v2.0.1

Fixes

• Read Mach-O code-signature blobs only from xnu-honoured slots, ignoring decoy entitlements.
• Fail Authenticode signatures lacking an image digest, so grafted catalog signatures fail.
• Take Authenticode timestamps from the signed TSTInfo, not a forgeable byte search.
• Check nested PE signatures, and mark unrecomputable digests unverifiable, not intact.
• Correct PE IMAGE_GUARD_* masks for delay-load IAT and export-suppression flags.
• Use the last CRX3 header fields, as Chrome does, so decoys can't spoof extension IDs.
• Refuse cache roots that are relative, symlinked or writable by other users.
• Run rizin with an allowlisted environment, and parse its output separators strictly.
• Catch panics in metrics, identity and reference derivation instead of aborting.
• Escape control characters in CLI argument errors.
• Pickle: model the stack and memo, fix LONG_BINGET length, cap operand amplification.
• Budget ZIP open reads and PyTorch version reads, refusing EOCD floods and bombs.
• Cap ELF name copies, verneed/verdef walks, DWARF attributes and overlapping note walks.
• Clamp Mach-O nsyms, skip overlapping fat slices, and cap load-command record counts.
• Keep goblin away from PE import/export tables over 32 MiB, and cap TLS and delay-import counts.
• Limit Authenticode chain walks to 32 candidate issuers.
• Add overflow checks to CAB, CLR, APK, Authenticode, VBA and code-signature parsing.
• Cap member listings and path sizes in ISO, UDF, ASAR, RAR, 7z and CHM.
• Cap APK signature blocks, JAR pom.properties reads and AXML/Java string copies.
• Bound DMG reconstruction, font scanning, NIB archives and JPEG pixel decoding.
• Cap OOXML .rels, PDF action sites, YAML alias replay and VBA decompression.
• Read each repeated RPM header tag once, and cap Go buildinfo dependency records.
• Count reference-evidence misses against the budget, fixing slow huge package-lock.json scans.

Features

• Verify CRX2 and CRX3 developer signatures, reported as crx.signature_verified.
• Report Authenticode unsigned_trailing_bytes for CVE-2013-3900-style padding.
• Add a module_level flag to value-flow values evaluated at load time.
• Identify Sphinx .doctree files as Pickle.
• Add public tools::scrub_env to restrict spawned tools' environments.
• Minimum Rust version raised from 1.94 to 1.97.

Optimizations

• Resolve AST call chains once and layer flow scopes, removing quadratic slowdowns.
• Reuse PDF endobj/endstream search positions instead of rescanning to EOF per object.
• Index ELF section-in-segment checks, and parse each DWARF abbreviation table once.
• Pre-index PE API-hash call edges, so a million edges now finish.
• Replace linear dedup scans with hash sets in tar, ISO, OOXML, PKGBUILD and JS.
• Serialize only the displayed rows in CLI text views, cutting memory on large files.