reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/dissecting-boot-and-kernel-rootkits/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/dissecting-boot-and-kernel-rootkits/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: dissecting-boot-and-kernel-rootkits
+description: 'Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/
+  UEFI), kernel-mode components, and stealth hooking techniques from static indicators. Activates
+  for requests to analyze a bootkit or rootkit, examine MBR/UEFI tampering, or identify kernel-mode
+  stealth components.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - bootkit
+  - rootkit
+  - kernel
+  - firmware
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1542.003
+  - T1014
+  - T1547.006
+d3fend:
+  - D3-SDA
+  - D3-FA
+references:
+  - 'MITRE ATT&CK T1542.003 Bootkit — https://attack.mitre.org/techniques/T1542/003/'
+  - 'MITRE ATT&CK T1014 Rootkit — https://attack.mitre.org/techniques/T1014/'
+---
+
+# Dissecting Boot and Kernel Rootkits
+
+## When to Use
+
+- You have a sample (MBR/VBR image, UEFI module, or kernel driver) suspected of boot-process or
+  kernel-level tampering and stealth.
+- You need to identify the persistence vector and stealth technique class statically.
+
+**Do not use** this on production firmware/boot media without acquisition — analyze a captured
+image. The skill reads bytes statically and executes nothing.
+
+## Prerequisites
+
+- The boot image / UEFI module / driver (read inertly).
+
+## Safety & Handling
+
+- Read bytes statically; never write the sample to boot media or load the driver.
+
+## Workflow
+
+### Step 1: Classify the artifact
+
+```bash
+python scripts/analyst.py classify sample.bin
+```
+
+Detects MBR/VBR (boot signature `0x55AA` at 0x1FE), UEFI modules (PE with `EFI` subsystem / PI
+GUIDs / `EFI_` strings), and kernel drivers (PE importing `ntoskrnl`/`hal`, `.sys` indicators).
+
+### Step 2: Identify tampering / hooking indicators
+
+Flag disk-write primitives (`Int 13h` for MBR bootkits), SSDT/IRP hooking and `Zw*`/`Ke*` kernel
+APIs, DKOM strings, and driver-callback registration.
+
+### Step 3: Map the persistence vector
+
+Determine whether persistence is via MBR/VBR overwrite, UEFI variable/module, or driver service.
+
+### Step 4: Document
+
+Record the artifact type, persistence vector, and stealth technique class, mapping to ATT&CK.
+
+## Validation
+
+- The artifact type is identified by concrete signatures (boot signature, PE subsystem, imports).
+- Tampering/hooking indicators reference real primitives, not generic strings.
+- The persistence vector is stated with its evidence.
+
+## Pitfalls
+
+- A legitimate bootloader/driver resembling a bootkit/rootkit — corroborate with behavior.
+- UEFI modules requiring firmware-volume parsing beyond simple PE checks.
+- Kernel samples needing signed-driver and callback context to confirm stealth.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the classifier.
+- ATT&CK T1542.003 and T1014 (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/dissecting-boot-and-kernel-rootkits/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Analyzing Bootkit and Rootkit Samples
+
+## Overview
+
+`scripts/analyst.py` classifies a sample as an MBR/VBR boot sector, UEFI module, or kernel driver
+(via boot signature, PE subsystem, and kernel imports), then surfaces boot-tampering, kernel
+hooking, and DKOM indicators from strings. It reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | struct, regex, JSON, file IO |
+
+## Core functions
+
+### `classify(path)`
+Returns the artifact type, boolean type flags, indicator lists, and the inferred persistence vector.
+
+### `_is_mbr(data)` / `_is_pe(data)`
+Boot-signature (`0x55AA` at 0x1FE) and PE/subsystem detection.
+
+## Indicator classes
+
+- Boot tampering: `Int 13h`, partition-table strings, `bootmgr`.
+- Kernel hooking: SSDT/IRP, `PsSetCreateProcessNotifyRoutine`, `ObRegisterCallbacks`.
+- DKOM: `EPROCESS`, `ActiveProcessLinks`.
