Add FOR610 tool/workflow knowledge base and data pipeline

Build comprehensive malware analysis knowledge base from 3 sources:
- SANS FOR610 course: 120 tools, 47 labs, 15 workflows, 27 recipes
- REMnux salt-states: 340 packages parsed from GitHub
- REMnux docs: 280+ tools scraped from docs.remnux.org

Master inventory merges all sources into 447 tools with help tiers
(rich/standard/basic). Pipeline generates: tools.db (397 entries),
397 cheatsheets with multi-tool recipes, 15 workflow guides, 224
TLDR pages, and coverage reports.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

data/generated/tldr/1768.py.md

@@ -0,0 +1,7 @@
+# 1768.py
+
+> Parse Cobalt Strike beacon configuration from shellcode or memory dumps
+
+- Run 1768.py:
+
+`1768.py shellcode.bin`

data/generated/tldr/7-zip.md

@@ -0,0 +1,7 @@
+# 7-Zip
+
+> Compress and decompress files using a variety of algorithms.
+
+- Run 7-Zip:
+
+`7-Zip --help`

data/generated/tldr/aeskeyfinder.md

@@ -0,0 +1,7 @@
+# AESKeyFinder
+
+> Find 128-bit and 256-bit AES keys in a memory image.
+
+- Run AESKeyFinder:
+
+`AESKeyFinder --help`

data/generated/tldr/androguard.md

@@ -0,0 +1,15 @@
+# androguard
+
+> Analyze Android APK files — extract permissions, activities, intents, and decompile DEX code
+
+- Run androguard:
+
+`androguard analyze <app.apk>`
+
+- Run androguard:
+
+`androguard decompile -o output/ <app.apk>`
+
+- Run androguard:
+
+`androgui.py <app.apk>`

data/generated/tldr/androidprojectcreator.md

@@ -0,0 +1,7 @@
+# AndroidProjectCreator
+
+> Convert an Android APK application file into an Android Studio project for easier analysis.
+
+- Run AndroidProjectCreator:
+
+`AndroidProjectCreator --help`

data/generated/tldr/anomy.md

@@ -0,0 +1,7 @@
+# anomy
+
+> A wrapper around wget, ssh, sftp, ftp, and telnet to route these connections through Tor to anonymize your traffic.
+
+- Run anomy:
+
+`anomy --help`

data/generated/tldr/apkid.md

@@ -0,0 +1,7 @@
+# apkid
+
+> Identify compilers, packers, and obfuscators used to protect Android APK and DEX files.
+
+- Run apkid:
+
+`apkid --help`

data/generated/tldr/apktool.md

@@ -0,0 +1,11 @@
+# apktool
+
+> Decompile and recompile Android APK files — extract resources, smali code, and manifest
+
+- Run apktool:
+
+`apktool d <app.apk> -o output/`
+
+- Run apktool:
+
+`apktool b output/ -o rebuilt.apk`

data/generated/tldr/autoit-ripper.md

@@ -0,0 +1,7 @@
+# autoit-ripper
+
+> Extract AutoIt scripts embedded in PE binaries.
+
+- Run autoit-ripper:
+
+`autoit-ripper --help`

data/generated/tldr/baksmali.md

@@ -0,0 +1,7 @@
+# baksmali
+
+> Disassembler for the dex format used by Dalvik, Android's Java VM implementation.
+
+- Run baksmali:
+
+`baksmali --help`

data/generated/tldr/balbuzard.md

@@ -0,0 +1,7 @@
+# balbuzard
+
+> Extract and deobfuscate patterns from suspicious files.
+
+- Run balbuzard:
+
+`balbuzard --help`

data/generated/tldr/base64dump.py.md

@@ -0,0 +1,15 @@
+# base64dump.py
+
+> Extract and decode Base64-encoded strings from files
+
+- Run base64dump.py:
+
+`base64dump.py file.txt`
+
+- Run base64dump.py:
+
+`base64dump.py file.ps1 -n 10`
+
+- Run base64dump.py:
+
+`base64dump.py file.ps1 -s 2 -d`

data/generated/tldr/bbcrack.md

@@ -0,0 +1,7 @@
+# bbcrack
+
+> Detect and decode strings obfuscated with XOR, ROL, and ADD algorithms
+
+- Run bbcrack:
+
+`bbcrack -l 1 specimen.dll`

