What Role Does the Offline-Sample Preset Play in Local Sample Analysis?

The offline-sample preset is a case-initialization shortcut that grants authentication, forces offline mode, and registers a local binary as an in-scope asset, enabling immediate analysis without network exposure.

When working with the zhaoxuya520/reverse-skill framework, analysts must satisfy strict authentication and network isolation requirements before processing potentially malicious binaries. The offline-sample preset streamlines this workflow by bundling authorization, offline network configuration, and asset registration into a single command-line flag, eliminating the need for external network access during case setup.

How the Offline-Sample Preset Configures Local Analysis

The preset operates by executing a deterministic sequence of environment variable assignments and asset registrations within the case initialization scripts. These actions satisfy the framework’s security gates while preparing the workspace for reverse engineering.

Automatic Authentication Grant

When invoked, the preset immediately grants authorization by setting authentication flags that normally require manual verification or external validation. In skills/scripts/case-init.sh (lines 71–75), the script exports AUTH_GRANTED=1 and AUTH_STATUS="granted", while the PowerShell counterpart in skills/scripts/case-init.ps1 (lines 58–61) sets $AuthGranted = $true and $AuthStatus = 'granted'.

Simultaneously, both scripts record the authorization basis as originating from the owner’s own system. The Bash implementation sets AUTH_BASIS="own_system" (line 75), and the PowerShell version applies the equivalent metadata, establishing that the analysis session is owner-operated and locally contained.

Mandatory Offline Network Isolation

The offline-sample preset forces the network profile to offline to prevent accidental outbound connections during malware analysis. In case-init.sh, line 76 executes NETWORK_PROFILE="${NETWORK_PROFILE:-offline}", while case-init.ps1 hardcodes $NetworkProfile = 'offline' at the corresponding logic block.

This isolation is reinforced by the network mode logic that governs execution readiness. Lines 66–68 in case-init.sh default the network_mode variable to offline, and subsequent checks (lines 60–67) verify that network_mode="offline" is accompanied by a non-empty SAMPLE variable before allowing the case to proceed. The PowerShell implementation mirrors this safety check using the $offlineSampleReady condition (lines 76–78), ensuring the workflow continues only when a concrete local sample is present.

Asset Registration and Audit Provenance

Beyond configuration, the preset handles sample ingestion and forensic traceability. The local file path provided via the --sample or -Sample parameter is immediately added to the in-scope assets list. In case-init.sh (line 78), the command IN_SCOPE_ASSETS+=("$SAMPLE") appends the target binary, while case-init.ps1 (lines 37–38) executes [void]$assets.Add($Sample.Trim()) to achieve the same result.

To satisfy audit requirements, both scripts populate the EVIDENCE_OF_AUTH field with a descriptive string identifying the initialization method. The Bash script sets EVIDENCE_OF_AUTH="${EVIDENCE_OF_AUTH:-preset:offline-sample (owner-operated local file)}" (line 77), and the PowerShell script assigns 'preset:offline-sample (owner-operated local file)' (lines 64–65), creating an immutable record that the case began with explicit offline authorization.

Security Gate Compliance and Operational Safety

According to the RULES.md specification in the repository, every case must pass a hard gate requiring auth.status=granted coupled with a valid network_profile before any ACT (analysis) phase can commence. The offline-sample preset satisfies both conditions atomically, eliminating manual configuration errors that could leave the environment in a partially authorized state.

By fixing the network profile to offline, the preset creates a deterministic, air-gapped environment crucial for handling unknown or potentially malicious samples. This prevents the analysis workstation from inadvertently dialing out to command-and-control servers or leaking sensitive file hashes during the initialization phase.

Practical Usage Examples

The preset accepts a standard set of flags across platforms, standardizing the initialization workflow for Linux, macOS, and Windows environments.

Bash Usage (Linux/macOS/Kali)

# Initialize a case for a local APK named app.apk

bash skills/scripts/case-init.sh \
  --hint "offline apk" \
  --case-name my-sample \
  --preset offline-sample \
  --sample ./app.apk

PowerShell Usage (Windows)

# Initialize a case for a local sample on Windows

powershell -File skills/scripts/case-init.ps1 `
  -Hint "offline apk" `
  -CaseName my-sample `
  -Preset offline-sample `
  -Sample ".\app.apk"

Both commands create the directory structure work/my-sample/ with standard sub-folders (evidence, notes, report), set auth.status=granted and network_profile=offline, and register app.apk as the sole in-scope asset. Downstream reverse-engineering tools—such as IDA, radare2, or jadx—can then process the sample immediately without requiring network validation steps.

Summary

• The offline-sample preset functions as a case-initialization preset that bundles authentication, network isolation, and asset registration into a single operation.
• It sets AUTH_GRANTED=1 (Bash) or $AuthGranted = $true (PowerShell) and forces NETWORK_PROFILE=offline, satisfying the RULES.md security gate requirements.
• The supplied local file is added to IN_SCOPE_ASSETS via skills/scripts/case-init.sh (line 78) or [void]$assets.Add() in skills/scripts/case-init.ps1 (lines 37–38).
• Audit trails are automatically generated via the EVIDENCE_OF_AUTH field, documenting that the analysis began with owner-operated, offline authorization.

Frequently Asked Questions

What specific files are modified when using the offline-sample preset?

The preset modifies environment variables and internal state within skills/scripts/case-init.sh (lines 71–78) or skills/scripts/case-init.ps1 (lines 37–38, 58–66), but it does not alter the source files themselves. Instead, it writes configuration metadata to the newly created case directory (e.g., work/my-sample/), establishing the auth.status, network_profile, and asset list for that specific session.

Can I use the offline-sample preset for multiple samples at once?

The preset is designed to initialize a case with a single primary sample passed via the --sample or -Sample argument. While the underlying asset list (IN_SCOPE_ASSETS) supports multiple entries, the standard preset workflow targets one local binary per case initialization to maintain clear provenance and audit chains.

How does the offline-sample preset satisfy the auth requirements in RULES.md?

The RULES.md file mandates that any ACT phase requires auth.status=granted and a valid network_profile. The preset satisfies these by explicitly setting AUTH_STATUS="granted" and NETWORK_PROFILE="offline" during initialization, effectively hard-coding the authorization state rather than deriving it from external identity providers or network handshakes.

Is the offline-sample preset available in both Linux and Windows environments?

Yes. The functionality is implemented identically in both skills/scripts/case-init.sh for Bash-based systems (Linux, macOS, Kali) and skills/scripts/case-init.ps1 for Windows PowerShell. Both scripts enforce the same authentication grants, offline network profiles, and asset registration logic, ensuring cross-platform consistency for local malware analysis workflows.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}