Disclaimer

0. Definitions

• "Project" — this repository (open-reverseLab), including all files, source code, compiled binaries, scripts, knowledge base articles, documentation, templates, configuration files, and any other content contained in any branch, tag, release, or commit at any point in the repository's history.
• "Version" — any state of the Project identified by or retrievable through a git commit hash, branch name, tag name, release identifier, archive file (ZIP, TAR, etc.), container image, package registry entry, CI/CD build artifact, pre-release (alpha, beta, RC), snapshot, or any other distribution format, whether published by the Project maintainers or by any third party.
• "User" — any natural person, legal entity, organization, automated system (including but not limited to bots, CI/CD pipelines, automated scanning services, AI/ML training pipelines, and agentic systems), or any other actor that accesses, downloads, clones, executes, inspects, references, or otherwise interacts with the Project or any Derivative, in whole or in part, whether directly or indirectly through any intermediate system, service, or person.
• "Derivative" — any work based on or derived from the Project, in whole or in part, regardless of the extent of modification or the medium of distribution. This includes but is not limited to: forks, clones, modified copies, redistributions, binary recompilations, container images, package manager distributions, plugin systems, API wrappers, embedded subsets (even a single function, class, script, or snippet), translated versions, academic works that incorporate Project code, and any works that integrate, reference, link to, or wrap the Project or any portion thereof.

1. Scope of Application

This disclaimer applies retroactively and prospectively to all Versions of the Project and all Derivatives, and binds all Users without exception. By accessing or using the Project or any Derivative in any form or to any extent, the User unconditionally agrees to be bound by all terms of this disclaimer. If the User does not agree — in whole or in part — the User must immediately cease all access and use, and must permanently delete all copies of the Project and any Derivatives in the User's possession or control.

2. Integrity of Disclaimer — Anti-Removal

2.1 Prohibition of removal. No User may remove, delete, conceal, obscure, truncate, or otherwise impair the visibility or discoverability of this disclaimer from the Project or any Derivative. This prohibition applies to the disclaimer in its entirety and to any individual provision thereof.

2.2 Constructive notice — survival irrespective of physical presence. The binding force of this disclaimer does not depend on its physical presence in any particular copy of the Project or Derivative. Even if this disclaimer has been removed, deleted, or concealed from a copy — whether by the User or by any upstream distributor — all terms of this disclaimer continue to bind every User of that copy with full force. Removal of the disclaimer text does not constitute, create, or imply lack of notice, ignorance, or waiver of any kind.

2.3 Willful violation. Any act of removing, deleting, concealing, or materially altering this disclaimer with intent to evade its terms constitutes a willful and knowing violation of this disclaimer. Such conduct shall be deemed conclusive evidence that the User had actual knowledge of the disclaimer's existence and content, voluntarily chose to breach it, and acted in bad faith. No User may assert ignorance of this disclaimer as a defense where the disclaimer has been removed or concealed by that User or by anyone acting in concert with or at the direction of that User.

2.4 Tampering with content. No User may modify, rewrite, paraphrase, abridge, or translate this disclaimer in a manner that materially alters, weakens, narrows, or nullifies any of its terms, obligations, or protections. Any such modified version is void and of no effect; the original disclaimer as published by the Project maintainers in the original Project repository shall govern exclusively.

2.5 Verification duty of downstream recipients. Any person who obtains the Project or a Derivative through a source other than the original Project repository (https://github.com/LING71671/open-reverselab) has an affirmative duty to verify whether this disclaimer governs the work. The absence of a visible disclaimer in a received copy does not relieve the recipient of the obligation to locate, read, and comply with the disclaimer as published in the original Project repository. Ignorance resulting from the upstream removal or concealment of the disclaimer is not a defense.

2.6 No waiver through inaction. Failure by the Project authors, contributors, or maintainers to enforce any provision of this disclaimer against any User does not constitute a waiver of the right to enforce that provision against that User or any other User, whether in relation to the same or different circumstances.

