reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-malware-in-memory-with-volatility3/references/api-reference.md

@@ -0,0 +1,40 @@
+# API Reference: Analyzing Malware in Memory with Volatility 3
+
+## Overview
+
+`scripts/analyst.py` consumes Volatility 3 `windows.malfind` JSON output and ranks memory
+regions by injection signal (RWX protection, embedded MZ header, executable prologue). It
+analyzes plugin output, not raw memory.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | JSON parsing |
+| volatility3 | >= 2.5 | Produces the memory-plugin output this tool consumes |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| Volatility 3 | Memory image analysis (pslist, pstree, malfind, netscan, dumpfiles) |
+| WinPmem / LiME | Memory acquisition |
+
+## Core functions
+
+### `rank_malfind(doc)`
+Parses malfind rows and scores each by injection indicators, returning a sorted candidate
+list with PID, process, address, and protection.
+
+## Usage
+
+```bash
+pip install volatility3
+vol -f memory.raw -r json windows.malfind | python scripts/analyst.py malfind -
+```
+
+## Sources
+
+- Volatility 3 documentation — https://volatility3.readthedocs.io/
+- The Art of Memory Forensics — concepts of injection detection (malfind/RWX)
+- Volatility 3 JSON renderer output structure (project docs)