, Autoruns, handles, network.

CFF Explorer

CFF Explorer.exe on PATH. Disable ASLR/DEP via DllCharacteristics, repair IAT, set section permissions 0xE0000020.

Cheat Engine

Cheat Engine.exe on PATH. Value scans, pointer scan, AOB injection via Auto Assemble.

7-Zip

7z.exe, 7zFM.exe on PATH. Extract, installer extraction, listing.

Ghidra

ghidraRun.bat, analyzeHeadless.bat on PATH. Headless import and post-scripts, Il2Cpp symbol import.

Burp Suite, mitmproxy, ZAP

Burp for proxy/Repeater/Intruder. mitmproxy for TLS intercepting proxy (CLI/web/scriptable). ZAP for scanning and fuzzing.

wabt

wasm2wat.exe, wat2wasm.exe, wasm-decompile.exe on PATH. WASM to WAT and decompilation.

Playwright & synchrony

Playwright browsers via npx playwright install. synchrony via npm install -g synchrony.

4. Operational Protocols

Android DB Forensics

Pull via run-as, dump schema, diff with sqldiff, analyze storage.

Network Capture

tshark capture, TLS with SSLKEYLOGFILE, export objects.

JS/Electron Unpacking

wakaru auto unpack, Vue SFC, source map extraction.

Hardware/Bus

sigrok scan, capture, decode I2C/SPI/UART.

Unity IL2CPP/Mono

Extract, Mono in dnSpy, Il2CppDumper, Ghidra import.

Windows PE

DIE scan, strings, CFF Explorer, peview.

Live Process/Kernel

Procmon capture, System Informer tracking.

Dynamic Debugging

x64dbg, API breakpoints, Cheat Engine validation.

5. Security and Ethics

Authorized, defensive and educational use only. Obtain proper authorization before analyzing third-party systems. Keep device IDs, API keys and tokens out of version control. Store extracted secrets in an encrypted local vault. EOF

6. Official Download Sources

The links below are official sources only. Mirror sites are used only when the official source is unreachable and with user approval. After installation, version and SHA-256 checksum are written to Tools/<tool>/VERSION.txt.

ToolOfficial Source
REA (Reverse Engineering Agent)https://github.com/morluto/rea
Detect It Easy (DIE)https://github.com/horsicq/detect-it-easy/releases
dnSpyhttps://github.com/dnSpy/dnSpy/releases (maintained fork: https://github.com/dnSpyEx/dnSpy)
Il2CppDumperhttps://github.com/Perfare/Il2CppDumper/releases/latest
x64dbg / x32dbghttps://x64dbg.com/
System Informerhttps://systeminformer.com/downloads
Process Hacker 2https://sourceforge.net/projects/processhacker/files/processhacker2/
Sysinternals Suitehttps://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
Explorer Suite / CFF Explorerhttps://ntcore.com/explorer-suite/
Cheat Enginehttps://www.cheatengine.org/downloads.php
7-Ziphttps://www.7-zip.org/download.html
SQLite Toolshttps://www.sqlite.org/download.html
Wakaruhttps://github.com/pionxzh/wakaru
Wireshark & TSharkhttps://www.wireshark.org/download.html
Sigrokhttps://sigrok.org/wiki/Downloads
Zadighttps://zadig.akeo.ie/
JADXhttps://github.com/skylot/jadx/releases/latest
Apktoolhttps://github.com/iBotPeaches/Apktool/releases/latest
Cutterhttps://cutter.re/download/
Rizinhttps://rizin.re/
Ghidrahttps://github.com/NationalSecurityAgency/ghidra/releases/latest
Scrcpyhttps://github.com/Genymobile/scrcpy/releases/latest
Perfettohttps://perfetto.dev/
Fridahttps://github.com/frida/frida/releases/latest
Burp Suite Communityhttps://portswigger.net/burp/communitydownload
mitmproxyhttps://www.mitmproxy.org/downloads
OWASP ZAPhttps://www.zaproxy.org/download/
wabthttps://github.com/WebAssembly/wabt/releases/latest
Playwrighthttps://playwright.dev/docs/intro
synchronyhttps://github.com/relative/synchrony
Android SDK Platform Toolshttps://developer.android.com/tools/releases/platform-tools
Android Studiohttps://developer.android.com/studio
JDK (Temurin 17 LTS)https://adoptium.net/temurin/releases/?version=17
Pythonhttps://www.python.org/downloads/
Node.js (LTS)https://nodejs.org/en/download

Reactions

Comments and reactions are stored locally in your browser; no account required.

