root
25f2286cb6
README 242 -> 180 lines: the 14-row tool table becomes three sentences pointing at capabilities.py, Read this first merges into Scope, and the six-script maintenance block becomes a table. Every path, command and anchor is unchanged. README.zh-CN follows the same eight sections, and picks up two drifts: it named hwprobe.py as the cheapest first command (SKILL.md and the English README say doctor.py), and it translated triage as 'three categories', which sends a reader looking for categories that do not exist. docs/primer is the Windows reverse-engineering tutorial series with an index, corrected in three places: x64dbg instead of OllyDbg, offsets fixed only within one build, and IAT hooking assuming the target imports the API it hooks. docs/tool-acquisition keeps the part capabilities.py does not answer: licence classes, id resolution on the host, and what proves a tool runs.
3.4 KiB
Tool acquisition, and what it costs
What this answers: how a tool gets onto an analysis host, what its licence permits, and how
you know it actually runs. This is the part capabilities.py reports as a gap but does not
close -- the probe says "missing", and this says what to do about it.
When to load this: when a route is blocked by an absent tool, or when its real cost is a licence rather than an install.
Licence class before download
| Class | Examples | What it costs you |
|---|---|---|
| Open | Ghidra, radare2/rizin, x64dbg, Frida, gdb, lldb, upx, 7-Zip | nothing; support and maintenance are the real cost |
| Free, restricted | IDA Free (non-commercial), Cheat Engine, most vendor trials | a licence condition, not a price; a commercial engagement may exclude it |
| Commercial | IDA Pro + Hex-Rays, Binary Ninja, Hopper | a per-seat licence; procurement lead time is part of the plan |
| Trial | vendor time-limited builds | an expiry date in the middle of a session; write it down |
No cracked builds, no key generators, no patched installers. Two reasons, and the second is the engineering one: a patched binary is an untrusted binary, and you would run it on the machine whose integrity every later measurement depends on. An unlicensed tool is a capability you do not have -- record it that way.
An id copied from a document is unverified until a search returns it
winget search, brew search, apt-cache search. Identifiers get renamed, forks get
republished, and a mirror is not the vendor's build. The resolution is one command, and it is the
difference between a record of what happened and a guess that worked once.
Two more things worth knowing before the install: WinDbg exists as a Store build and as the SDK's
Debugging Tools (cdb/kd), and those are different command lines; on macOS a downloaded bundle
carries a quarantine attribute, so verify the hash before removing it.
"Installed" is not "available"
| Kind | What proves it works | What it does not prove |
|---|---|---|
| CLI | the version string and one real command on a fixture you control | that it parses your target without error |
| GUI | it opened the sample and rendered a function list, witnessed by a human | that the analysis finished, or that the decompiler is licensed |
| Kernel / driver | the second machine answered on the debug link | that the driver loads on this build |
A GUI-only tool is a request for a human, not an unavailable capability. A weaker CLI substitute is not the same capability, and a headless host cannot render the real one.
When the tool is paid and you cannot pay
- Use the free implementation and record what it cannot do. Ghidra's decompiler differs from Hex-Rays in readability, not in existence; "recovered with Ghidra, control flow verified by hand" is a real result.
- Ask the requester to license it. A procurement question with a lead time, not a technical blocker -- name the blocked route and its cost.
- Narrow the deliverable so the missing capability is not on the critical path.
What to record
Per tool: class, version, absolute path, the smoke test you ran, and a label -- observed
(you ran it), inferred (the install succeeded, you did not run it), unverified (someone told
you it is there). Then re-run doctor.py and keep both outputs: their difference is the change
you made to the experiment.