data/generated/tldr/binee--binary-emulation-environment.md

@@ -0,0 +1,7 @@
+# binee (Binary Emulation Environment)
+
+> Analyze I/O operations of a suspicious PE file by emulating its execution.
+
+- Run binee (Binary Emulation Environment):
+
+`binee (Binary Emulation Environment) --help`

data/generated/tldr/binwalk.md

@@ -0,0 +1,11 @@
+# binwalk
+
+> Analyze and extract embedded files and firmware images
+
+- Run binwalk:
+
+`binwalk firmware.bin`
+
+- Run binwalk:
+
+`binwalk -e firmware.bin`

data/generated/tldr/box-js.md

@@ -0,0 +1,7 @@
+# box-js
+
+> JavaScript sandbox for analyzing malicious scripts by emulating browser/WScript APIs
+
+- Run box-js:
+
+`box-js --output-dir=/tmp suspicious.js`

data/generated/tldr/brxor.py.md

@@ -0,0 +1,7 @@
+# brxor.py
+
+> Brute-force XOR key detection for single-byte XOR-encoded strings
+
+- Run brxor.py:
+
+`brxor.py specimen.dll`

data/generated/tldr/bulk-extractor.md

@@ -0,0 +1,7 @@
+# bulk-extractor
+
+> Extract interesting strings from binary files.
+
+- Run bulk-extractor:
+
+`bulk-extractor --help`

data/generated/tldr/burp-suite-community-edition.md

@@ -0,0 +1,7 @@
+# Burp Suite Community Edition
+
+> Investigate website interactions using this web proxy.
+
+- Run Burp Suite Community Edition:
+
+`Burp Suite Community Edition --help`

data/generated/tldr/bytehist.md

@@ -0,0 +1,7 @@
+# Bytehist
+
+> Generate byte-usage histograms to visually identify packed or encrypted sections in binaries
+
+- Run Bytehist:
+
+`bytehist specimen.exe`

data/generated/tldr/cabextract.md

@@ -0,0 +1,7 @@
+# cabextract
+
+> Extract Microsoft cabinet (cab) files.
+
+- Run cabextract:
+
+`cabextract --help`

data/generated/tldr/capa.md

@@ -0,0 +1,15 @@
+# capa
+
+> Identify malware capabilities mapped to MITRE ATT&CK framework and Malware Behavior Catalog
+
+- Run capa:
+
+`capa specimen.exe`
+
+- Run capa:
+
+`capa -vv specimen.exe`
+
+- Run capa:
+
+`capa -vv specimen.exe | grep -A7 'Suspended Process'`

data/generated/tldr/cast.md

@@ -0,0 +1,7 @@
+# cast
+
+> Install and manage SaltStack-based Linux distributions.
+
+- Run cast:
+
+`cast --help`

data/generated/tldr/cfr.md

@@ -0,0 +1,11 @@
+# cfr
+
+> Modern Java decompiler — handles Java 8+ features including lambdas and try-with-resources
+
+- Run cfr:
+
+`cfr <file.jar> --outputdir output/`
+
+- Run cfr:
+
+`cfr <file.class>`

data/generated/tldr/chepy.md

@@ -0,0 +1,7 @@
+# chepy
+
+> Decode and otherwise analyze data using this command-line tool and Python library.
+
+- Run chepy:
+
+`chepy --help`

data/generated/tldr/clamav.md

@@ -0,0 +1,15 @@
+# ClamAV
+
+> Open-source antivirus — scan files for known malware signatures
+
+- Run ClamAV:
+
+`clamscan <sample>`
+
+- Run ClamAV:
+
+`clamscan -r <directory>/`
+
+- Run ClamAV:
+
+`freshclam`

data/generated/tldr/cobalt-strike-configuration-extractor--csce--and-parser.md

@@ -0,0 +1,7 @@
+# Cobalt Strike Configuration Extractor (CSCE) and Parser
+
+> Analyze Cobalt Strike beacons.
+
+- Run Cobalt Strike Configuration Extractor (CSCE) and Parser:
+
+`Cobalt Strike Configuration Extractor (CSCE) and Parser --help`

data/generated/tldr/cs-analyze-processdump.py.md

@@ -0,0 +1,7 @@
+# cs-analyze-processdump.py
+
+> Analyze Cobalt Strike beacon process dumps for sleep mask encoding
+
+- Run cs-analyze-processdump.py:
+
+`cs-analyze-processdump.py <process_dump>`

data/generated/tldr/cs-decrypt-metadata.py.md

@@ -0,0 +1,7 @@
+# cs-decrypt-metadata.py
+
+> Decrypt Cobalt Strike beacon metadata from network captures
+
+- Run cs-decrypt-metadata.py:
+
+`cs-decrypt-metadata.py <metadata_hex>`