3. Legal Compliance — All Jurisdictions

3.1 The Project and all Derivatives must be used in strict compliance with all applicable laws, regulations, rules, and regulatory requirements of every jurisdiction involved, including but not limited to:

• (a) the laws of the country/region where the User is located or domiciled;
• (b) the laws of the country/region where any target system, device, network, or data resides or is registered;
• (c) the laws of the country/region where any server, relay, proxy, or intermediate infrastructure is physically located or legally incorporated;
• (d) all applicable international laws, treaties, and conventions;
• (e) all applicable export control and sanctions regimes, including but not limited to the U.S. Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), the regulations administered by the U.S. Office of Foreign Assets Control (OFAC), the EU Dual-Use Regulation (2021/821), the UK Export Control Act, the Wassenaar Arrangement, and any equivalent laws of any other jurisdiction;
• (f) all applicable data protection and privacy laws, including but not limited to GDPR (EU/EEA), CCPA/CPRA (California), PIPL (China), PDPA (Singapore), LGPD (Brazil), and any equivalent laws of any other jurisdiction.

3.2 The User is solely responsible for determining which laws apply and for obtaining all necessary licenses, permits, authorizations, and legal advice before using the Project.

3.3 No geographic exception exists. The fact that the Project is accessible from a particular country or region does not constitute a representation that use in that country or region is lawful. The User must independently verify lawfulness.

4. Authorized Purposes Only

4.1 The Project is provided exclusively for the following purposes:

• (a) authorized security testing (penetration testing, vulnerability assessment, red team exercises) conducted with explicit, written, prior authorization from the owner or lawful operator of the target system;
• (b) CTF (Capture The Flag) competitions and similar educational cybersecurity exercises conducted in controlled, authorized environments;
• (c) bona fide academic research and publication, subject to all applicable ethical review and institutional approval requirements;
• (d) personal study and self-education;
• (e) reverse engineering, analysis, and security research on software, firmware, or devices for which the User holds lawful ownership or has obtained explicit, written, prior authorization from the lawful owner, including vulnerability verification performed against an instance of third-party software that the User has lawfully deployed and is authorized to test;
• (f) detection engineering and defensive research — including the development and validation of antivirus, EDR, sandbox, or emulation detection logic, YARA and Sigma rules, and behavioural analysis of malicious samples — conducted in an isolated laboratory environment.

4.2 Authorization must be specific, written, and prior. Implied, retrospective, or verbal authorization is insufficient. The User bears the burden of proving authorization was obtained.

4.3 Any use outside the purposes enumerated in 4.1 is unauthorized and prohibited.

5. Prohibited Uses

5.1 The User must not use the Project or any Derivative for any of the following:

• (a) unauthorized access to, interference with, or compromise of any system, network, device, or data;
• (b) development, distribution, or operation of malicious software (malware, ransomware, spyware, rootkits, botnets, etc.);
• (c) theft, exfiltration, or unauthorized collection of data or intellectual property;
• (d) circumvention of copyright protection, digital rights management (DRM), or access control mechanisms, except (i) as expressly permitted by applicable law, or (ii) research on the licence or activation mechanisms of software that the User lawfully owns or is expressly authorized to test, carried out in an isolated environment or within an authorized CTF / crackme exercise;
• (e) fraud, identity theft, phishing, or any form of deception;
• (f) harassment, stalking, doxing, or any form of unlawful surveillance;
• (g) sabotage, denial-of-service attacks, or disruption of services; provided that denial-of-service resilience testing and the validation of defensive detection rules — conducted against a system that the User owns or is expressly authorized to test, within an isolated laboratory environment or an authorized CTF range, and limited to the minimum load necessary to validate the finding — is not prohibited by this clause;
• (h) any activity that violates the Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030), the UK Computer Misuse Act 1990, the Cybersecurity Law of the People's Republic of China, the EU Directive 2013/40/EU on attacks against information systems, or any equivalent law in any jurisdiction;
• (i) any activity in or involving a country, region, entity, or individual subject to comprehensive sanctions, embargoes, or trade restrictions administered by the United Nations, the United States, the European Union, the United Kingdom, or any other applicable authority;
• (j) any other activity that violates any applicable law, regulation, or third-party right.

