reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-windows-driver-malware/references/api-reference.md

@@ -0,0 +1,37 @@
+# API Reference: Analyzing Windows Driver Malware
+
+## Overview
+
+`scripts/analyst.py` inspects a Windows `.sys` driver: it confirms the PE native subsystem and kernel
+imports, then flags IRP/IOCTL dispatch, arbitrary read/write primitives, and callback registration,
+mapping them to capabilities and BYOVD risk. It reads bytes statically and never loads the driver.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | struct, regex, JSON, file IO |
+
+## Core functions
+
+### `inspect(path)`
+Returns driver confirmation, subsystem, kernel imports, dispatch/RW/callback indicators,
+capabilities, and a BYOVD-risk flag.
+
+## Indicator classes
+
+- Dispatch: `IoCreateDevice`, `IoCreateSymbolicLink`, `IRP_MJ_DEVICE_CONTROL`.
+- RW primitives: `MmMapIoSpace`, `ZwMapViewOfSection`, `MmCopyMemory`.
+- Callbacks: `PsSetCreateProcessNotifyRoutine`, `ObRegisterCallbacks`.
+
+## Usage
+
+```bash
+python scripts/analyst.py inspect driver.sys
+```
+
+## Sources
+
+- Windows Driver Kit (WDM/IRP, IOCTL) — https://learn.microsoft.com/windows-hardware/drivers/
+- MITRE ATT&CK T1068 Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
+- BYOVD arbitrary-RW IOCTL patterns and kernel callbacks from public driver-abuse research