reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/Anthropic-Cybersecurity-Skills/skills/analyzing-golang-malware-with-ghidra/references/api-reference.md

@@ -0,0 +1,90 @@
+# API Reference: Go Malware Analysis with Ghidra
+
+## Ghidra Go Analysis Setup
+
+### GoResolver Script (Volexity)
+```bash
+# Install GoResolver for stripped Go binary function recovery
+git clone https://github.com/volexity/GoResolver
+# Run against Ghidra project
+analyzeHeadless /ghidra_projects MyProject -process go_malware.exe \
+  -postScript GoResolver.java
+```
+
+### Ghidra Built-in Go Support (10.3+)
+```
+File > Import > Select Go binary
+Analysis > Auto Analyze (includes GolangAnalyzer)
+Window > Function Tags > Filter "go."
+```
+
+## Go Binary Characteristics
+
+### Build Info Magic
+```
+Offset in .go.buildinfo section: "\xff Go buildinf:"
+```
+
+### gopclntab Magic Bytes
+| Go Version | Magic |
+|------------|-------|
+| 1.2-1.15 | `FB FF FF FF 00 00` |
+| 1.16-1.17 | `FA FF FF FF 00 00` |
+| 1.18-1.19 | `F0 FF FF FF 00 00` |
+| 1.20+ | `F1 FF FF FF 00 00` |
+
+### String Format
+Go strings are length-prefixed (not null-terminated):
+```
+struct GoString {
+    char *ptr;      // pointer to string data
+    int64 length;   // string length
+};
+```
+
+## Go-Specific Ghidra Scripts
+
+### GoReSym (Mandiant)
+```bash
+GoReSym -t -d -p /path/to/binary
+# -t: Recover type information
+# -d: Dump function metadata
+# -p: Print package listing
+```
+
+### redress (Go Reverse Engineering)
+```bash
+redress -src binary.exe           # Reconstruct source tree
+redress -pkg binary.exe           # List packages
+redress -type binary.exe          # Type information
+redress -string binary.exe        # Go string extraction
+redress -interface binary.exe     # Interface types
+```
+
+## Go Obfuscation Tools
+
+| Tool | Technique | Detection |
+|------|-----------|-----------|
+| garble | Function name hashing, literal obfuscation | Hash-like symbols, missing debug info |
+| gobfuscate | Package/function renaming | Random 8-char names |
+| go-strip | Symbol table removal | Missing gopclntab entries |
+
+## Common Go Malware Families
+
+| Family | Type | Notable Packages |
+|--------|------|-----------------|
+| Sliver | C2 implant | protobuf, grpc, mtls |
+| Merlin | C2 agent | http2, jose, websocket |
+| Sunlogin/Cobalt | RAT | screenshot, clipboard, keylog |
+| BianLian | Ransomware | crypto/aes, filepath.Walk |
+| Royal | Ransomware | goroutine-based parallel encryption |
+
+## Key Ghidra Analysis Steps
+```
+1. Search > For Strings > "go1." (version identification)
+2. Search > For Bytes > FB FF FF FF (gopclntab)
+3. Symbol Table > Filter "main." (entry points)
+4. Navigation > Go To "runtime.main" (program start)
+5. Decompiler > Check goroutine spawns (runtime.newproc)
+6. Data Types > Apply GoString struct to string references
+```

vendor-new/Anthropic-Cybersecurity-Skills/skills/analyzing-golang-malware-with-ghidra/references/standards.md

@@ -0,0 +1,29 @@
+# Go Binary Analysis Standards
+
+## Go Binary Structure
+| Component | Description | Location |
+|-----------|-------------|----------|
+| pclntab | PC-to-function mapping table | .gopclntab or .text |
+| moduledata | Runtime metadata structure | .noptrdata |
+| itab | Interface method tables | .rodata |
+| buildinfo | Go version and module info | .go.buildinfo |
+| typelinks | Type descriptor table | .rodata |
+
+## pclntab Magic Bytes by Go Version
+| Magic | Go Version |
+|-------|-----------|
+| 0xFBFFFFFF | 1.2 - 1.15 |
+| 0xFAFFFFFF | 1.16 - 1.17 |
+| 0xF1FFFFFF | 1.18 - 1.19 |
+| 0xF0FFFFFF | 1.20+ |
+
+## Common Go Malware Families
+- Sliver C2 implant
+- Geacon (Go Cobalt Strike beacon)
+- GoBruteforcer
+- Kaiji botnet
+- Chaos botnet (Go-based)
+
+## References
+- [Go Runtime Source](https://github.com/golang/go/tree/master/src/runtime)
+- [Go Internal ABI](https://go.dev/s/regcallabi)

vendor-new/Anthropic-Cybersecurity-Skills/skills/analyzing-golang-malware-with-ghidra/references/workflows.md

@@ -0,0 +1,37 @@
+# Go Malware Analysis Workflows
+
+## Workflow 1: Stripped Binary Recovery
+```
+[Stripped Go Binary] --> [Find pclntab] --> [Recover Function Names]
+                                                    |
+                                                    v
+                                           [Apply GoResolver] --> [Deobfuscate Names]
+                                                                        |
+                                                                        v
+                                                               [Categorize Functions]
+```
+
+## Workflow 2: Full Ghidra Analysis
+```
+[Go Binary] --> [Import to Ghidra] --> [Run Go Analysis Scripts]
+                                              |
+                                              v
+                                    [Fix String References]
+                                              |
+                                              v
+                                    [Identify main Package]
+                                              |
+                                              v
+                                    [Analyze C2/Network Logic]
+```
+
+## Workflow 3: Dependency-Based Capability Assessment
+```
+[Go Binary] --> [Extract Module Info] --> [List Dependencies]
+                                                |
+                                                v
+                                       [Map to Capabilities]
+                                                |
+                                                v
+                                       [Prioritize Analysis]
+```