reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-position-independent-code/scripts/analyst.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Identify position-independent code techniques in a shellcode blob.
+
+Scans for GetPC stubs, PEB access (x86/x64), API-hash loops, and stack-string construction, and
+infers architecture from the PEB-access form. Reads bytes statically; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+TECHNIQUES = {
+    "getpc_call_pop": [b"\xe8\x00\x00\x00\x00"],            # call $+5
+    "getpc_fnstenv": [b"\xd9\xee\xd9\x74\x24\xf4"],         # fldz; fnstenv [esp-0xc]
+    "peb_access_x86": [b"\x64\xa1\x30\x00\x00\x00", b"\x64\x8b\x0d\x30", b"\x64\x8b\x15\x30"],
+    "peb_access_x64": [b"\x65\x48\x8b", b"\x65\x4c\x8b"],   # gs:[..]
+    "api_hash_ror13": [b"\xac", b"\xc1\xcf\x0d", b"\xc1\xca\x0d"],  # lodsb; ror reg,13
+    "stack_strings": [b"\xc6\x44\x24", b"\xc7\x44\x24"],    # mov byte/dword [esp+x], imm
+}
+
+
+def analyze(path: str) -> dict:
+    data = Path(path).read_bytes()
+    found = {name: True for name, sigs in TECHNIQUES.items()
+             if any(s in data for s in sigs)}
+    arch = ("x64" if "peb_access_x64" in found
+            else "x86" if "peb_access_x86" in found else "unknown")
+    return {
+        "size": len(data),
+        "techniques": sorted(found.keys()),
+        "inferred_arch": arch,
+        "uses_peb_walk": "peb_access_x86" in found or "peb_access_x64" in found,
+        "uses_api_hashing": "api_hash_ror13" in found,
+        "is_position_independent": bool(found),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Analyze position-independent code")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("analyze")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(analyze(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())