Skip to content

Sage II

Latest
Latest

Choose a tag to compare

View all tags
@gaurav-gogia gaurav-gogia released this 12 Oct 19:14
v2.6.1
7a5fd74
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Mutant 2.6.1 - Sage II

A patch release for the workshop and the documentation. The compiler, the VM, the builtins, the language server and the CLI are the same code as in 2.6.0; only the version they report differs. Upgrading is a drop-in replacement, and programs compiled with 2.6.0 run without recompiling.

Workshop

  • The three DFRWS deep dives are standalone programs in examples/workshop/dfrws/. Each imports nothing and names its input on one line, so it runs on the workshop's evidence or on your own.

    • 1_timestomp: a $STANDARD_INFORMATION creation time earlier than the $FILE_NAME one, on every NTFS partition of an MBR or GPT disk or on a bare volume.
    • 2a_ad_redirects: each Chrome redirect chain, walked back to the ad click that started it.
    • 2b_ad_cookies: cookies from sites the history never visited.
    • 3_run_keys: the Run* keys of an NTUSER.DAT or SOFTWARE hive.

  • The evidence builds one topic at a time. build_evidence.ps1 -Topic timestomp,ads,registry (or build_evidence.sh --topic …) builds only what the deep dives read. With no option, all four topics are built, including the full case.

  • The workshop targets 2.6.1, and every program still runs on 2.6.0.

  • fsagen v0.4.0 or later is required. No version is pinned: the build scripts ask fsagen for the features they use and name any that is missing.

  • Beats 02, 03, 04, 07 and 09 no longer stop on a partial corpus, for example one where Defender removed the generated executable.

  • The shorter versions of the deep dives work again.

    • stomp_two_clocks no longer crashes on the GPT disk image.
    • ad_redirects and ad_cookies find Chrome's files at the paths the evidence now uses.

  • The corpus counts match a v0.4.0 build:

    Volume Files Timeline rows
    NTFS 100 136
    ext4 100 135

Examples and documentation

  • Example programs and guides use role names (analyst, example examiner, person_a) instead of people's names.

VS Code extension 0.3.1

It names Mutant 2.6.1 and carries a development-dependency update. Its behaviour is unchanged from 0.3.0.

Known issues

Every known issue listed for 2.6.0 still applies; see CHANGELOG.md.

Full changelog: v2.6.0...v2.6.1

Assets 10
Loading