64 lines
2.0 KiB
Markdown
64 lines
2.0 KiB
Markdown
# Quick Start
|
|
|
|
## Prerequisites
|
|
|
|
| Component | Debian/Ubuntu | Arch Linux | Purpose |
|
|
|---|---|---|---|
|
|
| Rust toolchain | `rustup` | `rustup` | Core compilation |
|
|
| LLVM / Clang | `clang`, `llvm` | `clang`, `llvm` | eBPF bytecode compilation |
|
|
| MinGW-w64 | `g++-mingw-w64-x86-64` | `mingw-w64-gcc` | Wine plugin cross-compilation |
|
|
| libcap | `libcap2-bin` | `libcap` | Capability management |
|
|
| X11/Wayland | `libx11-dev`, `libwayland-dev` | `libx11`, `wayland` | egui rendering backend |
|
|
|
|
## Build
|
|
|
|
```bash
|
|
git clone https://github.com/warlock-architecture/stave-core.git
|
|
cd stave-core
|
|
cargo run --bin environment_check # Verify tooling
|
|
chmod +x build.sh
|
|
./build.sh # Compile everything
|
|
```
|
|
|
|
## Optional: Enable Kernel Tracing
|
|
|
|
The eBPF probe requires elevated permissions. This step is **not** required for FFI, JNI, IPC, or UI-only usage:
|
|
|
|
```bash
|
|
sudo setcap cap_net_admin,cap_perfmon+ep ./target/release/libstave_core.so
|
|
```
|
|
|
|
## Verify
|
|
|
|
Open two terminals:
|
|
|
|
```bash
|
|
# Terminal 1: Start the engine (your host application loads libstave_core)
|
|
cargo run --bin simulate_evasion_telemetry
|
|
|
|
# Terminal 2: Run the evasion simulator
|
|
cargo run --bin simulate_evasion_telemetry
|
|
```
|
|
|
|
## Hotkey Reference
|
|
|
|
| Key | Action |
|
|
|---|---|
|
|
| F1 | Help overlay |
|
|
| F2 | Load target binary / attach to PID |
|
|
| F3 | Inline micro-assembler (patch opcodes) |
|
|
| F4 | Cycle Q3 view mode (hex / assembly / headers) |
|
|
| F5 | Go to address / symbol |
|
|
| F6 | Search byte pattern or string |
|
|
| F7 | Step into (trace into CALL targets) |
|
|
| F8 | Step over (execute loops at native speed) |
|
|
| Alt+L | Toggle loop filter on hex grid |
|
|
| Alt+B | Toggle breakpoint filter on hex grid |
|
|
| Alt+D | Toggle disk I/O filter on hex grid |
|
|
| Alt+N | Toggle network I/O filter on hex grid |
|
|
| Ctrl+G | Follow pointer address in data viewport |
|
|
| Ctrl+T | Cast struct overlay onto hex view |
|
|
| Ctrl+Z | Undo last patch |
|
|
| F10 | Exit and flush telemetry |
|
|
|
|
> **Note:** Hotkeys are documented but not yet wired to the egui event loop. This is a planned feature. |