# What Role Does the Offline-Sample Preset Play in Local Sample Analysis?

> Discover the role of the offline-sample preset in local sample analysis. This shortcut enables immediate, secure analysis by granting authentication, forcing offline mode, and registering local binaries without network exposure.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-28

---

**The `offline-sample` preset is a case-initialization shortcut that grants authentication, forces offline mode, and registers a local binary as an in-scope asset, enabling immediate analysis without network exposure.**

When working with the `zhaoxuya520/reverse-skill` framework, analysts must satisfy strict authentication and network isolation requirements before processing potentially malicious binaries. The `offline-sample` preset streamlines this workflow by bundling authorization, offline network configuration, and asset registration into a single command-line flag, eliminating the need for external network access during case setup.

## How the Offline-Sample Preset Configures Local Analysis

The preset operates by executing a deterministic sequence of environment variable assignments and asset registrations within the case initialization scripts. These actions satisfy the framework’s security gates while preparing the workspace for reverse engineering.

### Automatic Authentication Grant

When invoked, the preset immediately grants authorization by setting authentication flags that normally require manual verification or external validation. In [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) (lines 71–75), the script exports `AUTH_GRANTED=1` and `AUTH_STATUS="granted"`, while the PowerShell counterpart in `skills/scripts/case-init.ps1` (lines 58–61) sets `$AuthGranted = $true` and `$AuthStatus = 'granted'`.

Simultaneously, both scripts record the authorization basis as originating from the owner’s own system. The Bash implementation sets `AUTH_BASIS="own_system"` (line 75), and the PowerShell version applies the equivalent metadata, establishing that the analysis session is owner-operated and locally contained.

### Mandatory Offline Network Isolation

The `offline-sample` preset forces the **network profile to `offline`** to prevent accidental outbound connections during malware analysis. In [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh), line 76 executes `NETWORK_PROFILE="${NETWORK_PROFILE:-offline}"`, while `case-init.ps1` hardcodes `$NetworkProfile = 'offline'` at the corresponding logic block.

This isolation is reinforced by the network mode logic that governs execution readiness. Lines 66–68 in [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) default the `network_mode` variable to `offline`, and subsequent checks (lines 60–67) verify that `network_mode="offline"` is accompanied by a non-empty `SAMPLE` variable before allowing the case to proceed. The PowerShell implementation mirrors this safety check using the `$offlineSampleReady` condition (lines 76–78), ensuring the workflow continues only when a concrete local sample is present.

### Asset Registration and Audit Provenance

Beyond configuration, the preset handles **sample ingestion and forensic traceability**. The local file path provided via the `--sample` or `-Sample` parameter is immediately added to the in-scope assets list. In [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) (line 78), the command `IN_SCOPE_ASSETS+=("$SAMPLE")` appends the target binary, while `case-init.ps1` (lines 37–38) executes `[void]$assets.Add($Sample.Trim())` to achieve the same result.

To satisfy audit requirements, both scripts populate the `EVIDENCE_OF_AUTH` field with a descriptive string identifying the initialization method. The Bash script sets `EVIDENCE_OF_AUTH="${EVIDENCE_OF_AUTH:-preset:offline-sample (owner-operated local file)}"` (line 77), and the PowerShell script assigns `'preset:offline-sample (owner-operated local file)'` (lines 64–65), creating an immutable record that the case began with explicit offline authorization.

## Security Gate Compliance and Operational Safety

According to the [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) specification in the repository, every case must pass a hard gate requiring `auth.status=granted` coupled with a valid `network_profile` before any ACT (analysis) phase can commence. The `offline-sample` preset satisfies both conditions atomically, eliminating manual configuration errors that could leave the environment in a partially authorized state.

By fixing the network profile to `offline`, the preset creates a **deterministic, air-gapped environment** crucial for handling unknown or potentially malicious samples. This prevents the analysis workstation from inadvertently dialing out to command-and-control servers or leaking sensitive file hashes during the initialization phase.

## Practical Usage Examples

The preset accepts a standard set of flags across platforms, standardizing the initialization workflow for Linux, macOS, and Windows environments.

### Bash Usage (Linux/macOS/Kali)

```bash

# Initialize a case for a local APK named app.apk

bash skills/scripts/case-init.sh \
  --hint "offline apk" \
  --case-name my-sample \
  --preset offline-sample \
  --sample ./app.apk

```

### PowerShell Usage (Windows)

```powershell

# Initialize a case for a local sample on Windows

powershell -File skills/scripts/case-init.ps1 `
  -Hint "offline apk" `
  -CaseName my-sample `
  -Preset offline-sample `
  -Sample ".\app.apk"

```

Both commands create the directory structure `work/my-sample/` with standard sub-folders (`evidence`, `notes`, `report`), set `auth.status=granted` and `network_profile=offline`, and register `app.apk` as the sole in-scope asset. Downstream reverse-engineering tools—such as IDA, radare2, or jadx—can then process the sample immediately without requiring network validation steps.

## Summary

- The `offline-sample` preset functions as a **case-initialization preset** that bundles authentication, network isolation, and asset registration into a single operation.
- It sets `AUTH_GRANTED=1` (Bash) or `$AuthGranted = $true` (PowerShell) and forces `NETWORK_PROFILE=offline`, satisfying the [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) security gate requirements.
- The supplied local file is added to `IN_SCOPE_ASSETS` via [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) (line 78) or `[void]$assets.Add()` in `skills/scripts/case-init.ps1` (lines 37–38).
- Audit trails are automatically generated via the `EVIDENCE_OF_AUTH` field, documenting that the analysis began with owner-operated, offline authorization.

## Frequently Asked Questions

### What specific files are modified when using the offline-sample preset?

The preset modifies environment variables and internal state within [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) (lines 71–78) or `skills/scripts/case-init.ps1` (lines 37–38, 58–66), but it does not alter the source files themselves. Instead, it writes configuration metadata to the newly created case directory (e.g., `work/my-sample/`), establishing the `auth.status`, `network_profile`, and asset list for that specific session.

### Can I use the offline-sample preset for multiple samples at once?

The preset is designed to initialize a case with a single primary sample passed via the `--sample` or `-Sample` argument. While the underlying asset list (`IN_SCOPE_ASSETS`) supports multiple entries, the standard preset workflow targets one local binary per case initialization to maintain clear provenance and audit chains.

### How does the offline-sample preset satisfy the auth requirements in RULES.md?

The [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) file mandates that any ACT phase requires `auth.status=granted` and a valid `network_profile`. The preset satisfies these by explicitly setting `AUTH_STATUS="granted"` and `NETWORK_PROFILE="offline"` during initialization, effectively hard-coding the authorization state rather than deriving it from external identity providers or network handshakes.

### Is the offline-sample preset available in both Linux and Windows environments?

Yes. The functionality is implemented identically in both [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) for Bash-based systems (Linux, macOS, Kali) and `skills/scripts/case-init.ps1` for Windows PowerShell. Both scripts enforce the same authentication grants, offline network profiles, and asset registration logic, ensuring cross-platform consistency for local malware analysis workflows.