Comments(0 comments)

Up to 3 links per comment; all links are marked nofollow.0/2000

Spam, abuse or malicious content is not allowed.

No comments yet. Be the first to comment.

Resources

Generalized AGENTS.md and PROMPTS.md templates plus the setup prompt. Read in browser or download.

AGENTS.md

aegisSoft Reverse Engineering — AGENTS.md (General Template)

This file contains the binding rules of the aegisSoft reverse engineering workspace. Every agent and developer reads this file before entering the workspace.

1. Identity and Mission

  • Workspace: aegisSoft reverse engineering workspace.
  • Purpose: authorized, defensive, and educational reverse engineering.
  • Core principle: tools are location-independent and callable, no absolute paths in any script, every project carries its own PROJECT.md.

2. Directory Structure and Path Policy

<WORKSPACE_ROOT>/
├── Tools/
├── Projects/<project_name>/PROJECT.md
├── evidence/
├── AGENTS.md
└── PROMPTS.md
  • No absolute paths, secrets, device IDs, IP addresses, or ports are hardcoded.
  • All paths resolve relatively via <WORKSPACE_ROOT>, %~dp0, or $PSScriptRoot.
  • Device IDs, IP/ports, and API keys are never committed; stored in a local git-ignored config.

3. Platforms and Environment Variables

  • Windows: junctions for version-independent invocation.
  • Linux/macOS: symlinks.
  • Android: ANDROID_SDK_ROOT, JAVA_HOME.
  • Python 3.10+, Node.js/npm/npx, JDK 17+.
  • Every tool must be registered on PATH.

4. Tool Map

The blog post inventory table (Tool / Location / Invocation / Purpose) is binding. Each tool lives under Tools/<tool>/, invoked via junction/symlink.

5. Official Source Policy

  • Every tool's download link comes only from the official source (master prompt Section 1.1).
  • Mirrors are used only when the official source is unreachable and with user approval.
  • After installation, version, date, and SHA-256 (when possible) are written to Tools/<tool>/VERSION.txt.
  • Dead/broken links, version mismatches, or missing dependencies pause installation and are reported.

6. Operational Protocols

  • Android DB forensics: adb shell run-as, SQLite schema/diff.
  • Network capture: tshark, TLS decryption (SSLKEYLOGFILE), object export.
  • JS/Electron unpacking: wakaru, source maps, Vue SFC.
  • Hardware and bus signals: sigrok-cli, Zadig drivers.
  • Unity IL2CPP/Mono: Il2CppDumper, dnSpy, Ghidra symbol import.
  • Windows PE analysis: diec, strings64, CFF Explorer.
  • Live process and kernel telemetry: procmon64, System Informer.
  • Dynamic debugging: x64dbg, Cheat Engine.

7. Build Standards

  • All paths relative or via environment variables.
  • Android pipeline: aapt2, d8, zipalign, apksigner.
  • Device configuration (IDs, IP/port) in a git-ignored local file.
  • Aggressive power management (e.g. Honor MagicOS): FOREGROUND_SERVICE + persistent notification + WAKE_LOCK.

8. Project Lifecycle

  • Every project carries Projects/<name>/PROJECT.md.
  • Read AGENTS.md first when entering the workspace.
  • Project identity, architecture, build commands, and roadmap live in PROJECT.md.

9. Security and Ethics

  • Authorized, defensive, and educational reverse engineering only.
  • Obtain authorization before analyzing third-party systems.
  • Device IDs, API keys, and tokens never enter version control.
  • Extracted secrets stored in an encrypted local vault.