data/generated/tldr/cs-extract-key.py.md

@@ -0,0 +1,7 @@
+# cs-extract-key.py
+
+> Extract AES and HMAC encryption keys from Cobalt Strike beacon process memory dumps
+
+- Run cs-extract-key.py:
+
+`cs-extract-key.py -f <process_dump>`

data/generated/tldr/cs-parse-traffic.py.md

@@ -0,0 +1,7 @@
+# cs-parse-traffic.py
+
+> Decrypt and parse Cobalt Strike beacon network traffic using extracted keys
+
+- Run cs-parse-traffic.py:
+
+`cs-parse-traffic.py -f <capture.pcap> -k <keys_file>`

data/generated/tldr/curl.md

@@ -0,0 +1,11 @@
+# curl
+
+> Transfer data to/from servers using various protocols
+
+- Run curl:
+
+`curl -L http://example.com`
+
+- Run curl:
+
+`curl -o output.bin http://example.com/file`

data/generated/tldr/cut-bytes.py.md

@@ -0,0 +1,7 @@
+# cut-bytes.py
+
+> Cut out a part of a data stream.
+
+- Run cut-bytes.py:
+
+`cut-bytes.py --help`

data/generated/tldr/cutter.md

@@ -0,0 +1,7 @@
+# Cutter
+
+> Open-source reverse engineering platform — Qt-based GUI for radare2
+
+- Run Cutter:
+
+`cutter specimen.exe`

data/generated/tldr/cyberchef.md

@@ -0,0 +1,7 @@
+# CyberChef
+
+> Web-based data transformation tool — decode Base64, XOR, hex, decompress, and chain operations
+
+- Run CyberChef:
+
+`cyberchef`

data/generated/tldr/dc3-mwcp.md

@@ -0,0 +1,11 @@
+# dc3-mwcp
+
+> DC3 Malware Configuration Parser — extract C2 configs from known malware families
+
+- Run dc3-mwcp:
+
+`mwcp parse <sample>`
+
+- Run dc3-mwcp:
+
+`mwcp parse -p Emotet <sample>`

data/generated/tldr/de4dot.md

@@ -0,0 +1,7 @@
+# de4dot
+
+> .NET deobfuscator — remove obfuscation from .NET assemblies
+
+- Run de4dot:
+
+`de4dot obfuscated.exe`

data/generated/tldr/decode-vbe.py.md

@@ -0,0 +1,7 @@
+# decode-vbe.py
+
+> Decode encoded VBS scripts (VBE).
+
+- Run decode-vbe.py:
+
+`decode-vbe.py --help`

data/generated/tldr/decompyle.md

@@ -0,0 +1,7 @@
+# Decompyle++
+
+> Python bytecode disassembler and decompiler.
+
+- Run Decompyle++:
+
+`Decompyle++ --help`

data/generated/tldr/dex2jar.md

@@ -0,0 +1,7 @@
+# dex2jar
+
+> Examine Dalvik Executable (dex) files.
+
+- Run dex2jar:
+
+`dex2jar --help`

data/generated/tldr/dexray.md

@@ -0,0 +1,7 @@
+# dexray
+
+> Extract and decode data from antivirus quarantine files.
+
+- Run dexray:
+
+`dexray --help`

data/generated/tldr/diec.md

@@ -0,0 +1,7 @@
+# diec
+
+> Detect packers, compilers, and tools used to create executables
+
+- Run diec:
+
+`diec specimen.exe`

data/generated/tldr/disitool.md

@@ -0,0 +1,7 @@
+# disitool
+
+> Manipulate embedded digital signatures.
+
+- Run disitool:
+
+`disitool --help`

data/generated/tldr/dissect.md

@@ -0,0 +1,7 @@
+# dissect
+
+> Perform a variety of forensics and incident response tasks using this DFIR framework and toolset.
+
+- Run dissect:
+
+`dissect --help`

data/generated/tldr/dnfile.md

@@ -0,0 +1,7 @@
+# dnfile
+
+> Analyze static properties of.
+
+- Run dnfile:
+
+`dnfile --help`

data/generated/tldr/dnslib.md

@@ -0,0 +1,7 @@
+# dnslib
+
+> Python library to encode/decode DNS wire-format packets.
+
+- Run dnslib:
+
+`dnslib --help`

