Reverse Engineering Toolkit: Comprehensive Setup and Usage Guide
This post collects every tool used in the aegisSoft reverse engineering workspace in one place. For each tool it explains what it does, how to install it, how to configure it, and how it is used in a typical operation. It ships with generalized AGENTS.md and PROMPTS.md templates:
0. Workspace Philosophy
The most common mistake in reverse engineering is installing tools first and asking "what is where" later. Core principle: tools must be callable independent of location, no script may contain a hardcoded absolute path, and every project carries its own PROJECT.md. All paths resolve relatively or through environment variables; nothing is hardcoded.
Recommended top-level layout:
<WORKSPACE_ROOT>/
├── Tools/ # All analysis tools (junction/symlink for version independence)
├── Projects/ # Each project in its own subdirectory
│ └── <project_name>/
│ └── PROJECT.md
├── evidence/ # Forensic outputs, pcap, db, strings
├── AGENTS.md
└── PROMPTS.md
1. Tool Inventory
| Tool | Location | Entry | Purpose |
|---|---|---|---|
| REA | Tools/rea/ | MCP | Primary autonomous RE, ADB and binary analysis bridge |
| Detect It Easy | Tools/die/ | diec.exe, die.exe | Packer/compiler/protection/entropy detection |
| dnSpy | Tools/dnspy/ | dnSpy.exe | .NET decompile (C#), CIL patch, runtime debug |
| Il2CppDumper | Tools/il2cppdumper/ | Il2CppDumper.exe | Unity IL2CPP symbols (dump.cs, script.json, il2cpp.h) |
| x64dbg/x32dbg | Tools/x64dbg/ | x96dbg.exe | Native user-mode debugger |
| System Informer | Tools/systeminformer/ | SystemInformer.exe | Kernel-level process/DLL/memory/PE |
| Process Hacker 2 | Tools/processhacker/ | ProcessHacker.exe | Process/service/socket inspection |
| Sysinternals | Tools/sysinternals/ | procmon64.exe etc | Live events, persistence, strings |
| CFF Explorer | Tools/cff-explorer/ | CFF Explorer.exe | PE headers, ASLR/DEP, IAT |
| Cheat Engine | Tools/cheatengine/ | Cheat Engine.exe | Memory/pointer/AOB/Lua |
| 7-Zip | Tools/7zip/ | 7z.exe | Multi-format extraction |
| SQLite Tools | Tools/sqlite-tools/ | sqlite3, sqldiff, sqlite3_analyzer | DB query/diff/B-Tree |
| Wakaru | Tools/wakaru/ | wakaru.exe | JS bundle unpack/decompile |
| Wireshark/TShark | Tools/wireshark/ | tshark.exe | Packet capture/DPI/TLS |
| Sigrok-CLI/Zadig | Tools/sigrok-cli/ | sigrok-cli.exe | Logic analyzer/protocols/drivers |
| JADX | Tools/jadx/ | jadx.bat | DEX to Java |
| Apktool | Tools/ | apktool.bat | APK decode/rebuild |
| Cutter/Rizin | Tools/cutter/ | cutter.exe | ELF/PE/Mach-O reversing |
| Ghidra | Tools/ghidra/ | ghidraRun.bat | Decompiler/headless |
| Scrcpy | Tools/scrcpy/ | scrcpy.exe | Android mirroring |
| Perfetto | Tools/perfetto/ | perfetto.exe | System profiling |
| Frida Server | Tools/ | frida-server-*.exe | Dynamic hook/injection |
| Burp Suite | Tools/BurpSuiteCommunity/ | BurpSuiteCommunity.exe | Web proxy/testing |
| mitmproxy | Tools/mitmproxy/ | mitmproxy.exe | TLS intercepting proxy |
| OWASP ZAP | Tools/ZAP/ | ZAP.exe | Web scanner/fuzzer |
| wabt | Tools/wabt/bin/ | wasm2wat.exe | WASM decompile |
| Playwright | System | npx playwright | Browser automation |
| synchrony | System | synchrony | JS deobfuscation |
2. Setup Principles
- Collect all tools under one
Tools/root; use junctions/symlinks for version-independent calls. - No hardcoded absolute paths in scripts; use
%~dp0,$PSScriptRootor relative resolution. - Keep device IDs, IP/port and API keys out of version control in a local git-ignored config.
