# THADD OS — hardening, forensics, DFIR and reverse-engineering (optional set)
# ---------------------------------------------------------------------------
# --- Hardening / auditing ---
apparmor
apparmor-utils
apparmor-profiles
apparmor-profiles-extra
auditd
audispd-plugins
libpam-pwquality
libpam-tmpdir
libpam-apparmor
libpam-cap
libpam-cracklib
libpam-google-authenticator
usbguard
firejail
firetools
bubblewrap
selinux-utils
checkpolicy
lynis
debsums
tripwire
aide
aide-common
rkhunter
chkrootkit
unhide
unhide.rb
clamav
clamav-daemon
clamav-freshclam
yara
ssdeep
hashdeep
md5deep
sha1deep
hashrat
xxhash
nftables
iptables
ufw
gufw
shorewall
opensnitch
squid
privoxy
gnupg
gnupg2
gpa
kleopatra
age
cryptsetup
cryptsetup-initramfs
gocryptfs
encfs
zulucrypt-gui
keepassxc
password-gorilla
pwgen
apg
haveged
rng-tools5
systemd-coredump
acct
sysstat
iotop
sysdig
bpftrace
bpfcc-tools
linux-perf
fatrace
lsof
strace
ltrace
gdb
gdb-multiarch
radare2
rizin
cutter
ghidra
apktool
jadx
dex2jar
smali
bytecode-viewer
edb-debugger
qt5-default
kdbg
ddd
hopper
ida-free
rizin-cutter
floss
flare-floss
detect-it-easy
diec
pev
pescan
peframe
retdec
angr
triton
miasm
capstone-tool
python3-capstone
python3-keystone
python3-unicorn
python3-frida
frida
frida-tools
objection
runtime-inspector
# --- Forensics / DFIR ---
sleuthkit
autopsy
guymager
dc3dd
dcfldd
ddrescue
gddrescue
ddrutility
testdisk
photorec
foremost
scalpel
binwalk
bulk-extractor
libewf-utils
ewf-tools
afflib-tools
libafflib
libewf
libvshadow-utils
libbde-utils
reglookup
regripper
python3-reglookup
volatility3
python3-volatility3
plaso
log2timeline
python3-plaso
libimobiledevice-utils
ifuse
usbmuxd
android-sdk
adb
fastboot
heimdall-flash
openstego
steghide
outguess
stegsnow
stegseek
foremost
pngcheck
zsteg
exiftool
libimage-exiftool-perl
mediainfo
hexcompare
bless
ghex
dhex
okteta
radare2
vim-common
xxd
strings
binutils-multiarch
qemu-user
qemu-user-static
faketime
unblob
python3-pypdf2
pdf-parser
peepdf
oledump