data/generated/tldr/dnsresolver.py.md

@@ -0,0 +1,7 @@
+# dnsresolver.py
+
+> DNS resolver tool for dynamic analysis with wildcard and tracking support.
+
+- Run dnsresolver.py:
+
+`dnsresolver.py --help`

data/generated/tldr/docker.md

@@ -0,0 +1,7 @@
+# docker
+
+> Run and manage containers.
+
+- Run docker:
+
+`docker --help`

data/generated/tldr/dos2unix.md

@@ -0,0 +1,7 @@
+# dos2unix
+
+> Convert text files with Windows or macOS line breaks to Unix line breaks and vice versa.
+
+- Run dos2unix:
+
+`dos2unix --help`

data/generated/tldr/dotnetfile.md

@@ -0,0 +1,7 @@
+# dotnetfile
+
+> Analyze static properties of.
+
+- Run dotnetfile:
+
+`dotnetfile --help`

data/generated/tldr/droidlysis.md

@@ -0,0 +1,7 @@
+# droidlysis
+
+> Perform static analysis of Android applications.
+
+- Run droidlysis:
+
+`droidlysis --help`

data/generated/tldr/emldump.py.md

@@ -0,0 +1,7 @@
+# emldump.py
+
+> Parse and analyze EML email message files
+
+- Run emldump.py:
+
+`emldump.py message.eml`

data/generated/tldr/epic-irc-client.md

@@ -0,0 +1,7 @@
+# EPIC IRC Client
+
+> Examine IRC activities with this IRC client.
+
+- Run EPIC IRC Client:
+
+`EPIC IRC Client --help`

data/generated/tldr/evilclippy.md

@@ -0,0 +1,7 @@
+# evilclippy
+
+> Remove VBA project password protection and manipulate Office macro settings
+
+- Run evilclippy:
+
+`evilclippy -uu document.docm`

data/generated/tldr/evince.md

@@ -0,0 +1,7 @@
+# evince
+
+> View documents in a variety of formats, including PDF.
+
+- Run evince:
+
+`evince --help`

data/generated/tldr/ex-pe-xor.md

@@ -0,0 +1,7 @@
+# ex-pe-xor
+
+> Search an XOR'ed file for indications of executable binaries.
+
+- Run ex-pe-xor:
+
+`ex-pe-xor --help`

data/generated/tldr/exiftool.md

@@ -0,0 +1,11 @@
+# exiftool
+
+> Extract metadata from files (PDF, images, documents, executables)
+
+- Run exiftool:
+
+`exiftool document.pdf`
+
+- Run exiftool:
+
+`exiftool specimen.exe`

data/generated/tldr/fakedns.md

@@ -0,0 +1,7 @@
+# fakedns
+
+> Fake DNS server that resolves all queries to a specified IP for traffic interception
+
+- Run fakedns:
+
+`fakedns`

data/generated/tldr/fakemail.md

@@ -0,0 +1,7 @@
+# fakemail
+
+> Intercept and examine SMTP email activity with this fake SMTP server.
+
+- Run fakemail:
+
+`fakemail --help`

data/generated/tldr/fakenet-ng.md

@@ -0,0 +1,11 @@
+# fakenet-ng
+
+> Emulate network services (HTTP, DNS, SMTP, FTP) to intercept and analyze malware traffic dynamically
+
+- Run fakenet-ng:
+
+`fakenet`
+
+- Run fakenet-ng:
+
+`fakenet -c custom_config.ini`

data/generated/tldr/feh.md

@@ -0,0 +1,7 @@
+# feh
+
+> Lightweight image viewer for viewing extracted images from documents
+
+- Run feh:
+
+`feh extracted_image.jpg`

data/generated/tldr/file-magic.py.md

@@ -0,0 +1,7 @@
+# file-magic.py
+
+> Identify file types using the Python magic module.
+
+- Run file-magic.py:
+
+`file-magic.py --help`

data/generated/tldr/file.md

@@ -0,0 +1,11 @@
+# file
+
+> Determine file type and MIME type using magic bytes
+
+- Run file:
+
+`file specimen.exe`
+
+- Run file:
+
+`file document.doc`

data/generated/tldr/firefox.md

@@ -0,0 +1,7 @@
+# firefox
+
+> Web browser.
+
+- Run firefox:
+
+`firefox --help`

data/generated/tldr/floss.md

@@ -0,0 +1,15 @@
+# FLOSS
+
+> Automatically extract obfuscated strings from malware using static analysis, stack strings, and emulation
+
+- Run FLOSS:
+
+`floss specimen.exe`
+
+- Run FLOSS:
+
+`floss specimen.exe > strings-output.txt`
+
+- Run FLOSS:
+
+`floss --no-static -- specimen.exe`