- Every tool on PATH should be callable directly from the CLI.
3. Tool-by-Tool Setup
SQLite Tools
sqlite3, sqldiff, sqlite3_analyzer on PATH. Query with sqlite3 app_data.db, .schema, .tables. Export CSV/JSON. Diff with sqldiff. B-Tree map with sqlite3_analyzer.
Wakaru
wakaru on PATH. wakaru -u auto -o output_dir bundle.js; strict unpack; Vue SFC; Bun extraction; source map extraction; DCE.
Sigrok-CLI & Zadig
sigrok-cli and zadig.exe on PATH. Scan, capture, decode I2C/SPI/UART, assign WinUSB/libusb via Zadig.
Wireshark & TShark
tshark, dumpcap, editcap, mergecap, capinfos on PATH. Capture, ring buffer, filter, TLS decryption with SSLKEYLOGFILE, export objects, split/merge.
Detect It Easy
diec, die, diel on PATH. Basic, entropy, deep scan, JSON report, GUI.
Il2CppDumper
Il2CppDumper.exe on PATH. Command: Il2CppDumper.exe <libil2cpp.so/GameAssembly.dll> <global-metadata.dat> <output_dir>. Outputs dump.cs, script.json, il2cpp.h, stringliteral.json. Import symbols into Ghidra via ghidra_with_struct.py.
dnSpy
dnSpy.exe, dnSpy.Console.exe on PATH. Open assembly, edit method (C#), edit IL, attach debugger.
x64dbg
x96dbg.exe, x64dbg.exe, x32dbg.exe on PATH. Architecture selector, breakpoints F2/F7/F8/F9, Ctrl+G, hardware bp bph, API bp bp.
System Informer & Process Hacker
SystemInformer.exe, ProcessHacker.exe, peview.exe on PATH. PE view, token inspection, live strings, handle search.
Sysinternals
procmon64.exe, procexp64.exe, autoruns64.exe, strings64.exe, handle64.exe, tcpview64.exe on PATH. Strings, Procmon capture/open, Autoruns, handles, network.
CFF Explorer
CFF Explorer.exe on PATH. Disable ASLR/DEP via DllCharacteristics, repair IAT, set section permissions 0xE0000020.
Cheat Engine
Cheat Engine.exe on PATH. Value scans, pointer scan, AOB injection via Auto Assemble.
7-Zip
7z.exe, 7zFM.exe on PATH. Extract, installer extraction, listing.
Ghidra
ghidraRun.bat, analyzeHeadless.bat on PATH. Headless import and post-scripts, Il2Cpp symbol import.
Burp Suite, mitmproxy, ZAP
Burp for proxy/Repeater/Intruder. mitmproxy for TLS intercepting proxy (CLI/web/scriptable). ZAP for scanning and fuzzing.
wabt
wasm2wat.exe, wat2wasm.exe, wasm-decompile.exe on PATH. WASM to WAT and decompilation.
Playwright & synchrony
Playwright browsers via npx playwright install. synchrony via npm install -g synchrony.
4. Operational Protocols
Android DB Forensics
Pull via run-as, dump schema, diff with sqldiff, analyze storage.
Network Capture
tshark capture, TLS with SSLKEYLOGFILE, export objects.
JS/Electron Unpacking
wakaru auto unpack, Vue SFC, source map extraction.
Hardware/Bus
sigrok scan, capture, decode I2C/SPI/UART.
Unity IL2CPP/Mono
Extract, Mono in dnSpy, Il2CppDumper, Ghidra import.
Windows PE
DIE scan, strings, CFF Explorer, peview.
Live Process/Kernel
Procmon capture, System Informer tracking.
Dynamic Debugging
x64dbg, API breakpoints, Cheat Engine validation.
5. Security and Ethics
Authorized, defensive and educational use only. Obtain proper authorization before analyzing third-party systems. Keep device IDs, API keys and tokens out of version control. Store extracted secrets in an encrypted local vault. EOF
6. Official Download Sources
The links below are official sources only. Mirror sites are used only when the official source is unreachable and with user approval. After installation, version and SHA-256 checksum are written to Tools/<tool>/VERSION.txt.