Skip to content

v1.1.0

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 24 Jul 05:16
· 793 commits to main since this release
v1.1.0
efa1166

Features

  • New systemd service unit file type ("systemd")
  • v4 compact JSON schema for --format json/jsonl: string tuples, 2dp metrics, deduplicated findings, criticality as unsigned ordinals 0–5
  • ~60 new PE fields: header scalars, Authenticode, timestamps, anomaly booleans
  • ~20 new ELF fields: header, linking metadata, symbol counts, build ID/debuglink
  • ~25 new Mach-O fields: CPU type, load commands, dylib info, build version, code signature
  • New ELF finding-level metadata: interpreter, soname, needed libs, rpath/runpath, build-id, debuglink
  • Archive member limit raised 1K → 100K
  • reload_capability_mapper made public for external hot-reload

Improvements

  • Non-program archive members skipped by default (previously all entries were fully analyzed)
  • Streaming archive implementation removed; single unified code path
  • Code-classified strings evaluated first, capped at max(100, len/20) attempts
  • Already-matched traits not re-evaluated
  • In-memory AES payload decryption (eliminates per-extraction disk I/O)
  • Detection limits restored: 256 strings, 1KB file-type sniffing, 5MB AA
  • CLI no longer creates 0-byte log files; log path moved to XDG_STATE_HOME
  • string_value/string_literal renamed to text in trait YAML (old names still accepted)
  • YARA classifier and fileid extracted to their own crates

Bugfixes

  • FileType::Unknown was incorrectly matched against ELF/PE/Mach-O rules
  • ELF syms incorrectly pushed to imports regardless of SHN_UNDEF
  • Orphaned server task slots never released, eventually causing 503s
  • node-gyp Python symlinks falsely flagged as symlink-escape
  • Same base64 payload at multiple offsets reported multiple times
  • RawContentRegexIndex matched decoded string content instead of raw binary data
Assets 2
Loading