Skip to content

v2.7.0

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 14 Aug 01:17
· 28 commits to main since this release
v2.7.0
a69cc59

Faster scanning

  • Text traits with alternations or case-insensitive literals now go through the Aho-Corasick prefilter instead of running their regex against every file — the prefilter extracts a mandatory literal set from each pattern, and traits matching inside decoded layers (base64, xor) are still fed candidates from those layers so nothing is gated out.
  • Identical bytes are analyzed once: concurrent requests for the same SHA256 (both sides of a diff, duplicate archive members) share a single in-flight analysis, with care taken so Rayon workers never block on it.
  • Diffs skip members whose SHA is identical on both sides entirely.
  • jemalloc keeps freed pages around for 10 minutes instead of returning them immediately, bounding kernel VMA count without growing RSS.

Better archive analysis

  • Nested member paths keep full provenance (bundle.zip!!setup.exe!!payload.dll), and child executables inherit the enclosing archive's config — limits, YARA, extraction settings — instead of standalone defaults.
  • SFX/self-extracting installers found inside archives are materialized to temp files so external extractors (7z, innoextract) can open them.
  • LZMA-alone (.lzma) archives are supported, including base64-embedded blobs.
  • With --all-files, unrecognized members now get the full pipeline (strings, filefacts, capability evaluation) instead of a bare path entry.
  • File-count guard raised from 100k to 350k members (Kibana 9.4 ships ~137k).

Fewer false positives, fewer misses

  • npm download-and-execute detection now only fires on install/publish lifecycle scripts — fixes a Kibana FP from a codegen script.
  • Unchanged files that are hostile on both sides of a diff stay visible in the output instead of being filtered as "no change".
  • New incompatible-regex validator: trait patterns using lookaround or backreferences — which the linear-time engine silently can't compile — are now a hard validation error instead of dead rules.

New surface

  • Repeatable --zip-password flag for encrypted archives (appended to the built-in password list).
  • Library API cleave::extract_member() returns one member's raw bytes (64 MiB cap) — added for isomer.
  • New PE layout metrics: header size/ratio, directory-vs-section mismatches, and prose-looking section counts.
Assets 2
Loading