reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/recovering-injected-code-and-shellcode/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/recovering-injected-code-and-shellcode/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: recovering-injected-code-and-shellcode
+description: 'Carves injected PE images and position-independent shellcode from a memory dump or
+  carved region, identifies the payload type, and prepares it for disassembly or emulation.
+  Activates for requests to recover injected code, carve shellcode from memory, or reconstruct a
+  dumped payload for analysis.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - shellcode
+  - memory-forensics
+  - carving
+  - dynamic-analysis
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1055
+  - T1620
+  - T1027
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1620 Reflective Code Loading — https://attack.mitre.org/techniques/T1620/'
+  - 'MITRE ATT&CK T1055 Process Injection — https://attack.mitre.org/techniques/T1055/'
+---
+
+# Recovering Injected Code and Shellcode
+
+## When to Use
+
+- You have a carved memory region (from malfind/vaddump) and need to identify and extract the
+  payload — an injected PE or raw shellcode.
+- You need to locate likely shellcode entry points (egg hunters, GetPC stubs) before disassembly.
+
+**Do not use** this to execute the payload — it prepares code for static disassembly/emulation in
+a controlled tool, not for running.
+
+## Prerequisites
+
+- A carved binary region (raw bytes) from a memory image.
+
+## Safety & Handling
+
+- The carved region is live malicious code; store it password-protected and never execute it.
+
+## Workflow
+
+### Step 1: Identify payload type
+
+```bash
+python scripts/analyst.py identify region.bin
+```
+
+Detects an embedded `MZ`/PE (with offset) versus raw shellcode, and reports the PE's architecture
+if present.
+
+### Step 2: Locate shellcode entry hints
+
+Finds common position-independent code markers: GetPC stubs (`call $+5`/`fldz/fnstenv`), PEB
+access (`fs:[30]`/`gs:[60]`), and API-hashing loops.
+
+### Step 3: Extract for analysis
+
+Carve the PE at its offset (or keep the raw shellcode) and hand it to a disassembler/emulator at
+the detected base/entry.
+
+### Step 4: Document
+
+Record offsets, architecture, and entry hints for the downstream RE workflow.
+
+## Validation
+
+- An embedded PE is confirmed by `MZ` + valid `e_lfanew` → `PE\0\0`.
+- Shellcode entry hints reference real PIC patterns, not arbitrary bytes.
+- Architecture detection matches the PE Machine field (or PIC heuristics for raw shellcode).
+
+## Pitfalls
+
+- Assuming everything carved is a PE; much injected code is headerless shellcode.
+- Wrong base address breaking relocations when loading a dumped PE — note it for rebuilding.
+- Treating compressed/encrypted stages as final shellcode without a decode pass.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the identifier.
+- ATT&CK T1620 and T1055 (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/recovering-injected-code-and-shellcode/references/api-reference.md

@@ -0,0 +1,40 @@
+# API Reference: Recovering Injected Code and Shellcode
+
+## Overview
+
+`scripts/analyst.py` triages a carved memory region: it locates embedded MZ/PE headers (validating
+`e_lfanew` → `PE\0\0` and reading the Machine field) and scans for position-independent code
+markers. It reads bytes statically and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | struct, JSON, file IO |
+
+## Core functions
+
+### `identify(path)`
+Returns embedded PE offsets/architecture, shellcode hint flags, and whether the region is likely
+raw shellcode.
+
+### `_pe_at(data, off)`
+Validates an MZ/PE header at an offset and returns its architecture.
+
+## PIC markers detected
+
+- GetPC stubs (`call $+5`, `fnstenv`)
+- PEB access (`fs:[30]` x86, `gs:[60]` x64)
+- API-hashing loops (`lodsb` + `ror 13`)
+
+## Usage
+
+```bash
+python scripts/analyst.py identify region.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1620 Reflective Code Loading — https://attack.mitre.org/techniques/T1620/
+- MITRE ATT&CK T1055 Process Injection — https://attack.mitre.org/techniques/T1055/
+- PE/COFF specification (e_lfanew, Machine values); ror13 API-hash pattern from public shellcode research

vendor-new/analyst-ai-pack/skills/recovering-injected-code-and-shellcode/scripts/analyst.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""Identify and triage a carved memory region as an injected PE or raw shellcode.
+
+Detects an embedded MZ/PE header (reporting its offset and architecture) and scans for common
+position-independent code markers (GetPC stubs, PEB access, API-hash loops). Reads bytes
+statically; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import struct
+import sys
+from pathlib import Path
+
+MACHINE = {0x14c: "x86", 0x8664: "x64", 0x1c0: "arm", 0xaa64: "arm64"}
+
+PIC_HINTS = {
+    "getpc_callpop": [b"\xe8\x00\x00\x00\x00", b"\xd9\xee\xd9\x74\x24\xf4"],  # call$+5, fldz/fnstenv
+    "peb_access_x86": [b"\x64\xa1\x30\x00\x00\x00", b"\x64\x8b"],            # fs:[30]
+    "peb_access_x64": [b"\x65\x48\x8b", b"\x65\x4c\x8b"],                    # gs:[60]
+    "api_hash_loop": [b"\xac", b"\xc1\xcf\x0d", b"\xc1\xca\x0d"],            # lodsb + ror13
+}
+
+
+def _pe_at(data: bytes, off: int) -> dict | None:
+    if data[off:off + 2] != b"MZ" or off + 0x40 > len(data):
+        return None
+    e_lfanew = struct.unpack_from("<I", data, off + 0x3c)[0]
+    pe = off + e_lfanew
+    if pe + 6 > len(data) or data[pe:pe + 4] != b"PE\x00\x00":
+        return None
+    machine = struct.unpack_from("<H", data, pe + 4)[0]
+    return {"offset": off, "machine": MACHINE.get(machine, hex(machine))}
+
+
+def identify(path: str) -> dict:
+    data = Path(path).read_bytes()
+    pes = []
+    start = 0
+    while True:
+        idx = data.find(b"MZ", start)
+        if idx == -1:
+            break
+        info = _pe_at(data, idx)
+        if info:
+            pes.append(info)
+        start = idx + 1
+        if len(pes) > 20:
+            break
+    hints = {name: True for name, sigs in PIC_HINTS.items() if any(s in data for s in sigs)}
+    return {
+        "size": len(data),
+        "embedded_pe": pes,
+        "is_pe": bool(pes),
+        "shellcode_hints": sorted(hints.keys()),
+        "likely_raw_shellcode": not pes and bool(hints),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Identify injected PE / shellcode in a region")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("identify")
+    p.add_argument("region")
+    args = parser.parse_args(argv)
+    print(json.dumps(identify(args.region), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())