10. Verification and Reporting

After setup/work, the agent produces:

  • Completed: every installed/configured tool (version + location).
  • Not completed: any tool/component not installed and the reason.
  • Errors and gaps: errors, missing dependencies, broken links, version mismatches.
  • Excellence assessment: are all tools callable? any absolute paths? secrets in VCS? docs complete? Overall: EXCELLENT / INCOMPLETE / BROKEN.
  • Additional checks: junction/symlink resolution, PATH verification, PROJECT.md in every project, git status.

11. Bilingual Synchronization

  • The Turkish and English versions of this file (aegissoft-agents-tr.md, aegissoft-agents-en.md) always carry the same content.
  • A change in one is applied to the other.
  • Prompt files (aegissoft-master-prompt-tr.md, aegissoft-master-prompt-en.md) follow the same rule.

This template is generalized; filled with <WORKSPACE_ROOT> and environment variables in a real installation.

PROMPTS.md

aegisSoft Reverse Engineering — PROMPTS.md (General Template)

This file contains templates used to bootstrap reverse engineering sessions.

1. Session Bootstrap Template

Workspace root: <WORKSPACE_ROOT>
Target: <target file/application/package>
Authorization: <proof of authorization / scope>
Read AGENTS.md first, then proceed.
All paths resolve relatively or via environment variables.

2. "Read AGENTS.md First" Rule

Every agent reads AGENTS.md at the start of every session and follows its rules. The rules are not bypassed.

3. Tool Invocation Templates (Relative Paths)

  • SQLite: sqlite3 <db>, .schema, .tables; sqlite3 -header -csv.
  • Wakaru: wakaru -u auto -o <out> <bundle>; --unpack=strict; --vue-sfc; extract.
  • Sigrok: sigrok-cli --scan; --driver ... --samples; -P i2c:....
  • Wireshark: tshark -D; tshark -i <iface> -w <out>; TLS keylog; --export-objects.
  • DIE: diec <target>; -e; -d; -j.
  • Il2CppDumper: Il2CppDumper.exe <lib> <metadata> <out>.
  • x64dbg: x96dbg.exe <target>; bp, bph.
  • CFF Explorer: header/flag editing, ASLR/DEP.
  • Cheat Engine: memory scan, AOB.
  • Ghidra: analyzeHeadless.bat <proj> <name> -import <bin>.

4. Error / Gap Reporting Template

Tool/Component: <name>
Status: COMPLETED / NOT COMPLETED / BROKEN
Reason: <explanation>
Broken link: <URL if any>
Missing dependency: <if any>
Suggested fix: <step>

5. Verification Command List

  • where <tool> / which <tool> (PATH verification)
  • dir Tools\<tool> / ls -la Tools/<tool> (junction/symlink)
  • git status (secret file check)
  • PROJECT.md present in every project

6. Official Link Policy Reminder

  • Every tool's download link comes only from the official source.
  • Mirrors are used only when the official source is unreachable and with user approval.
  • Dead/broken links pause installation and are reported.

7. Bilingual Synchronization

  • The Turkish and English versions of this file (aegissoft-prompts-tr.md, aegissoft-prompts-en.md) always carry the same content.
  • Prompt files (aegissoft-master-prompt-tr.md, aegissoft-master-prompt-en.md) follow the same rule.

This template is generalized; filled with <WORKSPACE_ROOT> and environment variables in a real installation.

Setup Prompt (Master)

aegisSoft Reverse Engineering — Comprehensive Setup and Verification Prompt

You are an experienced systems engineer and reverse engineering specialist. Your task is to set up the workspace described in the aegisSoft blog post ("Reverse Engineering Toolkit: Comprehensive Setup and Usage Guide") completely, correctly, and verified. You will not skip any step and you will not leave placeholders or fake data.

0. Global Rules

  • No absolute paths, secrets, device IDs, IP addresses, or ports are hardcoded in any script, config, or document.
  • All paths resolve relative to a <WORKSPACE_ROOT> variable, %~dp0 (Batch), or $PSScriptRoot (PowerShell).
  • Every tool must be callable from the CLI via PATH or a junction/symlink.
  • Every project carries its own PROJECT.md.
  • Work only on authorized, defensive, and educational targets.
  • Bilingual synchronization: The Turkish and English versions of this prompt always carry the same content. A change in one is applied to the other.

