reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-position-independent-code/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/analyzing-position-independent-code/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: analyzing-position-independent-code
+description: 'Analyzes position-independent code and shellcode by identifying GetPC/PEB-walk
+  techniques, API-hash resolution loops, and relocation-free addressing so the payload can be
+  disassembled at the right base. Activates for requests to analyze position-independent code,
+  identify PIC techniques, or understand how shellcode resolves APIs without imports.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - position-independent-code
+  - shellcode
+  - peb-walk
+  - api-hashing
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1027
+  - T1027.007
+  - T1620
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'PEB / LDR structures (Windows internals) — https://learn.microsoft.com/windows/win32/api/winternl/'
+  - 'MITRE ATT&CK T1027.007 Dynamic API Resolution — https://attack.mitre.org/techniques/T1027/007/'
+---
+
+# Analyzing Position-Independent Code
+
+## When to Use
+
+- You have a PIC blob/shellcode that resolves its own addresses and APIs without imports, and you
+  need to understand its technique before disassembly.
+- You want to identify the base-resolution (GetPC), PEB-walk, and API-hashing mechanics.
+
+**Do not use** this to execute the code — analyze it statically (and emulate separately if needed).
+Treat the blob as malicious.
+
+## Prerequisites
+
+- The PIC/shellcode blob (read inertly).
+
+## Safety & Handling
+
+- Read bytes statically; store the blob password-protected and never execute it.
+
+## Workflow
+
+### Step 1: Identify PIC techniques
+
+```bash
+python scripts/analyst.py analyze shellcode.bin
+```
+
+Detects GetPC stubs (`call $+5`/`fnstenv`), PEB access (`fs:[30]`/`gs:[60]`), API-hash loops
+(`lodsb` + `ror`), and stack-string construction.
+
+### Step 2: Determine architecture and base behavior
+
+Confirm 32- vs 64-bit PEB access and how the code computes its own base for relative addressing.
+
+### Step 3: Map API resolution
+
+Note the hashing algorithm and that resolved APIs are obtained by walking the PEB→LDR→export tables
+(pair with the API-hash resolver skill).
+
+### Step 4: Disassemble at the right base
+
+Load the blob at the inferred base/entry in a disassembler/emulator and proceed.
+
+## Validation
+
+- PIC technique hits reference real patterns (GetPC/PEB/API-hash), not arbitrary bytes.
+- Architecture is consistent with the PEB-access form detected.
+- The analysis points to a concrete entry/base for disassembly.
+
+## Pitfalls
+
+- Encoded/staged shellcode where the PIC patterns appear only after decoding.
+- Mixed 32/64-bit (WoW64) transitions.
+- Custom GetPC variants not matching common signatures.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
+- PEB/LDR and ATT&CK T1027.007 references (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/analyzing-position-independent-code/references/api-reference.md

@@ -0,0 +1,37 @@
+# API Reference: Analyzing Position-Independent Code
+
+## Overview
+
+`scripts/analyst.py` identifies position-independent code techniques in a shellcode blob — GetPC
+stubs, PEB access (x86/x64), API-hash loops, and stack-string construction — and infers the
+architecture from the PEB-access form. It reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | JSON, file IO |
+
+## Core functions
+
+### `analyze(path)`
+Returns detected techniques, inferred architecture, PEB-walk/API-hashing flags, and a PIC flag.
+
+## Techniques detected
+
+- GetPC: `call $+5` (`E8 00 00 00 00`), `fldz; fnstenv`.
+- PEB: `fs:[30]` (x86), `gs:[60]` (x64).
+- API hashing: `lodsb` + `ror 13`.
+- Stack strings: `mov [esp+x], imm`.
+
+## Usage
+
+```bash
+python scripts/analyst.py analyze shellcode.bin
+```
+
+## Sources
+
+- PEB/LDR structures (winternl.h) — https://learn.microsoft.com/windows/win32/api/winternl/
+- MITRE ATT&CK T1027.007 Dynamic API Resolution — https://attack.mitre.org/techniques/T1027/007/
+- GetPC / PEB-walk / ror13 patterns from public shellcode research

vendor-new/analyst-ai-pack/skills/analyzing-position-independent-code/scripts/analyst.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Identify position-independent code techniques in a shellcode blob.
+
+Scans for GetPC stubs, PEB access (x86/x64), API-hash loops, and stack-string construction, and
+infers architecture from the PEB-access form. Reads bytes statically; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+TECHNIQUES = {
+    "getpc_call_pop": [b"\xe8\x00\x00\x00\x00"],            # call $+5
+    "getpc_fnstenv": [b"\xd9\xee\xd9\x74\x24\xf4"],         # fldz; fnstenv [esp-0xc]
+    "peb_access_x86": [b"\x64\xa1\x30\x00\x00\x00", b"\x64\x8b\x0d\x30", b"\x64\x8b\x15\x30"],
+    "peb_access_x64": [b"\x65\x48\x8b", b"\x65\x4c\x8b"],   # gs:[..]
+    "api_hash_ror13": [b"\xac", b"\xc1\xcf\x0d", b"\xc1\xca\x0d"],  # lodsb; ror reg,13
+    "stack_strings": [b"\xc6\x44\x24", b"\xc7\x44\x24"],    # mov byte/dword [esp+x], imm
+}
+
+
+def analyze(path: str) -> dict:
+    data = Path(path).read_bytes()
+    found = {name: True for name, sigs in TECHNIQUES.items()
+             if any(s in data for s in sigs)}
+    arch = ("x64" if "peb_access_x64" in found
+            else "x86" if "peb_access_x86" in found else "unknown")
+    return {
+        "size": len(data),
+        "techniques": sorted(found.keys()),
+        "inferred_arch": arch,
+        "uses_peb_walk": "peb_access_x86" in found or "peb_access_x64" in found,
+        "uses_api_hashing": "api_hash_ror13" in found,
+        "is_position_independent": bool(found),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Analyze position-independent code")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("analyze")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(analyze(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())