5.2 This list is non-exhaustive. The absence of a specific activity from this list does not imply authorization.

6. No Warranty

6.1 THE PROJECT IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, SECURITY, AVAILABILITY, OR FREEDOM FROM DEFECTS OR VULNERABILITIES.

6.2 The Project authors, contributors, and maintainers do not warrant that the Project is error-free, secure, legally compliant, or suitable for any particular purpose. The User assumes all risk associated with the use of the Project.

7. Limitation of Liability & Indemnification

7.1 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE PROJECT AUTHORS, CONTRIBUTORS, MAINTAINERS, OR ANY PERSON OR ENTITY ASSOCIATED WITH THE PROJECT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING BUT NOT LIMITED TO LOSS OF DATA, LOSS OF PROFITS, BUSINESS INTERRUPTION, SYSTEM DAMAGE, REPUTATIONAL HARM, LEGAL PENALTIES, OR REGULATORY SANCTIONS) ARISING FROM OR IN CONNECTION WITH THE USE OF OR INABILITY TO USE THE PROJECT OR ANY DERIVATIVE, WHETHER BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

7.2 The User agrees to indemnify, defend, and hold harmless the Project authors, contributors, and maintainers from and against any and all claims, demands, suits, proceedings, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising from or related to the User's use, misuse, or distribution of the Project or any Derivative, or the User's violation of this disclaimer or any applicable law.

8. Derivative Works

8.1 Mandatory retention and integrity. Any Derivative must include this disclaimer in its entirety, in a prominent and easily discoverable location (at minimum: the root README or equivalent primary documentation file). The disclaimer must be reproduced verbatim, without any modification, deletion, abridgement, paraphrasing, translation, reformatting, or rearrangement that affects its substantive meaning. This retention obligation is absolute and survives any and all modifications to other parts of the Project or Derivative — no change to the Project, however extensive, extinguishes the duty to retain the disclaimer intact. Any Derivative that removes, conceals, or materially alters this disclaimer is in material breach of this agreement, and all Users of such Derivative remain fully bound by the original disclaimer as published in the original Project repository, notwithstanding its removal or alteration from that Derivative.

8.2 Attribution. Any Derivative must clearly and conspicuously state its relationship to the Project, including a link to the original Project repository (https://github.com/LING71671/open-reverselab) and a statement that the Derivative is not endorsed by or affiliated with the Project authors.

8.3 No dilution. The creation or distribution of a Derivative does not exempt the Derivative's author, distributor, or users from any provision of this disclaimer. All provisions apply to Derivatives with the same force as to the original Project.

8.4 Sub-licensing. Any license grant for a Derivative must be consistent with and not purport to override, narrow, or invalidate any provision of this disclaimer.

8.5 Notification duty. Any person who distributes the Project or a Derivative to a third party must take reasonable steps to bring this disclaimer to the attention of the recipient before or at the time of distribution.

8.6 Removal of the disclaimer from a Derivative constitutes an independent breach of this agreement by the person who performed the removal, and such person assumes direct and personal liability for any damages, claims, or losses arising from any downstream User's reliance on the absence of the disclaimer. The person who removed the disclaimer bears the burden of proving that any downstream User had independent knowledge of the disclaimer's terms.

9. Third-Party Components

The Project may include, reference, invoke, or bundle third-party software, libraries, tools, or data. Such third-party components are governed by their own licenses and disclaimers. The Project authors make no representation or warranty regarding third-party components and assume no liability arising from their use. Users must independently review and comply with all third-party terms.

10. No Endorsement

Use of the Project or any Derivative by any User does not imply endorsement, sponsorship, affiliation with, or approval by the Project authors, contributors, or maintainers. Users must not represent or imply any such endorsement.

11. Severability

If any provision of this disclaimer is held to be invalid, illegal, or unenforceable by a court or tribunal of competent jurisdiction, that provision shall be severed and the remaining provisions shall continue in full force and effect. The invalid provision shall be replaced by a valid provision that most closely approximates the intent and economic effect of the original.

12. Governing Law & Dispute Resolution

This disclaimer shall be governed by and construed in accordance with applicable law, without regard to conflict-of-law principles. Any dispute arising from or relating to this disclaimer or the use of the Project shall be resolved in accordance with applicable procedural law. The User submits to the jurisdiction of the competent courts as determined by applicable law.

