Installation

Installation

install-retoolkit.sh provisions a complete reverse-engineering environment on Debian and Kali. This page covers requirements, how the layered install works, what is optional, and how to verify or repair an installation.

Contents

• Requirements
• Standard install
• How the layered install works
• Layer reference
• Options
• Opt-in components
• Verifying an install
• Partial and repeat installs
• What gets installed where
• Uninstalling

Requirements

Requirement	Detail
Operating system	Kali Rolling 2024 or later, or Debian 12 or later
Privileges	sudo. The install is system-wide by design.
Disk space	Roughly 20 GB for a full install including Ghidra
Memory	8 GB minimum, 16 GB recommended for Ghidra on large binaries
Network	Required during installation only

The analyzer runs entirely offline once provisioned. Only the installer needs network access.

Install into a disposable virtual machine. This is a system-wide install that adds package repositories, builds software from source, and places tools on the system path. It is not intended for a workstation you rely on for other work.

Standard install

git clone https://github.com/Sandler73/RE-Toolkit.git
cd RE-Toolkit
sudo ./install-retoolkit.sh

Expect the full install to take a while. Ghidra is a large download, and several components are compiled from source when no package is available.

On completion the installer prints a verification table showing every tool as PASS or FAIL, followed by a summary of anything unresolved.

How the layered install works

The installer provisions in numbered layers. Three properties define its behavior, and understanding them prevents most confusion.

Distribution packages first, source builds second. Packaged tools are installed through apt. Source builds exist only as a fallback for tools a rolling distribution may not carry at a given moment. LAYER 2H runs after LAYER 1 specifically to recover packages apt could not resolve.

The consequence matters when reading output: an apt miss is not necessarily a failure. Several tools are expected to be unavailable through apt on some distributions and are recovered by a source build later. The installer does not report those as failures until LAYER 2H has had its opportunity. Wait for the post-LAYER-2H summary before treating an apt-stage message as a real problem.

It does not stop at the first failure. The installer deliberately does not enable set -e. A single package failure must not abort provisioning and leave a half-built system with no explanation. Failures are captured, logged, and reported in the verification table at the end.

It is idempotent. Existing installs are detected and skipped. Re-running is safe, and is the normal way to repair a partial install.

Every phase writes its output to /var/log/retoolkit/, so nothing is silently swallowed. When something fails, that directory holds the reason.

Layer reference

Layer	Installs	Skip with
0	Analyzer source into /opt/retoolkit/	--skip-source
1	System packages via apt	--skip-apt
2	Microsoft .NET SDK and ilspycmd	--skip-dotnet
2B	Detect It Easy, packer and compiler fingerprinting
2C	de4dot-cex, the .NET deobfuscator
2D	TrID signature database
2E	Release-packaged .NET and PE analysis tools
2F	yarGen. The goodware database is opt-in.
2G	Mobile tooling: jadx, apktool, baksmali
2H	Source-build recovery for unresolved apt packages
3	Python virtual environment and analysis libraries	--skip-python
4	Ghidra	--skip-ghidra
4B	cwe_checker	--with-cwe-checker
4C	redress, for Go binary analysis	--with-redress
4D	rustfilt, for Rust name demangling	--with-rustfilt
4E	findaes, AES key scanner	--with-findaes
5	capa and YARA rule sets	--skip-rules
8	qiling emulator, dynamic Tier 1
9	Docker and the dynamic analysis image	--with-docker
10	cuckoo sandbox checks and guidance	--with-cuckoo
11	RetDec decompiler	--with-retdec
12	Post-install verification

Layers 6 and 7 do not exist. Layer 6 was renumbered to Layer 12, and Layer 7 was reserved but never allocated. The gap is preserved deliberately, because renumbering would invalidate every log file and document that refers to a layer by number.

Options

Phase-skip options

Use these for partial or incremental installs.

Option	Effect
--skip-source	Do not install analyzer source to /opt/retoolkit/. Use when running from a development checkout.
--skip-apt	Skip the system package phase
--skip-dotnet	Skip the .NET SDK and ilspycmd
--skip-python	Skip the Python virtual environment
--skip-ghidra	Skip Ghidra. Leaves an existing /opt/ghidra alone.
--skip-rules	Skip cloning capa and YARA rules

Behavioral options

Option	Effect
--verify	Run only post-install verification. Changes nothing.
--force	Reinstall everything, overwriting existing installs
--install-ghidrathon	Install Ghidrathon. Opt-in; see the note below.
--verbose, -v	Verbose output, equivalent to --log-level=debug
--log-level LEVEL	One of debug, info, warn, error. Default info.
--version, -V	Print the version and exit
--help, -h	Print help and exit

--verbose is an alias for --log-level=debug only when the log level is still at its default. If you set --log-level explicitly, --verbose does not override it.

