<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Ransomware Encryption Algorithms

## File Analysis

| Command | Description |
|---|---|
| `file <encrypted_file>` | Identify file type (encrypted files show as "data") |
| `xxd <file> \| head -20` | Hex dump of file header |
| `ent <file>` | Shannon entropy analysis |
| `binwalk <file>` | Scan for embedded signatures |

## String Extraction

| Command | Description |
|---|---|
| `strings <binary>` | Extract ASCII strings |
| `strings -el <binary>` | Extract UTF-16LE strings (Windows) |
| `strings <binary> \| grep -iE '(AES\|RSA\|Crypt)'` | Filter crypto strings |

## Radare2 Analysis

| Command | Description |
|---|---|
| `r2 -A <binary> -c "afl~crypt" -q` | List crypto-related functions |
| `r2 -A <binary> -c "ii~Crypt" -q` | List crypto API imports |
| `r2 -A <binary> -c "/x 637279707400" -q` | Search for "crypt" bytes |
| `r2 -A <binary> -c "izz~AES" -q` | Search strings for AES references |

## YARA Crypto Rules

```yara
rule CryptoConstants {
    meta:
        description = "Detects AES S-box constants in binary"
    strings:
        $aes_sbox = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 }
        $rsa_marker = "-----BEGIN RSA"
    condition:
        any of them
}
```

## Memory Analysis

| Command | Description |
|---|---|
| `volatility3 -f <dump> windows.pslist` | List processes |
| `volatility3 -f <dump> windows.memmap --pid <pid> --dump` | Dump process memory |
| `strings <memdump> \| grep -E '^[0-9a-f]{64}$'` | Find potential AES keys |

## Agent Script

```bash
# Analyze file entropy
node agent.js entropy encrypted_file.locked

# Extract crypto strings from binary
node agent.js strings ransomware.exe

# Identify family from ransom note
node agent.js identify ransom_note.txt

# Check for available decryptor
node agent.js decryptor "STOP/Djvu"
```