data/generated/tldr/format-bytes.py.md

@@ -0,0 +1,7 @@
+# format-bytes.py
+
+> Decompose structured binary data with format strings.
+
+- Run format-bytes.py:
+
+`format-bytes.py --help`

data/generated/tldr/frida.md

@@ -0,0 +1,15 @@
+# Frida
+
+> Dynamic instrumentation toolkit — hook and trace running processes, intercept function calls in real time
+
+- Run Frida:
+
+`frida -l hook.js <process_name>`
+
+- Run Frida:
+
+`frida-trace -i 'recv*' <process_name>`
+
+- Run Frida:
+
+`frida-ps -U`

data/generated/tldr/ghidra.md

@@ -0,0 +1,7 @@
+# Ghidra
+
+> Open-source disassembler and decompiler from NSA with scripting, function graphs, and data type management
+
+- Run Ghidra:
+
+`ghidra`

data/generated/tldr/ghidrassistmcp.md

@@ -0,0 +1,7 @@
+# GhidrAssistMCP
+
+> MCP server for AI-assisted reverse engineering in Ghidra.
+
+- Run GhidrAssistMCP:
+
+`GhidrAssistMCP --help`

data/generated/tldr/gnome-calculator.md

@@ -0,0 +1,7 @@
+# GNOME Calculator
+
+> Calculator.
+
+- Run GNOME Calculator:
+
+`GNOME Calculator --help`

data/generated/tldr/gnu-wget.md

@@ -0,0 +1,7 @@
+# GNU Wget
+
+> Interact with servers via HTTP, HTTPS, FTP, and FTPS using this command-line tool.
+
+- Run GNU Wget:
+
+`GNU Wget --help`

data/generated/tldr/goresym.md

@@ -0,0 +1,7 @@
+# goresym
+
+> Extract metadata and symbols from Go binaries, including stripped ones.
+
+- Run goresym:
+
+`goresym --help`

data/generated/tldr/gunzip.md

@@ -0,0 +1,7 @@
+# gunzip
+
+> Decompress gzip-compressed data (often used in multi-stage payload extraction)
+
+- Run gunzip:
+
+`gunzip -c compressed.gz > output.bin`

data/generated/tldr/hachoir.md

@@ -0,0 +1,7 @@
+# Hachoir
+
+> View, edit, and carve contents of various binary file types.
+
+- Run Hachoir:
+
+`Hachoir --help`

data/generated/tldr/hash-id.md

@@ -0,0 +1,7 @@
+# Hash ID
+
+> Identify different types of hashes.
+
+- Run Hash ID:
+
+`Hash ID --help`

data/generated/tldr/hex-to-bin.py.md

@@ -0,0 +1,7 @@
+# hex-to-bin.py
+
+> Convert hexadecimal text dumps to binary data.
+
+- Run hex-to-bin.py:
+
+`hex-to-bin.py --help`

data/generated/tldr/hexdump.md

@@ -0,0 +1,7 @@
+# hexdump
+
+> Display file content in hexadecimal format
+
+- Run hexdump:
+
+`hexdump -C binary.dat`

data/generated/tldr/httpd.md

@@ -0,0 +1,7 @@
+# httpd
+
+> Simple HTTP server on REMnux for simulating C2 web servers
+
+- Run httpd:
+
+`httpd`

data/generated/tldr/ibus.md

@@ -0,0 +1,7 @@
+# ibus
+
+> Adjust input methods for the GUI.
+
+- Run ibus:
+
+`ibus --help`

data/generated/tldr/ilspy.md

@@ -0,0 +1,7 @@
+# ILSpy
+
+> .NET assembly decompiler — view C#/VB.NET source from compiled .NET binaries
+
+- Run ILSpy:
+
+`ILSpy.exe assembly.exe`

data/generated/tldr/ilspycmd.md

@@ -0,0 +1,7 @@
+# ilspycmd
+
+> Command-line .NET decompiler (CLI version of ILSpy)
+
+- Run ilspycmd:
+
+`ilspycmd assembly.exe > decompiled.cs`

data/generated/tldr/imagemagick.md

@@ -0,0 +1,7 @@
+# imagemagick
+
+> View and manipulate image and related files.
+
+- Run imagemagick:
+
+`imagemagick --help`

