reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-dotnet-malware-internals/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Reverse Engineering .NET Malware
+
+## Overview
+
+`scripts/analyst.py` parses a PE to detect the CLR runtime header (COM descriptor data directory
+index 14) and the `BSJB` metadata-root signature, confirming whether a sample is managed. It
+parses bytes only and never executes the sample.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | struct parsing, file IO |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| ILSpy / dnSpyEx | Decompile MSIL to C#; managed debugging |
+| de4dot | Static deobfuscation of known protectors |
+
+## Core functions
+
+### `identify(path)`
+Returns whether the sample is managed, whether the `BSJB` metadata signature is present, and
+diagnostic notes (mscoree/_CorExeMain references).
+
+## Usage
+
+```bash
+python scripts/analyst.py identify sample.exe
+```
+
+## Sources
+
+- ECMA-335 Common Language Infrastructure (CIL/MSIL metadata, BSJB root) —
+  https://ecma-international.org/publications-and-standards/standards/ecma-335/
+- PE COM descriptor data directory (index 14) — PE/COFF specification
+- ILSpy decompiler — https://github.com/icsharpcode/ILSpy