Skip to content

v2.3.0 (migrated from Codeberg)

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 24 Jul 05:16
v2.3.0
1435c58

Features

  • length_min/length_max bound regex match length; replaces costly {4000,} repetitions.
  • KV length bounds now match strings by byte length (previously never matched).
  • New regex-memory validator flags patterns that exceed budget or silently never compile.
  • Benign fixtures can require a minimum score.
  • Compact JSON: parent id (pid), trait IDs in descriptions.
  • Archive entries report entropy, magic bytes, and extension/type mismatch.
  • PyInstaller entries tagged by kind.
  • Tiny render: benign files show their strongest traits; binary windows get hex-offset rows.
  • FreeBSD/arm64 builds again!
  • Automated trait publishing on a timer (unsigned for now).

Fixes

  • near_* windows could match on any: legs alone while an all: leg sat far away; windows now require every all: leg. Fixes false positives.
  • Java exfil triggers narrowed to explicit exfil terms; upload alone no longer fires.
  • Mach-O malformed-header check skips files under 4 KB.
  • XOR payload noise in text files suppressed unless it looks like runnable source.

Optimizations

  • Regex engine rebuilt on regex_automata with byte-budgeted caches; removes 1.5-4 GB RSS spikes on large binaries. Match semantics unchanged.
  • Parallel prefilter and path-trait evaluation for large archives.
  • Indexed unless: suppression; was a linear scan per finding.
  • YARA scanner cache 4 to 64; avoids ~31k scanner rebuilds on a 13k-member archive.
Assets 2
Loading