AIDebug v3.0.0 Release Notes
AIDebug 3.0 expands the read-only PE workspace into a deeper structural-
analysis environment while preserving the project's evidence-first boundaries.
It also adds explicit configuration for several remote and local LLM providers.
Deeper native PE evidence
The PE workspace now exposes TLS directories and callback tables, x64 runtime-
function and unwind records, load-configuration fields, exploit-mitigation
clues, and detailed Control Flow Guard evidence. Address mappings retain RVA,
VA, and file-offset context, and malformed or truncated structures remain
visible as warnings instead of being silently discarded.
Signatures, provenance clues, and overlays
Authenticode inspection walks aligned certificate records, decodes PKCS#7 and
X.509 evidence, compares embedded and calculated PE digests, and verifies
supported signer signatures. It does not claim Windows root trust, revocation,
or timestamp-authority validation. Rich headers, Debug Directory and CodeView
records, PDB metadata, and exact overlay ranges are available with bounded
viewing and safe, no-overwrite export paths.
Managed PE inspection
For .NET assemblies, AIDebug parses the CLR header, metadata root, streams,
ECMA-335 table layout, Module and Assembly identity, AssemblyRef dependencies,
managed resources, and strong-name metadata. Static inspection never
initializes the CLR and does not execute managed code.
Explicit AI providers
Optional AI analysis can be configured for Anthropic, OpenAI, Google Gemini,
or a local Ollama-compatible endpoint. .env.example documents placeholder
configuration, while private .env files remain ignored. Ambiguous provider
selection fails closed so evidence is not silently sent to an unintended
backend.
Companion guide
The published
PE File Structure for Malware Analysis: A Practical Guide
provides a screenshot-led walkthrough of the AIDebug PE-analysis workflow.
Validation
The release gate checks synchronized metadata, documentation, Ruff, pytest,
Bandit, dependency audits, YARA compilation, Frida JavaScript syntax, source
and wheel contents, Twine metadata, fresh-wheel installation, and safe offline
analysis smoke tests. GitHub CI repeats supported-version checks and repository
secret scanning before the immutable tag is eligible for publication.