Synthesis: handle runtime-resolved / custom IATs and dynamic API refs (future work)

[danielplohmann]

Context

PR #198 adds experimental binary synthesis (SmdaReport.synthesizeBinary()), which rebuilds import tables from xmetadata["imported_functions"]. The current review fixes (see PR #198) harden the native IAT path (non-contiguous slot padding, defensive fallbacks, etc.).

This issue tracks a broader, separate limitation that should NOT be addressed in PR #198:

• SMDA records imports from the native IAT only. Malware frequently resolves APIs at runtime and caches them in custom / secondary IATs that the sample builds and maintains itself, often with format violations (no zero terminators, scattered / non-contiguous slots, possibly interleaved with code or data).
• These dynamic API references are not listed among the imported symbols, so the synthesized binary's import view is inconsistent with what the sample actually uses.

Open questions / future work

• Detect and record runtime-resolved API references (e.g. from dataflow-resolved indirect calls) so they appear in imported_functions.
• Make synthesis robust to custom IAT layouts (e.g. a contiguous synthetic IAT backed by .bspack, rather than depending on the original possibly-broken IAT structure for import enumeration).
• Decide whether custom IAT slots that fall inside code/data regions should be tolerated without corrupting those bytes.

Scope

Out of scope for PR #198 — tracked here so the simpler review fixes can land without blocking on this larger, partly-open-ended problem.