> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting

> Common issues and fixes when setting up or running the lab.

| Issue | Cause | Fix |
| - | - | - |
| SSH connection refused | SSH service not running or wrong IP | Run `sudo systemctl start ssh` on REMnux/SIFT. Verify IP with `ip a`. |
| MCP shows "Failed to connect" | Node.js path wrong or build not compiled | Run `npx tsc` in `~/mcp/remnux-mcp`. Re-register with `claude mcp remove` then `add`. |
| Ghidra returns "Unauthorized" | Auth token not passed through SSH layers | Use the `ghidra-scripts` wrapper approach — do not pass token directly via `docker exec`. |
| Ghidra container crashes on start | Binding to `0.0.0.0` without auth token | Always set `GHIDRA_MCP_AUTH_TOKEN` when using `GHIDRA_MCP_BIND_ADDRESS=0.0.0.0`. |
| `ghidra_list_functions` returns empty | Sample loaded but not analyzed | Call `ghidra_run_analysis` with `entry_offset=0x0` after loading. Required for raw shellcode and headerless binaries. |
| `ghidra_load_sample` fails on shellcode | Auto-detection fails on headerless binaries | Pass the `language` parameter: `x86:LE:64:default` for 64-bit, `x86:LE:32:default` for 32-bit. |
| `ghidra_load_sample` returns "File not found" | Container uses `/data/` not `/home/remnux/samples/` | The updated `ghidra-post.sh` translates paths automatically. If using `run_command` directly, use `/data/filename`. |
| MCP not visible in Claude session | Registered with project scope, not user scope | Re-register with `--scope user`. Check `~/.claude.json` for duplicate entries. |
| npm install hangs on REMnux/SIFT | No internet (host-only network) | Re-enable NAT temporarily to install. Switch back to host-only after. |
| sift-ssh MCP not connecting | Wrong username or key path | SIFT default user is `sansforensics`. Verify: `ssh -i ~/.ssh/sift_key sansforensics@192.168.56.30` |
| Volatility3 returns no output | Wrong OS profile or memory image path | Try `vol -f image.dmp windows.info` first to detect OS. Use full absolute path. |
| netplan apply fails on SIFT | nano not installed | Use `sudo tee /etc/netplan/...` instead. Check interface name with `ip a` first. |
| cfr/procyon empty output | Not a valid JAR or encrypted JAR | Verify with `file sample.jar`. Try `jadx` as fallback. |
| `go version -m` returns nothing | Stripped binary or not Go | Use `strings binary \| grep 'go[0-9]'`. Go binaries embed module paths even when stripped. |
| jadx not found | Not in PATH on REMnux | Use full path: `/usr/local/jadx/bin/jadx`. |

## Security Notes

> [!WARNING]
>
> Follow these rules to keep the lab isolated and your host machine safe.

* **Never execute samples on VM1.** Samples only ever live on REMnux (`/home/remnux/samples/`) or SIFT (`/cases/`).
* **Keep REMnux and SIFT host-only.** Switch back immediately after installing tools. Never leave analysis VMs on NAT during a session.
* **Use password-protected zips.** Always transfer as `zip -P infected sample.zip sample.exe`.
* **Revert snapshots between samples.** Take a clean snapshot before analysis; revert after each session.
* **Disable shared clipboard and drag-and-drop** in VMware settings for REMnux and SIFT.
* **API keys stay on VM1 only.** The VirusTotal key is never transferred to analysis VMs.
* **Hash all evidence.** Use `sift-ssh hash_file` before and after analysis to maintain chain of custody.
* **The Ghidra auth token is lab-internal only.** Bound to `127.0.0.1` inside Docker — not exposed on the network.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.