<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Ransomware Decryption Feasibility — API Reference

## YARA Rules for Identification

```bash
# Scan file with ransomware rules
yara -r ransomware.yar /path/to/sample

# Scan with metadata output
yara -r -m ransomware.yar /path/to/sample

# Scan memory dump
yara -r ransomware.yar /evidence/memory.dmp
```

## Volatility 3 — Key Recovery

```bash
# List processes (find ransomware PID)
vol -f memory.dmp windows.pslist

# Dump process memory
vol -f memory.dmp windows.memmap --pid <PID> --dump

# Search for key material
vol -f memory.dmp windows.filescan | grep -i key

# Scan for RSA keys
strings memory.dmp | grep "BEGIN.*PRIVATE KEY"
```

## PhotoRec File Recovery

```bash
# Interactive recovery
photorec /dev/sda2

# Recover from disk image
photorec /cmd disk.img fileopt,everything,enable search
```

## Hex Analysis

```bash
# Compare file headers
xxd -l 64 encrypted_file | head
xxd -l 64 known_good_file | head

# Extract bytes at offset
dd if=encrypted_file bs=1 skip=4096 count=1024 2>/dev/null | xxd
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `sample` | Ransomware binary or encrypted file | `/evidence/sample.exe` |
| `family` | Ransomware family name | `gandcrab` |
| `memory_dump` | Memory dump file path | `/evidence/memory.dmp` |
| `pid` | Ransomware process ID | `4832` |