Ghidrathon is opt-in because it can break the Ghidra GUI on some Java 21 builds. It is not needed for command-line analysis, which uses pyghidra instead.

Opt-in components

These are off by default because each adds significant install time, disk usage, or operational risk.

Option	Adds	Cost
--with-cwe-checker	Static CWE detection over binary IR	A Rust build, several minutes; installs rustup when absent
--with-redress	Go binary structure recovery	Go build
--with-rustfilt	Rust symbol demangling	Small; shares the rustup install
--with-findaes	AES key scanning in memory images	Source build
--with-yargen-db	yarGen goodware database	Roughly 913 MB download
--with-docker	Docker and the dynamic analysis image	Large; enables dynamic Tier 3
--with-cuckoo	cuckoo presence checks and setup guidance	Small; see note
--with-retdec	RetDec decompiler via container image	Large image pull

Without --with-yargen-db, yarGen still installs and runs, but cannot apply goodware filtering, so generated rules are noisier.

--with-cuckoo does not perform an automated cuckoo installation. A working cuckoo deployment requires a hypervisor, an analyst virtual machine, and agent configuration, all of which are environment-specific. The installer verifies whether cuckoo is present and provides guidance.

A full install with every opt-in component:

sudo ./install-retoolkit.sh --with-docker --with-cuckoo --with-retdec \
    --with-redress --with-rustfilt --with-findaes --with-yargen-db \
    --with-cwe-checker --install-ghidrathon

Verifying an install

sudo ./install-retoolkit.sh --verify

This runs only the verification layer and produces a PASS/FAIL matrix for every tool without performing any install work. Use it to health-check an environment, or to confirm whether an install that appeared to succeed actually did.

That last case is worth stating plainly: an installer can complete without obvious error while leaving specific tools unusable. --verify is how you find out, and it is the fastest first step when a stage reports a tool as missing.

Partial and repeat installs

Re-running the installer is safe and is the intended repair path. Existing components are detected and skipped, so a second run addresses only what did not succeed the first time.

When a component needs to be rebuilt, for example after an upstream change:

sudo ./install-retoolkit.sh --force

To reinstall a single area, combine --force with skip flags for everything else. To rebuild only the Python environment:

sudo ./install-retoolkit.sh --force --skip-apt --skip-dotnet \
    --skip-ghidra --skip-rules --skip-source

When an install fails partway, check the per-phase logs in /var/log/retoolkit/ before re-running. The log identifies which layer failed and why, which usually distinguishes a transient network problem from a genuine incompatibility.

What gets installed where

Path	Contents
/opt/retoolkit/	Analyzer source: driver, lib/, stages/, GhidraDump.py
/usr/local/bin/analyze-binaries.sh	Symlink to the driver
/opt/ghidra	Ghidra installation
/opt/capa-rules/	capa rule set
/opt/yara-rules/	YARA rule set
/opt/trid/	TrID signature database
/opt/qiling-rootfs/	Root filesystems for qiling emulation
/var/log/retoolkit/	Per-phase installation logs
/etc/profile.d/retools.sh	Exports CAPA_RULES and YARA_RULES

Rule paths are exported system-wide, so the analyzer finds them without configuration. Override them per run with --capa-rules and --yara-rules.

Uninstalling

There is no uninstall option. This is a deliberate consequence of the design: the installer adds distribution packages, a third-party package repository, and source-built software, and removing all of that reliably is not something a script can promise.

The supported approach is to discard the virtual machine, which is also the reason installing into a disposable VM is the documented practice.

To remove the RE-Toolkit-specific parts without touching installed packages:

sudo rm -rf /opt/retoolkit /opt/capa-rules /opt/yara-rules /opt/trid
sudo rm -f /usr/local/bin/analyze-binaries.sh /etc/profile.d/retools.sh
sudo rm -rf /var/log/retoolkit

This leaves every tool the installer provisioned in place. Removing those means removing the packages and source builds individually.