# aegisSoft Reverse Engineering — Comprehensive Setup and Verification Prompt

You are an experienced systems engineer and reverse engineering specialist. Your task is to set up the workspace described in the aegisSoft blog post ("Reverse Engineering Toolkit: Comprehensive Setup and Usage Guide") **completely, correctly, and verified**. You will not skip any step and you will not leave placeholders or fake data.

## 0. Global Rules

- No absolute paths, secrets, device IDs, IP addresses, or ports are **hardcoded** in any script, config, or document.
- All paths resolve relative to a `<WORKSPACE_ROOT>` variable, `%~dp0` (Batch), or `$PSScriptRoot` (PowerShell).
- Every tool must be callable from the CLI via PATH or a junction/symlink.
- Every project carries its own `PROJECT.md`.
- Work only on authorized, defensive, and educational targets.
- **Bilingual synchronization:** The Turkish and English versions of this prompt always carry the same content. A change in one is applied to the other.

## 1. Official Source Policy (Mandatory)

- Every tool's download link comes **only from the official source** (table below). Mirror sites are used only when the official source is unreachable and with user approval.
- After installation, version, date, and (when possible) SHA-256 checksum are written to `Tools/<tool>/VERSION.txt`.
- If a dead/broken link, version mismatch, or missing dependency is detected, installation **pauses** and is reported to the user; it is never silently skipped.
- A link is never fabricated for a tool not listed below; user approval is requested instead.

### 1.1 Official Download Sources

| Tool | Official Source |
| --- | --- |
| REA (Reverse Engineering Agent) | https://github.com/morluto/rea |
| Detect It Easy (DIE) | https://github.com/horsicq/detect-it-easy/releases |
| dnSpy | https://github.com/dnSpy/dnSpy/releases (maintained fork: https://github.com/dnSpyEx/dnSpy) |
| Il2CppDumper | https://github.com/Perfare/Il2CppDumper/releases/latest |
| x64dbg / x32dbg | https://x64dbg.com/ (https://github.com/x64dbg/x64dbg/releases) |
| System Informer | https://systeminformer.com/downloads |
| Process Hacker 2 | https://sourceforge.net/projects/processhacker/files/processhacker2/ |
| Sysinternals Suite | https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite |
| Explorer Suite / CFF Explorer | https://ntcore.com/explorer-suite/ (https://ntcore.com/files/ExplorerSuite.exe) |
| Cheat Engine | https://www.cheatengine.org/downloads.php |
| 7-Zip | https://www.7-zip.org/download.html |
| SQLite Tools | https://www.sqlite.org/download.html |
| Wakaru | https://github.com/pionxzh/wakaru (npm: `npm install -g @wakaru/cli@latest`) |
| Wireshark & TShark | https://www.wireshark.org/download.html |
| Sigrok | https://sigrok.org/wiki/Downloads |
| Zadig | https://zadig.akeo.ie/ |
| JADX | https://github.com/skylot/jadx/releases/latest |
| Apktool | https://github.com/iBotPeaches/Apktool/releases/latest (https://apktool.org/docs/install/) |
| Cutter | https://cutter.re/download/ (https://github.com/rizinorg/cutter/releases) |
| Rizin | https://rizin.re/ (https://github.com/rizinorg/rizin/releases) |
| Ghidra | https://github.com/NationalSecurityAgency/ghidra/releases/latest |
| Scrcpy | https://github.com/Genymobile/scrcpy/releases/latest |
| Perfetto (traceconv) | https://perfetto.dev/ (https://github.com/google/perfetto) |
| Frida | https://github.com/frida/frida/releases/latest (https://frida.re/docs/installation/) |
| Burp Suite Community | https://portswigger.net/burp/communitydownload |
| mitmproxy | https://www.mitmproxy.org/downloads |
| OWASP ZAP | https://www.zaproxy.org/download/ |
| wabt | https://github.com/WebAssembly/wabt/releases/latest |
| Playwright | https://playwright.dev/docs/intro |
| synchrony | https://github.com/relative/synchrony |
| Android SDK Platform Tools | https://developer.android.com/tools/releases/platform-tools |
| Android Studio | https://developer.android.com/studio |
| JDK (Temurin 17 LTS) | https://adoptium.net/temurin/releases/?version=17 |
| Python | https://www.python.org/downloads/ |
| Node.js (LTS) | https://nodejs.org/en/download |

## 2. Workspace Layout

```
<WORKSPACE_ROOT>/
├── Tools/                 # All analysis tools (junction/symlink, version-independent)
├── Projects/              # Each project in its own subdirectory
│   └── <project_name>/
│       └── PROJECT.md     # Project identity, architecture, build commands, roadmap
├── evidence/              # Forensic output, pcap, db, strings
├── AGENTS.md              # Binding copy of this guide
└── PROMPTS.md             # Session bootstrap templates
```

Rules: no loose files in root; tools under `Tools/`; projects under `Projects/`.

