Integrate findings from reverse engineering a major EDR's kernel driver
and on-sensor ML model into the skill and analyzer.
- SKILL.md: model architecture, import capability rankings, scoring math,
runtime detection warnings, alternative execution model guidance
- pe_structural_analyzer.py: Re01-Re43 import mapping, BM/FPE simulation,
10KB cloud boundary, estimated EDR score output
- New reference: edr-model-intelligence.md
- Updated references with verified feature weights
Skill, PE structural analyzer, and reference docs for systematically
reducing VirusTotal/EDR detection rates on compiled Go binaries via
structural analysis and disciplined A/B testing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
michaelweber