reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-windows-driver-malware/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/analyzing-windows-driver-malware/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: analyzing-windows-driver-malware
+description: 'Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for
+  the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD
+  and kernel-callback abuse. Activates for requests to analyze a Windows driver, examine a .sys
+  sample, or assess a BYOVD/kernel driver threat.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - windows-driver
+  - kernel
+  - byovd
+  - ioctl
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1068
+  - T1014
+  - T1547.006
+d3fend:
+  - D3-SDA
+  - D3-FA
+references:
+  - 'Windows Driver Kit (WDM/IRP) — https://learn.microsoft.com/windows-hardware/drivers/'
+  - 'MITRE ATT&CK T1068 Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/'
+---
+
+# Analyzing Windows Driver Malware
+
+## When to Use
+
+- You have a `.sys` kernel driver (malicious rootkit driver or a vulnerable driver used for BYOVD)
+  and need to identify its entry, IRP/IOCTL handlers, and dangerous kernel operations.
+- You are assessing privilege-escalation or kernel-stealth risk.
+
+**Do not use** this by loading the driver — analyze it statically. Loading kernel code is
+dangerous and is the threat itself.
+
+## Prerequisites
+
+- The driver `.sys` (read inertly).
+
+## Safety & Handling
+
+- Read bytes statically; never install/load the driver. Note its signing status for BYOVD context.
+
+## Workflow
+
+### Step 1: Confirm it is a kernel driver
+
+```bash
+python scripts/analyst.py inspect driver.sys
+```
+
+Verifies the PE native subsystem (1), kernel imports (`ntoskrnl.exe`, `hal.dll`), and reports
+imported kernel APIs.
+
+### Step 2: Identify dispatch and dangerous primitives
+
+Flag IRP/IOCTL handling (`IoCreateDevice`, `IoCreateSymbolicLink`, `IRP_MJ_DEVICE_CONTROL`),
+arbitrary read/write primitives (`MmMapIoSpace`, `ZwMapViewOfSection`, `MmCopyMemory`), and
+callback registration (`PsSetCreateProcessNotifyRoutine`, `ObRegisterCallbacks`).
+
+### Step 3: Assess BYOVD/stealth potential
+
+Map exposed IOCTLs to capabilities (physical memory access, process kill, token theft) that BYOVD
+abuse relies on.
+
+### Step 4: Document
+
+Record the driver's handlers, dangerous primitives, signing status, and risk.
+
+## Validation
+
+- Native subsystem and kernel imports confirm a driver.
+- Dispatch/IOCTL and dangerous-primitive imports are reported with evidence.
+- Capabilities are tied to concrete imported APIs.
+
+## Pitfalls
+
+- Legitimate vendor drivers that are nonetheless exploitable (BYOVD) — context matters.
+- Drivers resolving APIs dynamically, hiding imports.
+- Confusing user-mode helper components with the kernel driver itself.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
+- WDK and ATT&CK T1068 references (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/analyzing-windows-driver-malware/references/api-reference.md

@@ -0,0 +1,37 @@
+# API Reference: Analyzing Windows Driver Malware
+
+## Overview
+
+`scripts/analyst.py` inspects a Windows `.sys` driver: it confirms the PE native subsystem and kernel
+imports, then flags IRP/IOCTL dispatch, arbitrary read/write primitives, and callback registration,
+mapping them to capabilities and BYOVD risk. It reads bytes statically and never loads the driver.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | struct, regex, JSON, file IO |
+
+## Core functions
+
+### `inspect(path)`
+Returns driver confirmation, subsystem, kernel imports, dispatch/RW/callback indicators,
+capabilities, and a BYOVD-risk flag.
+
+## Indicator classes
+
+- Dispatch: `IoCreateDevice`, `IoCreateSymbolicLink`, `IRP_MJ_DEVICE_CONTROL`.
+- RW primitives: `MmMapIoSpace`, `ZwMapViewOfSection`, `MmCopyMemory`.
+- Callbacks: `PsSetCreateProcessNotifyRoutine`, `ObRegisterCallbacks`.
+
+## Usage
+
+```bash
+python scripts/analyst.py inspect driver.sys
+```
+
+## Sources
+
+- Windows Driver Kit (WDM/IRP, IOCTL) — https://learn.microsoft.com/windows-hardware/drivers/
+- MITRE ATT&CK T1068 Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
+- BYOVD arbitrary-RW IOCTL patterns and kernel callbacks from public driver-abuse research

vendor-new/analyst-ai-pack/skills/analyzing-windows-driver-malware/scripts/analyst.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Inspect a Windows kernel driver (.sys): confirm native subsystem and flag kernel primitives.
+
+Parses the PE optional header for the native subsystem and scans strings for kernel imports,
+IRP/IOCTL dispatch, arbitrary read/write primitives, and callback registration. Reads bytes
+statically; never loads the driver.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import struct
+import sys
+from pathlib import Path
+
+ASCII_RE = re.compile(rb"[\x20-\x7e]{4,}")
+
+KERNEL_IMPORTS = ["ntoskrnl.exe", "hal.dll", "ndis.sys", "fltmgr.sys", "wdfldr.sys",
+                  "storport.sys"]
+DISPATCH = ["iocreatedevice", "iocreatesymboliclink", "iodeletedevice", "irp_mj_device_control",
+            "iocreatedevicesecure", "wdfdevicecreate"]
+RW_PRIMITIVES = ["mmmapiospace", "zwmapviewofsection", "mmcopymemory", "mmmapiospaceex",
+                 "zwopensection", "halgetbusdatabyoffset", "mmgetphysicaladdress"]
+CALLBACKS = ["pssetcreateprocessnotifyroutine", "pssetloadimagenotifyroutine",
+             "obregistercallbacks", "cmregistercallback", "pssetcreatethreadnotifyroutine"]
+
+
+def _subsystem(data: bytes) -> int | None:
+    if data[:2] != b"MZ":
+        return None
+    e_lfanew = struct.unpack_from("<I", data, 0x3c)[0]
+    if data[e_lfanew:e_lfanew + 4] != b"PE\x00\x00":
+        return None
+    return struct.unpack_from("<H", data, e_lfanew + 24 + 68)[0]
+
+
+def _strings(data: bytes) -> str:
+    return "\n".join(m.decode("latin-1", "ignore") for m in ASCII_RE.findall(data)).lower()
+
+
+def inspect(path: str) -> dict:
+    data = Path(path).read_bytes()
+    subsystem = _subsystem(data)
+    blob = _strings(data)
+    is_driver = subsystem == 1 or any(k in blob for k in KERNEL_IMPORTS)
+    capabilities = []
+    rw = sorted({p for p in RW_PRIMITIVES if p in blob})
+    cbs = sorted({c for c in CALLBACKS if c in blob})
+    if rw:
+        capabilities.append("arbitrary_memory_access")
+    if cbs:
+        capabilities.append("kernel_callback_registration")
+    if any(d in blob for d in DISPATCH):
+        capabilities.append("ioctl_dispatch")
+    return {
+        "is_kernel_driver": is_driver,
+        "pe_subsystem": subsystem,
+        "kernel_imports": sorted({k for k in KERNEL_IMPORTS if k in blob}),
+        "dispatch_indicators": sorted({d for d in DISPATCH if d in blob}),
+        "read_write_primitives": rw,
+        "callback_registration": cbs,
+        "capabilities": capabilities,
+        "byovd_risk": bool(rw),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Inspect a Windows kernel driver")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("inspect")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(inspect(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())