reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/diffing-malware-samples-to-find-changes/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: diffing-malware-samples-to-find-changes
+description: 'Compares two related malware samples to surface what changed between variants using
+  section-level hashing, import-set differences, and fuzzy similarity scoring. Activates for
+  requests to diff two samples, compare malware variants, or measure similarity between two binaries
+  for variant tracking.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - bindiff
+  - variant-analysis
+  - similarity
+  - triage
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1587.001
+  - T1027
+  - T1588.001
+d3fend:
+  - D3-FA
+  - D3-DA
+references:
+  - 'PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format'
+  - 'ssdeep fuzzy hashing (CTPH) — https://ssdeep-project.github.io/ssdeep/'
+---
+
+# Diffing Malware Samples to Find Changes
+
+## When to Use
+
+- You have two related samples (suspected variants of one family) and want a fast, structural diff
+  before a full BinDiff.
+- You need to quantify similarity and pinpoint changed sections/imports for variant tracking.
+
+**Do not use** this as authoritative function-level diffing — that requires BinDiff/Diaphora on
+disassembly. This skill does structural/statistical diffing and executes nothing.
+
+## Prerequisites
+
+- Two sample files (read inertly). Optional: `ssdeep`/`tlsh` for fuzzy scores (degrade gracefully).
+
+## Workflow
+
+### Step 1: Structural diff
+
+```bash
+python scripts/analyst.py diff a.bin b.bin
+```
+
+Compares file size, per-section SHA-256 and entropy, and the import name sets, reporting added/
+removed/changed sections and imports.
+
+### Step 2: Similarity score
+
+Reports a byte-level similarity ratio and, if available, ssdeep/tlsh fuzzy-hash comparison scores.
+
+### Step 3: Prioritize changed regions
+
+Changed sections (same name, different hash) and new imports are the high-value targets for deeper
+disassembly diffing.
+
+### Step 4: Document
+
+Record what changed and the similarity score to support variant/lineage tracking.
+
+## Validation
+
+- Section comparison keys on section name; identical sections report equal hashes.
+- Import diff lists are accurate (added vs removed vs common).
+- Fuzzy-hash scores are reported only when the library is available, else clearly omitted.
+
+## Pitfalls
+
+- Recompilation shifting addresses makes raw byte diff noisy — rely on section/import structure.
+- Packers making both samples look similar (packed) while the payloads differ — unpack first.
+- Treating a high byte-similarity as proof of same author without corroboration.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the differ.
+- PE format and ssdeep references (linked in frontmatter).