data/generated/tldr/inetsim.md

@@ -0,0 +1,7 @@
+# INetSim
+
+> Emulate internet services (HTTP, HTTPS, DNS, FTP, SMTP) for malware analysis in isolated labs
+
+- Run INetSim:
+
+`inetsim`

data/generated/tldr/inspircd.md

@@ -0,0 +1,7 @@
+# inspircd
+
+> Examine IRC activity with this IRC server.
+
+- Run inspircd:
+
+`inspircd --help`

data/generated/tldr/ioc-parser.md

@@ -0,0 +1,7 @@
+# ioc-parser
+
+> Extract indicators of compromise (IOCs) from PDF reports and text files
+
+- Run ioc-parser:
+
+`ioc_parser <report.pdf>`

data/generated/tldr/iptables.md

@@ -0,0 +1,7 @@
+# iptables
+
+> Linux firewall and NAT tool for redirecting IP-based malware traffic
+
+- Run iptables:
+
+`iptables -t nat -A PREROUTING -i ens32 -j REDIRECT`

data/generated/tldr/ipwhois.md

@@ -0,0 +1,7 @@
+# ipwhois
+
+> Retrieve and parse whois data for IP addresses.
+
+- Run ipwhois:
+
+`ipwhois --help`

data/generated/tldr/jadx.md

@@ -0,0 +1,11 @@
+# jadx
+
+> Decompile Android DEX/APK to Java source code with a GUI or command line
+
+- Run jadx:
+
+`jadx <app.apk> -d output/`
+
+- Run jadx:
+
+`jadx-gui <app.apk>`

data/generated/tldr/java-idx-parser.md

@@ -0,0 +1,7 @@
+# java-idx-parser
+
+> Analyze Java IDX files.
+
+- Run java-idx-parser:
+
+`java-idx-parser --help`

data/generated/tldr/javassist.md

@@ -0,0 +1,7 @@
+# Javassist
+
+> Java bytecode engineering toolkit/library.
+
+- Run Javassist:
+
+`Javassist --help`

data/generated/tldr/jd-gui-java-decompiler.md

@@ -0,0 +1,7 @@
+# JD-GUI Java Decompiler
+
+> Java decompiler with GUI.
+
+- Run JD-GUI Java Decompiler:
+
+`JD-GUI Java Decompiler --help`

data/generated/tldr/jd-gui.md

@@ -0,0 +1,7 @@
+# jd-gui
+
+> Visual Java decompiler with GUI — browse and search decompiled JAR/class files
+
+- Run jd-gui:
+
+`jd-gui <file.jar>`

data/generated/tldr/jq.md

@@ -0,0 +1,11 @@
+# jq
+
+> Command-line JSON processor for extracting and transforming structured data
+
+- Run jq:
+
+`cat report.json | jq '.apis'`
+
+- Run jq:
+
+`jq -r '.entry' report.json`

data/generated/tldr/js-beautify.md

@@ -0,0 +1,7 @@
+# js-beautify
+
+> Format and beautify obfuscated JavaScript code for readability
+
+- Run js-beautify:
+
+`js-beautify malicious.js > beautified.js`

data/generated/tldr/jstillery.md

@@ -0,0 +1,7 @@
+# jstillery
+
+> Deobfuscate JavaScript scripts using AST and Partial Evaluation techniques.
+
+- Run jstillery:
+
+`jstillery --help`

data/generated/tldr/libemu.md

@@ -0,0 +1,7 @@
+# libemu
+
+> A library for x86 code emulation and shellcode detection.
+
+- Run libemu:
+
+`libemu --help`

data/generated/tldr/libolecf.md

@@ -0,0 +1,7 @@
+# libolecf
+
+> Microsoft Office OLE2 compound documents.
+
+- Run libolecf:
+
+`libolecf --help`

data/generated/tldr/lief.md

@@ -0,0 +1,7 @@
+# lief
+
+> Parse and analyze PE, ELF, MachO, DEX, OAT, VDEX, ART, and DWARF executable formats.
+
+- Run lief:
+
+`lief --help`

data/generated/tldr/magika.md

@@ -0,0 +1,7 @@
+# magika
+
+> Identify file type using signatures.
+
+- Run magika:
+
+`magika --help`

data/generated/tldr/mail-parser.md

@@ -0,0 +1,7 @@
+# mail-parser
+
+> Parse raw SMTP email messages and extract headers, body, and attachments
+
+- Run mail-parser:
+
+`python3 -c "import mailparser; mail = mailparser.parse_from_file('<email.eml>'); print(mail.subject)"`