reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-android-dex-malware/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Analyzing Android DEX Malware
+
+## Overview
+
+`scripts/analyst.py` treats an APK as a ZIP and inventories its DEX files, native libraries,
+assets, and manifest presence, flagging multidex and likely encrypted payload assets. It does
+not decompile or execute — use jadx/apktool for decompilation.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | zipfile, file IO |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| jadx | Decompile DEX bytecode to Java |
+| apktool | Decode resources and binary AndroidManifest.xml |
+| Android emulator | Dynamic analysis of dynamic/native payloads |
+
+## Core functions
+
+### `inspect(path)`
+Returns the DEX list, native libraries, assets, manifest presence, multidex flag, and triage
+notes.
+
+## Usage
+
+```bash
+python scripts/analyst.py inspect sample.apk
+```
+
+## Sources
+
+- Android DEX bytecode format — https://source.android.com/docs/core/runtime/dex-format
+- APK packaging (ZIP container, AndroidManifest.xml) — Android documentation
+- jadx DEX-to-Java decompiler — https://github.com/skylot/jadx