reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/building-config-extractors/references/api-reference.md

@@ -0,0 +1,48 @@
+# API Reference: Building Config Extractors
+
+## Overview
+
+`scripts/analyst.py` is a declarative config-extraction engine: given a JSON spec describing the
+config blob location, ordered decode layers, and field definitions, it extracts a structured,
+defanged config from a sample. It reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | base64, struct, JSON, file IO |
+
+## Spec format
+
+```json
+{
+  "blob": {"marker": "CFG0", "length": 256},
+  "decode": [{"type": "xor", "key": "0x5a"}, {"type": "base64"}],
+  "fields": [
+    {"name": "c2", "offset": 0, "length": 64, "type": "str"},
+    {"name": "port", "offset": 64, "type": "u16"},
+    {"name": "ip", "offset": 66, "type": "ipv4"}
+  ]
+}
+```
+
+- **blob**: `offset`+`length` or `marker`+`length` (searches for the marker).
+- **decode**: ordered `xor` (single-byte `0x..` or multi-byte string key) and `base64` layers.
+- **fields**: `str`, `u16`, `u32` (little-endian), `ipv4`. URL/IP fields are defanged.
+
+## Core functions
+
+### `extract(path, spec)`
+Locates the blob, applies decode layers, parses fields, returns the config.
+
+## Usage
+
+```bash
+python scripts/analyst.py extract sample.bin --spec family.json
+```
+
+## Sources
+
+- MITRE ATT&CK T1140 Deobfuscate/Decode Information — https://attack.mitre.org/techniques/T1140/
+- Declarative config-extractor design (DC3-MWCP, CAPE parsers) — https://github.com/Defense-Cyber-Crime-Center/DC3-MWCP
+- XOR/base64 layered config encoding from public family teardowns