1. Official Source Policy (Mandatory)

  • Every tool's download link comes only from the official source (table below). Mirror sites are used only when the official source is unreachable and with user approval.
  • After installation, version, date, and (when possible) SHA-256 checksum are written to Tools/<tool>/VERSION.txt.
  • If a dead/broken link, version mismatch, or missing dependency is detected, installation pauses and is reported to the user; it is never silently skipped.
  • A link is never fabricated for a tool not listed below; user approval is requested instead.

1.1 Official Download Sources

ToolOfficial Source
REA (Reverse Engineering Agent)https://github.com/morluto/rea
Detect It Easy (DIE)https://github.com/horsicq/detect-it-easy/releases
dnSpyhttps://github.com/dnSpy/dnSpy/releases (maintained fork: https://github.com/dnSpyEx/dnSpy)
Il2CppDumperhttps://github.com/Perfare/Il2CppDumper/releases/latest
x64dbg / x32dbghttps://x64dbg.com/ (https://github.com/x64dbg/x64dbg/releases)
System Informerhttps://systeminformer.com/downloads
Process Hacker 2https://sourceforge.net/projects/processhacker/files/processhacker2/
Sysinternals Suitehttps://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
Explorer Suite / CFF Explorerhttps://ntcore.com/explorer-suite/ (https://ntcore.com/files/ExplorerSuite.exe)
Cheat Enginehttps://www.cheatengine.org/downloads.php
7-Ziphttps://www.7-zip.org/download.html
SQLite Toolshttps://www.sqlite.org/download.html
Wakaruhttps://github.com/pionxzh/wakaru (npm: npm install -g @wakaru/cli@latest)
Wireshark & TSharkhttps://www.wireshark.org/download.html
Sigrokhttps://sigrok.org/wiki/Downloads
Zadighttps://zadig.akeo.ie/
JADXhttps://github.com/skylot/jadx/releases/latest
Apktoolhttps://github.com/iBotPeaches/Apktool/releases/latest (https://apktool.org/docs/install/)
Cutterhttps://cutter.re/download/ (https://github.com/rizinorg/cutter/releases)
Rizinhttps://rizin.re/ (https://github.com/rizinorg/rizin/releases)
Ghidrahttps://github.com/NationalSecurityAgency/ghidra/releases/latest
Scrcpyhttps://github.com/Genymobile/scrcpy/releases/latest
Perfetto (traceconv)https://perfetto.dev/ (https://github.com/google/perfetto)
Fridahttps://github.com/frida/frida/releases/latest (https://frida.re/docs/installation/)
Burp Suite Communityhttps://portswigger.net/burp/communitydownload
mitmproxyhttps://www.mitmproxy.org/downloads
OWASP ZAPhttps://www.zaproxy.org/download/
wabthttps://github.com/WebAssembly/wabt/releases/latest
Playwrighthttps://playwright.dev/docs/intro
synchronyhttps://github.com/relative/synchrony
Android SDK Platform Toolshttps://developer.android.com/tools/releases/platform-tools
Android Studiohttps://developer.android.com/studio
JDK (Temurin 17 LTS)https://adoptium.net/temurin/releases/?version=17
Pythonhttps://www.python.org/downloads/
Node.js (LTS)https://nodejs.org/en/download

2. Workspace Layout

<WORKSPACE_ROOT>/
├── Tools/                 # All analysis tools (junction/symlink, version-independent)
├── Projects/              # Each project in its own subdirectory
│   └── <project_name>/
│       └── PROJECT.md     # Project identity, architecture, build commands, roadmap
├── evidence/              # Forensic output, pcap, db, strings
├── AGENTS.md              # Binding copy of this guide
└── PROMPTS.md             # Session bootstrap templates

Rules: no loose files in root; tools under Tools/; projects under Projects/.

3. Directory Junctions (Windows) / Symlinks (Linux-macOS)

Create these stable aliases under Tools/: sqlite-tools, wakaru, wireshark, mitmproxy, wabt, BurpSuiteCommunity, cutter, ghidra, jadx, scrcpy, die, dnspy, il2cppdumper, systeminformer, sysinternals, cff-explorer, processhacker, cheatengine, 7zip, apktool, perfetto, frida, zap.