13. Amendments

The Project maintainers reserve the right to amend this disclaimer at any time. The version of the disclaimer in effect at the time of the User's access or use shall govern. It is the User's responsibility to review the disclaimer periodically. Continued use after an amendment constitutes acceptance of the amended terms.

14. Prevailing Language

This disclaimer is published in English and Chinese. In the event of any conflict or ambiguity between the two language versions, the English version shall prevail.

15. Educational Communication & Technical Assistance

15.1 Nature of information. All technical information, guidance, code examples, explanations, suggestions, opinions, or any other form of response (collectively, "Responses") provided by the Project authors, contributors, or maintainers — whether published in the Project, posted in public forums, delivered in private correspondence (including but not limited to instant messaging, email, voice, video, social media, and any other communication channel), or conveyed in any other medium, constitute general-purpose educational and technical reference material only. No Response is directed at, tailored for, or intended to facilitate action against any specific system, target, person, or entity.

15.2 No vetting obligation. The Project authors, contributors, and maintainers have no obligation, duty, or practical ability to verify the identity, credentials, authorization status, or true intent of any person who asks a question, requests assistance, or seeks technical guidance. A Response is provided as-is, at face value, to the question as posed, without any investigation into the questioner's circumstances or purposes.

15.3 Response does not constitute authorization or endorsement. The provision of a Response does not constitute, and shall not be construed as: (a) authorization, encouragement, or endorsement of any specific act by the recipient; (b) a representation that the recipient's intended use is lawful; (c) a representation that the recipient has obtained necessary legal authorization; (d) the formation of any partnership, agency, joint venture, or conspiratorial relationship; or (e) acquiescence in, ratification of, or complicity in any unlawful act.

15.4 Recipient bears sole responsibility. Any person who receives a Response is solely and exclusively responsible for: (a) determining whether their intended use complies with all applicable laws; (b) obtaining all necessary authorizations, licenses, and consents before acting; and (c) any consequences, legal or otherwise, arising from their use of the information. No recipient may assert, as a defense or in mitigation, that a Response from the Project authors, contributors, or maintainers led them to believe their conduct was authorized, lawful, or condoned.

15.5 Silence does not signify consent. The Project authors', contributors', or maintainers' failure to respond to any communication — or their decision not to express approval or disapproval of any described or proposed use of the Project — does not constitute consent, acquiescence, ratification, waiver, or approval of any kind.

15.6 No confidential or privileged relationship. No communication with the Project authors, contributors, or maintainers creates any attorney-client, fiduciary, confidential, or other special relationship. All communications are non-confidential unless a separate written agreement expressly provides otherwise.

15.7 Third-party transactions.

• (a) The Project is licensed under GPL-3.0-only, which explicitly permits the commercial resale, redistribution, and bundling of the software by any party, provided the terms of the license are complied with. Accordingly, a third party's resale or commercialization of the Project or any Derivative does not, in and of itself, violate the Project's license.
• (b) However, the Project is and remains provided free of charge by its authors. The Project authors have never charged, and will never charge, any fee for the Project itself. Any resale, relicensing, bundling, or commercialization by any third party is an act of that third party alone. The Project authors do not participate in, authorize, endorse, derive any benefit from, or bear any responsibility for such transactions.
• (c) Any payment made by a User to any third party in connection with the Project or any Derivative — including but not limited to purchase, subscription, licensing, service, support, or consulting fees — does not establish any contractual, fiduciary, or other relationship between that User and the Project authors, contributors, or maintainers. Such payment confers no additional rights, privileges, or legitimate expectations upon the User as against the Project authors.
• (d) The free nature of the Project is not altered, waived, or diminished by any third party's commercial activity. Any User who paid a third party for access to the Project retains the right to obtain the Project directly from the original repository free of charge.