+
+## Usage
+
+```bash
+python scripts/analyst.py classify sample.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1542.003 Bootkit; T1014 Rootkit — https://attack.mitre.org/
+- PE subsystem values (native=1, EFI=10–13) — https://learn.microsoft.com/windows/win32/debug/pe-format
+- MBR `0x55AA` boot signature and kernel callback/hooking primitives from public OS/RE documentation

vendor-new/analyst-ai-pack/skills/dissecting-boot-and-kernel-rootkits/scripts/analyst.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Classify bootkit/rootkit artifacts and surface tampering/hooking indicators.
+
+Detects MBR/VBR boot sectors (0x55AA signature), UEFI modules, and kernel drivers, then scans
+strings for boot-tampering (Int 13h), kernel hooking (SSDT/IRP/Zw*/Ke*), and DKOM indicators.
+Reads bytes statically; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import struct
+import sys
+from pathlib import Path
+
+ASCII_RE = re.compile(rb"[\x20-\x7e]{4,}")
+
+KERNEL_IMPORTS = ["ntoskrnl.exe", "hal.dll", "ndis.sys", "fltmgr.sys", "wdfldr.sys"]
+HOOK_INDICATORS = ["keservicedescriptortable", "kservicedescriptortable", "iocreatedevice",
+                   "ioattachdevice", "psssetcreateprocessnotifyroutine",
+                   "psssetloadimagenotifyroutine", "obregistercallbacks", "ssdt", "irp_mj"]
+DKOM_INDICATORS = ["eprocess", "activeprocesslinks", "psinitialsystemprocess", "kdblock"]
+BOOT_INDICATORS = ["int 13", "\xcd\x13", "invalid partition table", "missing operating system",
+                   "bootmgr"]
+UEFI_INDICATORS = ["efi_", "gefisystemtable", "bootservices", "runtimeservices",
+                   "gizmo_efi", "setvariable"]
+
+
+def _strings(data: bytes) -> str:
+    return "\n".join(m.decode("latin-1", "ignore") for m in ASCII_RE.findall(data)).lower()
+
+
+def _is_mbr(data: bytes) -> bool:
+    return len(data) >= 512 and data[0x1FE:0x200] == b"\x55\xaa"
+
+
+def _is_pe(data: bytes) -> tuple[bool, int | None]:
+    if data[:2] != b"MZ":
+        return False, None
+    e_lfanew = struct.unpack_from("<I", data, 0x3c)[0]
+    if data[e_lfanew:e_lfanew + 4] != b"PE\x00\x00":
+        return False, None
+    subsystem = struct.unpack_from("<H", data, e_lfanew + 24 + 68)[0]
+    return True, subsystem
+
+
+def classify(path: str) -> dict:
+    data = Path(path).read_bytes()
+    blob = _strings(data)
+    raw_low = data[:4096].lower()
+    is_pe, subsystem = _is_pe(data)
+    # PE subsystems: 1 native (driver), 10-13 EFI.
+    is_driver = is_pe and (subsystem == 1 or any(k in blob for k in KERNEL_IMPORTS))
+    is_uefi = is_pe and (subsystem in (10, 11, 12, 13) or any(u in blob for u in UEFI_INDICATORS))
+    is_mbr = _is_mbr(data)
+    artifact = ("MBR/VBR boot sector" if is_mbr else "UEFI module" if is_uefi
+                else "kernel driver" if is_driver else "PE" if is_pe else "unknown")
+    return {
+        "artifact_type": artifact,
+        "is_mbr_vbr": is_mbr,
+        "is_uefi_module": is_uefi,
+        "is_kernel_driver": is_driver,
+        "boot_tampering_indicators": sorted({b for b in BOOT_INDICATORS
+                                             if b in blob or b.encode("latin-1") in raw_low}),
+        "kernel_hooking_indicators": sorted({h for h in HOOK_INDICATORS if h in blob}),
+        "dkom_indicators": sorted({d for d in DKOM_INDICATORS if d in blob}),
+        "persistence_vector": ("MBR/VBR overwrite" if is_mbr else "UEFI module/variable" if is_uefi
+                               else "driver service" if is_driver else "undetermined"),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Classify bootkit/rootkit artifacts")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("classify")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(classify(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())