reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-golang-malware-internals/references/api-reference.md

@@ -0,0 +1,38 @@
+# API Reference: Analyzing Golang Malware Internals
+
+## Overview
+
+`scripts/analyst.py` confirms a Go build (build ID / `go1.x` / `runtime.main`), detects pclntab
+magic markers, and recovers Go function names and package import paths from printable strings,
+mapping notable packages to capabilities. It reads bytes statically and executes nothing. This is
+a heuristic scan, not a full pclntab structure parser.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `info(path)`
+Returns Go detection, versions, pclntab magics present, recovered functions, package paths, and
+capabilities.
+
+## Heuristics
+
+- Go detection: `Go build ID`, `go1.x`, `runtime.main`.
+- pclntab magics: `\xfb\xff\xff\xff`, `\xfa…`, `\xf0…`, `\xf1…` (across Go versions).
+- Functions: `main.*`, `runtime.*`, `net.*`, `crypto.*`, `os/exec.*`, `syscall.*`.
+
+## Usage
+
+```bash
+python scripts/analyst.py info sample.bin
+```
+
+## Sources
+
+- Go runtime pclntab format (runtime/symtab.go) — https://go.dev/src/runtime/symtab.go
+- Go build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo
+- Go RE techniques (pclntab name recovery, garble obfuscation) from public Go-malware research