## 3. Directory Junctions (Windows) / Symlinks (Linux-macOS)

Create these stable aliases under `Tools/`: `sqlite-tools`, `wakaru`, `wireshark`, `mitmproxy`, `wabt`, `BurpSuiteCommunity`, `cutter`, `ghidra`, `jadx`, `scrcpy`, `die`, `dnspy`, `il2cppdumper`, `systeminformer`, `sysinternals`, `cff-explorer`, `processhacker`, `cheatengine`, `7zip`, `apktool`, `perfetto`, `frida`, `zap`.

Each alias points to a version-independent directory; on version update only the target changes.

## 4. Tool Inventory and Installation

Apply the blog post's table (Tool / Location / Invocation / Purpose) exactly. For each tool:
1. Download from the official source (Section 1.1).
2. Extract/install under `Tools/<tool>/`.
3. Add to PATH or create a junction.
4. Test the invocation file (`diec.exe`, `tshark.exe`, etc.).
5. Write the version to `VERSION.txt`.

## 5. Runtimes

- Android SDK: defined via `ANDROID_SDK_ROOT`; `platform-tools`, `build-tools/<version>`, `platforms/android-<api>` resolve relatively.
- Android Studio JBR: `jbr/bin/` provides `javac`, `keytool`, `jar`.
- JDK 17+: referenced via `JAVA_HOME`.
- Python 3.10+ with `Scripts` on PATH.
- Node.js, npm, npx, and global web RE tools (`synchrony`, `@playwright/cli`) system-wide.
- Playwright browser cores under `%LOCALAPPDATA%/ms-playwright/`.

## 6. Per-Tool Installation and Configuration

Apply Section 3 of the blog post (SQLite, Wakaru, Sigrok, Wireshark, DIE, Il2CppDumper, dnSpy, x64dbg, CFF Explorer, Cheat Engine, 7-Zip, Ghidra, Android SDK/ADB, Python/Node/Java) with its commands. Every command uses relative paths or environment variables.

## 7. Creating AGENTS.md and PROMPTS.md (Mandatory Content)

Create `AGENTS.md` and `PROMPTS.md` at the workspace root. They must include the following sections:

### AGENTS.md mandatory sections
1. Identity and mission (aegisSoft RE workspace).
2. Directory structure and path policy (no absolute paths).
3. Platforms (Windows/Linux/macOS/Android) and environment variables.
4. Tool map (Section 4 inventory: location + invocation).
5. Official source policy (Section 1).
6. Operational protocols (Android DB, network capture, JS/Electron, hardware/bus, Unity IL2CPP/Mono, Windows PE, live process/kernel, dynamic debugging).
7. Build standards (relative paths, Android pipeline, git-ignored device config).
8. Project lifecycle (`PROJECT.md`, AGENTS.md priority).
9. Security and ethics (authorized targets, no secrets in VCS).
10. Verification and reporting (Section 9).
11. Bilingual synchronization (TR/EN versions equal).

### PROMPTS.md mandatory sections
1. Session bootstrap template (workspace root, target, authorization).
2. "Read AGENTS.md first" rule.
3. Tool invocation templates (relative paths).
4. Error/missing reporting template.
5. Verification command list.
6. Official link policy reminder.

## 8. Operational Protocols

Apply Section 4 of the blog post step by step (Android DB forensics, network capture, JS/Electron unpacking, hardware/bus signals, Unity IL2CPP/Mono, Windows PE analysis, live process/kernel telemetry, dynamic debugging).

## 9. Verification and Final Report (Mandatory)

After setup the agent produces this report:

### 9.1 Completed
- List of every successfully installed/configured tool and component (version + location).

### 9.2 Not Completed
- Any tool/component that could not be installed and the reason.

### 9.3 Errors and Gaps
- Encountered errors, missing dependencies, broken links, version mismatches.

### 9.4 Excellence Assessment
- Are all tools callable? (Yes/No + details)
- Any absolute paths? (Yes/No)
- Secrets in version control? (Yes/No)
- Are AGENTS.md and PROMPTS.md complete? (Yes/No)
- Overall status: **EXCELLENT / INCOMPLETE / BROKEN** with rationale.

### 9.5 Additional Checks
- Junction/symlink resolution (`dir`/`ls -la`).
- PATH verification (`where`/`which`).
- `PROJECT.md` present in every project.
- Git status: no untracked secret files.

## 10. Security and Ethics

Authorized, defensive, and educational reverse engineering only. Obtain authorization before analyzing third-party systems. Device IDs, API keys, and tokens must not enter version control; extracted secrets are stored in an encrypted local vault.

## 11. Execution Instruction

Apply all sections above in order. Verify at every step. Produce the Section 9 report at the end. Never assume a step is done — actually invoke and test every tool.