Skip to content

v1.5.0

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 08 Sep 15:27
· 10 commits to main since this release
v1.5.0
d8f4895

Features

  • New markdown extractor lifts README identity claim
  • New pe_signature_trust module splits an aged signature from a wrong one via digest_matches and signed_within_validity
  • npm manifests now emit cross-field judgements: consistency.name_repo_mismatch, consistency.publisher_repo_owner_mismatch
  • BIFF worksheet inventory (office.sheet_count, office.xlm_sheet_count, office.hidden_sheet_count) surfaces Excel 4.0 macro sheets
  • Source string literals and call arguments are now escape-decoded
  • binding.gyp parsing falls back to a tolerant Python-literal parse [gyp.parse_lenient=1]
  • Malformed PE import directories are now detected and reported rather than silently walked.
  • PE version-info consistency checks and .lnk location anchors
  • New known_metrics() API enumerates every metric key a build can emit,
  • New open_with_fileid() lets a caller that already computed a FileId skip the second detection pass.

Fixes

  • Fixed a deadlock where a rizin subprocess wait could park an analysis-pool worker forever without reaping the child or firing its timeout.
  • Fixed an off-by-one in ISO parsing.
  • Fixed null-offset imports in PE, Java class, and WASM.
  • Preserved posix_spawn for rizin subprocesses on FreeBSD.

Optimizations

  • PDF parsing no longer scans to end-of-file looking for a stream that isn't there
  • Rizin runs aa; aac instead of aaa on x86 PE images
  • Detection skips a redundant second byte-scan on single-stream containers
Assets 2
Loading