16. Unauthorized Distribution & Impersonation

16.1 Compromised or malicious copies. Any person who forks, modifies, or redistributes a copy of the Project that introduces code, behavior, or functionality not present in the original — including backdoors, malware, spyware, trackers, miners, or any other malicious payload — does so at their own risk and on their own behalf. The Project authors bear no responsibility for the safety, integrity, or authenticity of any copy obtained from any source other than the original Project repository (https://github.com/LING71671/open-reverselab). The presence of the Project's name or attribution in a compromised copy does not constitute the Project authors' endorsement of or responsibility for that copy. Users are strongly urged to verify copies against the official repository before use. GPL-3.0 does not impose upon the Project authors any obligation to monitor, audit, or approve third-party modifications.

16.2 Service wrappers (SaaS / API). Any third party that wraps, hosts, or provides the Project or any Derivative as a service — including SaaS platforms, API services, "as-a-service" offerings, cloud-hosted instances, or any form of remote or automated delivery of the Project's functionality — does so as an independent actor. Such service provision does not create any agency, partnership, or other relationship between the service provider and the Project authors. The service provider is solely responsible for: lawful operation in all jurisdictions; vetting and monitoring its users; responding to abuse reports and legal demands; and any harm or liability arising from the service. No claim against the Project authors may be based on the conduct of an independent third-party service that incorporates or wraps the Project.

16.3 Third-party content (tutorials, videos, etc.). Any third party that creates or publishes content — including tutorials, videos, livestreams, articles, courses, training materials, or social media posts — that features, references, demonstrates, or incorporates the Project (collectively, "Third-Party Content") does so on its own initiative. Such content reflects the views and judgments of its creator alone. The Project authors do not endorse or verify any Third-Party Content, are not responsible for the accuracy, legality, safety, or ethics of any instruction or demonstration therein, and are not responsible for any act taken by a viewer in reliance on such content, even if the content identifies the Project or its authors as a source. The inclusion of the Project's name in Third-Party Content does not constitute the Project authors' participation in or complicity in any act depicted or enabled by that content.

16.4 AI/ML training and model use. The Project's source code, knowledge base, documentation, scripts, and any other content (collectively, "Project Content") may be used by third parties as input or training data for artificial intelligence, machine learning, or large language model systems (collectively, "AI Systems"). Any AI System trained on, fine-tuned with, or otherwise incorporating Project Content is an independent product of its creator or operator. The Project authors: (a) do not authorize, endorse, or review the use of Project Content in AI training; (b) make no representation about the correctness, safety, lawfulness, or ethical compliance of any output, advice, or action generated or recommended by such AI Systems; (c) are not responsible for any harm, damage, or liability arising from any person's use of or reliance on such AI Systems, regardless of whether the AI System or its operator identifies the Project or its authors as a source of training data; (d) are not responsible for any act taken by a User of such AI Systems in reliance on the AI System's output, even where that output reproduces, paraphrases, or derives from Project Content. The inclusion of Project Content in AI training does not convert the Project authors into co-authors, co-developers, or co-operators of the resulting AI System.

17. Entire Agreement

This disclaimer constitutes the entire understanding between the User and the Project authors regarding the subject matter hereof, and supersedes all prior or contemporaneous communications, agreements, and understandings, whether oral or written.

18. Survival

All provisions of this disclaimer that by their nature should survive termination or cessation of use — including but not limited to provisions Regarding liability, indemnification, warranty disclaimer, integrity of the disclaimer, educational communication, unauthorized distribution and impersonation, AI/ML training, abuse reporting, and governing law — shall survive indefinitely.

19. Abuse Reporting

19.1 Reporting channel. Anyone who becomes aware that the Project or any Derivative is being used for unauthorized access, denial-of-service, malware deployment, or any other prohibited use may report it privately through the GitHub Security Advisory of the original Project repository (https://github.com/LING71671/open-reverselab), using the subject prefix [abuse].

19.2 Handling. The Project maintainers may, at their sole discretion, review any such report and — where the report is substantiated and the relevant content is within the maintainers' control — update, annotate, or remove the content concerned. The maintainers undertake no obligation to monitor third-party use, to respond within any particular period, or to take any specific action.

19.3 No admission. Receipt or handling of a report does not constitute an admission of responsibility for the reported conduct, nor a waiver of any provision of this disclaimer.