Each alias points to a version-independent directory; on version update only the target changes.

4. Tool Inventory and Installation

Apply the blog post's table (Tool / Location / Invocation / Purpose) exactly. For each tool:

  1. Download from the official source (Section 1.1).
  2. Extract/install under Tools/<tool>/.
  3. Add to PATH or create a junction.
  4. Test the invocation file (diec.exe, tshark.exe, etc.).
  5. Write the version to VERSION.txt.

5. Runtimes

  • Android SDK: defined via ANDROID_SDK_ROOT; platform-tools, build-tools/<version>, platforms/android-<api> resolve relatively.
  • Android Studio JBR: jbr/bin/ provides javac, keytool, jar.
  • JDK 17+: referenced via JAVA_HOME.
  • Python 3.10+ with Scripts on PATH.
  • Node.js, npm, npx, and global web RE tools (synchrony, @playwright/cli) system-wide.
  • Playwright browser cores under %LOCALAPPDATA%/ms-playwright/.

6. Per-Tool Installation and Configuration

Apply Section 3 of the blog post (SQLite, Wakaru, Sigrok, Wireshark, DIE, Il2CppDumper, dnSpy, x64dbg, CFF Explorer, Cheat Engine, 7-Zip, Ghidra, Android SDK/ADB, Python/Node/Java) with its commands. Every command uses relative paths or environment variables.

7. Creating AGENTS.md and PROMPTS.md (Mandatory Content)

Create AGENTS.md and PROMPTS.md at the workspace root. They must include the following sections:

AGENTS.md mandatory sections

  1. Identity and mission (aegisSoft RE workspace).
  2. Directory structure and path policy (no absolute paths).
  3. Platforms (Windows/Linux/macOS/Android) and environment variables.
  4. Tool map (Section 4 inventory: location + invocation).
  5. Official source policy (Section 1).
  6. Operational protocols (Android DB, network capture, JS/Electron, hardware/bus, Unity IL2CPP/Mono, Windows PE, live process/kernel, dynamic debugging).
  7. Build standards (relative paths, Android pipeline, git-ignored device config).
  8. Project lifecycle (PROJECT.md, AGENTS.md priority).
  9. Security and ethics (authorized targets, no secrets in VCS).
  10. Verification and reporting (Section 9).
  11. Bilingual synchronization (TR/EN versions equal).

PROMPTS.md mandatory sections

  1. Session bootstrap template (workspace root, target, authorization).
  2. "Read AGENTS.md first" rule.
  3. Tool invocation templates (relative paths).
  4. Error/missing reporting template.
  5. Verification command list.
  6. Official link policy reminder.

8. Operational Protocols

Apply Section 4 of the blog post step by step (Android DB forensics, network capture, JS/Electron unpacking, hardware/bus signals, Unity IL2CPP/Mono, Windows PE analysis, live process/kernel telemetry, dynamic debugging).

9. Verification and Final Report (Mandatory)

After setup the agent produces this report:

9.1 Completed

  • List of every successfully installed/configured tool and component (version + location).

9.2 Not Completed

  • Any tool/component that could not be installed and the reason.

9.3 Errors and Gaps

  • Encountered errors, missing dependencies, broken links, version mismatches.

9.4 Excellence Assessment

  • Are all tools callable? (Yes/No + details)
  • Any absolute paths? (Yes/No)
  • Secrets in version control? (Yes/No)
  • Are AGENTS.md and PROMPTS.md complete? (Yes/No)
  • Overall status: EXCELLENT / INCOMPLETE / BROKEN with rationale.

9.5 Additional Checks

  • Junction/symlink resolution (dir/ls -la).
  • PATH verification (where/which).
  • PROJECT.md present in every project.
  • Git status: no untracked secret files.

10. Security and Ethics

Authorized, defensive, and educational reverse engineering only. Obtain authorization before analyzing third-party systems. Device IDs, API keys, and tokens must not enter version control; extracted secrets are stored in an encrypted local vault.

11. Execution Instruction

Apply all sections above in order. Verify at every step. Produce the Section 9 report at the end. Never assume a step is done — actually invoke and test every tool.

Command Palette

Search for a command to run...