reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-compiled-python-malware/references/api-reference.md

@@ -0,0 +1,37 @@
+# API Reference: Analyzing Compiled Python Malware
+
+## Overview
+
+`scripts/analyst.py` detects frozen-Python packers (PyInstaller, py2exe, cx_Freeze) by their markers,
+locates the PyInstaller CArchive magic cookie, and extracts embedded Python version strings. It
+reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `detect(path)`
+Returns the detected packer, PyInstaller cookie offset, and Python version strings, plus the
+recommended next step.
+
+## Markers
+
+- PyInstaller: `_MEIPASS`, `PYZ-00.pyz`, `pyiboot01_bootstrap`, CArchive cookie `MEI\\014\\013\\012\\013\\016`.
+- py2exe: `PYTHONSCRIPT`.
+- cx_Freeze: `cx_Freeze` strings.
+
+## Usage
+
+```bash
+python scripts/analyst.py detect sample.exe
+```
+
+## Sources
+
+- PyInstaller archive format (CArchive/PKG, MEI cookie) — https://pyinstaller.org/en/stable/advanced-topics.html
+- Python bytecode / .pyc magic (dis module) — https://docs.python.org/3/library/dis.html
+- pyinstxtractor extraction workflow (public PyInstaller-unpacking tooling)