Paranoia 0.6.0

Paranoia 0.6.0 adds an assembler, 32-bit debugging, plugins, an optional AI assistant, PDB types and a better decompiler, and gives the app a new look.

PSB-C · SIGNED · ATTESTED · SBOM · NO-TELEMETRY · LOCAL-FIRST

Downloads

• Paranoia-Setup-0.6.0.exe: the Windows installer (per-user, no admin rights needed)
• Paranoia-0.6.0-portable.exe: a portable build in a single file
• SHA256SUMS and SHA256SUMS.sigstore.json: the checksums and their Sigstore signature
• paranoia-v0.6.0-rust.cdx.json and paranoia-v0.6.0-npm.cdx.json: the SBOMs (CycloneDX)

Build-provenance and SBOM attestations are attached to every executable. To check a download, see docs/VERIFY.md:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/Altumptic/paranoia/\.github/workflows/ci\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify Paranoia-0.6.0-portable.exe --repo Altumptic/paranoia

The executables are not Authenticode-signed yet, so Windows SmartScreen may warn on first launch (exception PSB-EX-1, expiring 2027-04-30).

New

• Assembler (x86 / x64). Edit → Assemble… patches code from Intel-syntax text: mov eax, [ebx+ecx*4+8], jz 0x401020, lock xadd [rdi], eax, db 0x90, 0xcc. The shortest encoding wins; longer code takes over the instructions it overlaps and the rest is NOP-padded.
• 32-bit Windows debugging. The debugger now runs 32-bit programs (WOW64) as well as x64: eax…eip registers, 4-byte stack slots, breakpoints, stepping.
• Plugins. A folder with a plugin.json and one .js / .py script adds commands to a Plugins menu. Each version is confirmed in a native dialog before it first runs; editing a plugin asks again. See docs/PLUGINS.md.
• AI assistant (optional, off by default). Explain a function, suggest a name (applied only when you click), flag suspicious behaviour. Point it at a local Ollama / LM Studio server and nothing leaves your computer; a remote host needs your confirmation. Requests are made by the desktop process only and carry one function's decompiled text.
• PDB types. Struct, union and enum definitions from a PDB's type stream join the debug-info types, are searchable in the Types panel and offered by Y. DWARF types moved to the same runtime layer, so large binaries no longer bloat the saved annotations (11 MB on one test file).
• Decompiler. Typed-pointer arithmetic follows C (p += 0x60 on a 48-byte T * prints p += 2). Variables now come from reaching definitions, so a register reused for unrelated values becomes separate variables, inside branches and loops too. On real binaries this roughly doubled the variable count and never merged what the old splitting kept apart.
• New design. A small grey whale mark instead of the coloured logo, a VS Code-style menu bar with a command centre, an About dialog, a refreshed theme.

Privacy and security notes

• By default the app still makes no network connections. The only exception is the AI assistant once you configure it; the page itself keeps connect-src 'self'. The API key, if you set one, is encrypted with the OS keystore and never reaches the page. Details: SECURITY-DESIGN.md.
• Plugin code is somebody else's code: JavaScript plugins run in the isolated worker, Python plugins are ordinary programs with your permissions.

Known limits

• The assembler is x86 / x64 only; string instructions (movsb, rep stosd) are not supported yet.
• Reading IDA's binary .sig files, PowerPC, mixed ARM/Thumb images and a Linux debugger are still planned. The decompiler's variable recovery is not yet a full SSA IR with phi-based expression propagation.
• The AI assistant was tested against a stub server, not against real Ollama / LM Studio models, and the native confirmation dialogs for plugins and remote AI hosts were not exercised automatically.