reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-engineering-ransomware-encryption-routine/references/api-reference.md

@@ -0,0 +1,52 @@
+# API Reference: Reverse Engineering Ransomware Encryption
+
+## Cryptographic Algorithm Constants
+
+| Algorithm | Signature | Description |
+|-----------|-----------|-------------|
+| AES | S-Box starting `0x63 0x7C 0x77` | AES Rijndael substitution box |
+| RSA | DER `0x30 0x82` prefix | ASN.1 RSA key structure |
+| ChaCha20/Salsa20 | `expand 32-byte k` | Stream cipher constant |
+| RC4 | Sequential 0-255 state | Key scheduling algorithm init |
+
+## Encryption Analysis Techniques
+
+| Technique | Tool | Purpose |
+|-----------|------|---------|
+| Entropy analysis | `ent`, Python | Detect encrypted regions |
+| Constant scanning | IDA/Ghidra YARA | Find crypto implementations |
+| API tracing | x64dbg, Frida | Trace CryptEncrypt/BCrypt calls |
+| Key extraction | Volatility3 | Dump keys from memory |
+
+## Ransomware Encryption Patterns
+
+| Pattern | Indicator |
+|---------|-----------|
+| Full encryption | Entropy > 7.9 across entire file |
+| Intermittent | High entropy blocks with gaps |
+| Header-only | First N bytes encrypted, rest plain |
+| Appended metadata | File larger than original (key/IV at end) |
+
+## Common Ransomware Crypto
+
+| Family | Algorithm | Key Mgmt |
+|--------|-----------|----------|
+| LockBit 3.0 | AES-256-CBC + RSA-2048 | Per-file AES key, RSA-encrypted |
+| BlackCat/ALPHV | ChaCha20 + RSA-4096 | Rust implementation |
+| Royal | AES-256-CBC + RSA-2048 | Intermittent encryption |
+| Akira | ChaCha20 | Partial file encryption |
+
+## Python Libraries
+
+| Library | Version | Purpose |
+|---------|---------|---------|
+| `hashlib` | stdlib | SHA256 hashing |
+| `struct` | stdlib | Binary data parsing |
+| `re` | stdlib | Pattern extraction |
+| `math` | stdlib | Shannon entropy calculation |
+
+## References
+
+- ID Ransomware: https://id-ransomware.malwarehunterteam.com/
+- NoMoreRansom Decryptors: https://www.nomoreransom.org/en/decryption-tools.html
+- Ghidra: https://ghidra-sre.org/

reverse-engineering-ransomware-encryption-routine/references/standards.md

@@ -0,0 +1,30 @@
+# Ransomware Encryption Standards Reference
+
+## Common Encryption Schemes by Family
+| Family | Symmetric | Asymmetric | Key Size |
+|--------|-----------|-----------|----------|
+| Rhysida | AES-256-CTR | RSA-4096 | 256-bit |
+| Qilin.B | AES-256-CTR/ChaCha20 | RSA-4096 OAEP | 256-bit |
+| Medusa | AES-256 | RSA public key | 256-bit |
+| LockBit 3.0 | AES-256-CTR | Curve25519 | 256-bit |
+| BlackCat/ALPHV | AES-128/ChaCha20 | RSA-2048 | 128/256-bit |
+| Conti | ChaCha20 | RSA-4096 | 256-bit |
+
+## Windows Cryptographic API Cheat Sheet
+| Function | Purpose |
+|----------|---------|
+| CryptAcquireContext | Acquire crypto provider handle |
+| CryptGenKey | Generate symmetric/asymmetric key |
+| CryptImportKey | Import key blob |
+| BCryptOpenAlgorithmProvider | Open CNG algorithm |
+| BCryptGenerateSymmetricKey | Create symmetric key |
+
+## MITRE ATT&CK Techniques
+- T1486: Data Encrypted for Impact
+- T1490: Inhibit System Recovery
+- T1083: File and Directory Discovery
+- T1082: System Information Discovery
+
+## References
+- [No More Ransom Decryptors](https://www.nomoreransom.org/en/decryption-tools.html)
+- [ID Ransomware](https://id-ransomware.malwarehunterteam.com/)

reverse-engineering-ransomware-encryption-routine/references/workflows.md

@@ -0,0 +1,37 @@
+# Ransomware Encryption Analysis Workflows
+
+## Workflow 1: Encryption Routine Identification
+```
+[Ransomware Sample] --> [Import Analysis] --> [Find Crypto APIs]
+                                                    |
+                                                    v
+                                           [Identify Algorithm]
+                                                    |
+                                                    v
+                                           [Trace Key Generation]
+                                                    |
+                                                    v
+                                           [Assess Decryption Feasibility]
+```
+
+## Workflow 2: Key Recovery Assessment
+```
+[Encrypted Files] --> [Analyze File Structure] --> [Locate Encrypted Key]
+                                                          |
+                                                          v
+                                                 [Check for PRNG Weaknesses]
+                                                          |
+                                                          v
+                                                 [Attempt Key Recovery]
+```
+
+## Workflow 3: Decryptor Development
+```
+[Identified Flaw] --> [Extract Parameters] --> [Build Decryption Logic]
+                                                        |
+                                                        v
+                                               [Test on Sample Files]
+                                                        |
+                                                        v
+                                               [Release Decryptor Tool]
+```