# Quick Start

## Prerequisites

| Component | Debian/Ubuntu | Arch Linux | Purpose |
|---|---|---|---|
| Rust toolchain | `rustup` | `rustup` | Core compilation |
| LLVM / Clang | `clang`, `llvm` | `clang`, `llvm` | eBPF bytecode compilation |
| MinGW-w64 | `g++-mingw-w64-x86-64` | `mingw-w64-gcc` | Wine plugin cross-compilation |
| libcap | `libcap2-bin` | `libcap` | Capability management |
| X11/Wayland | `libx11-dev`, `libwayland-dev` | `libx11`, `wayland` | egui rendering backend |

## Build

```bash
git clone https://github.com/warlock-architecture/stave-core.git
cd stave-core
cargo run --bin environment_check    # Verify tooling
chmod +x build.sh
./build.sh                           # Compile everything
```

## Optional: Enable Kernel Tracing

The eBPF probe requires elevated permissions. This step is **not** required for FFI, JNI, IPC, or UI-only usage:

```bash
sudo setcap cap_net_admin,cap_perfmon+ep ./target/release/libstave_core.so
```

## Verify

Open two terminals:

```bash
# Terminal 1: Start the engine (your host application loads libstave_core)
cargo run --bin simulate_evasion_telemetry

# Terminal 2: Run the evasion simulator
cargo run --bin simulate_evasion_telemetry
```

## Hotkey Reference

| Key | Action |
|---|---|
| F1 | Help overlay |
| F2 | Load target binary / attach to PID |
| F3 | Inline micro-assembler (patch opcodes) |
| F4 | Cycle Q3 view mode (hex / assembly / headers) |
| F5 | Go to address / symbol |
| F6 | Search byte pattern or string |
| F7 | Step into (trace into CALL targets) |
| F8 | Step over (execute loops at native speed) |
| Alt+L | Toggle loop filter on hex grid |
| Alt+B | Toggle breakpoint filter on hex grid |
| Alt+D | Toggle disk I/O filter on hex grid |
| Alt+N | Toggle network I/O filter on hex grid |
| Ctrl+G | Follow pointer address in data viewport |
| Ctrl+T | Cast struct overlay onto hex view |
| Ctrl+Z | Undo last patch |
| F10 | Exit and flush telemetry |

> **Note:** Hotkeys are documented but not yet wired to the egui event loop. This is a planned feature.