reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-rust-malware-internals/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Analyzing Rust Malware Internals
+
+## Overview
+
+`scripts/analyst.py` confirms a Rust build (rustc/cargo markers, `/rustc/<hash>/library/` paths,
+panic strings), heuristically demangles legacy `_ZN...E` symbols, detects v0 `_R` symbols, and
+extracts crate name/version pairs from `.cargo/registry` paths, mapping notable crates to
+capabilities. It reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `info(path)`
+Returns Rust detection, legacy-demangled names, v0 symbols present, crates, and capabilities.
+
+### `_demangle_legacy(sym)`
+Decodes the length-prefixed segments of a legacy `_ZN...17h<hash>E` symbol into `a::b::c`.
+
+## Notes
+
+- v0 (`_R`) symbols are detected; full v0 demangling is delegated to a dedicated tool
+  (e.g., `rustfilt`).
+
+## Usage
+
+```bash
+python scripts/analyst.py info sample.bin
+```
+
+## Sources
+
+- Rust symbol mangling v0 (RFC 2603) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html
+- Legacy `_ZN`/Itanium-style length-prefixed mangling (public Rust ABI docs)
+- Cargo registry path layout (`registry/src/<index>/<crate>-<ver>`) from Cargo documentation