warlocks-stave/QuickStart.md

Quick Start

Prerequisites

Component	Debian/Ubuntu	Arch Linux	Purpose
Rust toolchain	rustup	rustup	Core compilation
LLVM / Clang	clang, llvm	clang, llvm	eBPF bytecode compilation
MinGW-w64	g++-mingw-w64-x86-64	mingw-w64-gcc	Wine plugin cross-compilation
libcap	libcap2-bin	libcap	Capability management
X11/Wayland	libx11-dev, libwayland-dev	libx11, wayland	egui rendering backend

Build

git clone https://github.com/warlock-architecture/stave-core.git
cd stave-core
cargo run --bin environment_check    # Verify tooling
chmod +x build.sh
./build.sh                           # Compile everything

Optional: Enable Kernel Tracing

The eBPF probe requires elevated permissions. This step is not required for FFI, JNI, IPC, or UI-only usage:

sudo setcap cap_net_admin,cap_perfmon+ep ./target/release/libstave_core.so

Verify

Open two terminals:

# Terminal 1: Start the engine (your host application loads libstave_core)
cargo run --bin simulate_evasion_telemetry

# Terminal 2: Run the evasion simulator
cargo run --bin simulate_evasion_telemetry

Hotkey Reference

Key	Action
F1	Help overlay
F2	Load target binary / attach to PID
F3	Inline micro-assembler (patch opcodes)
F4	Cycle Q3 view mode (hex / assembly / headers)
F5	Go to address / symbol
F6	Search byte pattern or string
F7	Step into (trace into CALL targets)
F8	Step over (execute loops at native speed)
Alt+L	Toggle loop filter on hex grid
Alt+B	Toggle breakpoint filter on hex grid
Alt+D	Toggle disk I/O filter on hex grid
Alt+N	Toggle network I/O filter on hex grid
Ctrl+G	Follow pointer address in data viewport
Ctrl+T	Cast struct overlay onto hex view
Ctrl+Z	Undo last patch
F10	Exit and flush telemetry

Note: Hotkeys are documented but not yet wired to the egui event loop. This is a planned feature.