reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-engineering-rust-malware/references/api-reference.md

@@ -0,0 +1,45 @@
+# API Reference: Reverse Engineering Rust Malware
+
+## Rust Binary Indicators
+
+| Indicator | Pattern | Description |
+|-----------|---------|-------------|
+| Panic strings | `panicked at` | Rust panic handler messages |
+| Unwrap failure | `called.*unwrap.*on.*None` | Option/Result unwrap |
+| Core panic | `core::panicking` | Standard library panic |
+| Runtime start | `std::rt::lang_start` | Rust runtime entry point |
+| Cargo registry | `.cargo/registry` | Crate dependency paths |
+| Rustc version | `rustc X.Y.Z` | Compiler version string |
+
+## Crate Extraction Pattern
+
+| Pattern | Example Match |
+|---------|---------------|
+| `crates.io-<hash>/<name>-<ver>` | `crates.io-abc123/reqwest-0.11.22` |
+| `.cargo/registry/src/<index>/<name>-<ver>` | `.cargo/registry/src/index.crates.io/aes-0.8.3` |
+
+## Suspicious Crate Capabilities
+
+| Crate | Capability | Malware Use |
+|-------|-----------|-------------|
+| reqwest / hyper | HTTP client | C2 communication |
+| aes / chacha20 / rsa | Encryption | Ransomware encryption |
+| ring | Crypto primitives | Key generation |
+| winapi / winreg | Windows API | Persistence, injection |
+| sysinfo | System info | Host enumeration |
+| native-tls | TLS | Encrypted C2 channel |
+
+## Python Libraries
+
+| Library | Version | Purpose |
+|---------|---------|---------|
+| `re` | stdlib | Pattern matching for Rust indicators |
+| `struct` | stdlib | PE header parsing |
+| `hashlib` | stdlib | SHA256 sample hashing |
+| `json` | stdlib | Report generation |
+
+## References
+
+- Ghidra: https://ghidra-sre.org/
+- Binary Defense Rust Analysis: https://binarydefense.com/resources/blog/
+- Bishop Fox Rust Malware: https://bishopfox.com/blog/rust-for-malware-development

reverse-engineering-rust-malware/references/standards.md

@@ -0,0 +1,9 @@
+# Standards Reference - reverse-engineering-rust-malware
+
+## Applicable Standards
+- MITRE ATT&CK Framework
+- NIST SP 800-83 Guide to Malware Incident Prevention
+- NIST SP 800-86 Guide to Integrating Forensic Techniques
+
+## Related MITRE ATT&CK Techniques
+See SKILL.md for specific technique mappings.

reverse-engineering-rust-malware/references/workflows.md

@@ -0,0 +1,11 @@
+# Analysis Workflows - reverse-engineering-rust-malware
+
+## Primary Workflow
+```
+[Sample Collection] --> [Static Analysis] --> [Dynamic Analysis] --> [IOC Extraction]
+                                                                          |
+                                                                          v
+                                                                 [Report Generation]
+```
+
+See SKILL.md for detailed step-by-step procedures.