v1.8.0

Performance

• ~5× faster on binaries needing rizin/radare2 analysis. The expensive aaa pass now overlaps native extraction, skips non-ARM binaries where it can't detect anything, and merges what were multiple rizin invocations into one.
• Repeated scans of the same file are cheaper — rizin outputs are memoized in-process and cached on disk.

Detection

• Fixed: structured {ptr, len} strings (e.g. in xclip PE) were being dropped by the garbage filter — now surfaced.

Caching (new)

• Persistent on-disk cache for rizin/string results at ~/.cache/stng (Linux) / ~/Library/Caches/stng (macOS).
• Auto-reclaimed in the background: entries older than 30 days or beyond 2 GiB are swept,
  Project
• Moved to GitHub!

v1.7.1

Features

• New stng-owned string cache (in-memory + disk) so consumers share one copy instead of re-extracting.
• Strings now carry their source byte extent, fixing span math for UTF-16LE, base64, and stack strings.

Fixes

• Stack-string junk (stack fills, register-save patterns) no longer bypasses the garbage filter.
• Fixed a quadratic slowdown in XOR scanning on large payloads (tens of seconds → fast, identical output).

Performance

• 40% faster test suite
• bumped jemalloc to 0.7
• trimmed per-string memory (dropped unused metadata fields).
  

v1.7.0

• Added generic decoded-string extraction for text inputs.
• Added base64-over-UTF-16LE decoding.
• Improved Go PE inline string recovery.
• Reduced PE/network false-positive IPs.
• Tightened URL-decoding false positives.
• Improved Python/JS code classification.
• Parallelized decoder and filtering hot paths.
• Added Deserialize for extracted string metadata.
• Added focused regression tests.
• Added pre-commit hook support.

v1.6.2

Detection

• XOR decoder now drops strings ≥16 chars where one character is >50% of the content. Kills
  false positives from repeated-byte runs (e.g. spaces) that XOR into base64-looking junk. Expect
  fewer XOR hits, not more.

Performance

• Dotted-pattern XOR scan: was up to 255 full-buffer passes per file, now one pass. Same
  output, much faster on large inputs.

API (breaking)

• FormatHint::Binary removed. Use Auto. Text unchanged.

Supply chain / cleanup

• Dropped thiserror dependency (consolidated on anyhow).
• Removed ~764 lines of dead amd64 code. Active extractors untouched.
• Routine bumps: cc, memchr, miniz_oxide, wasm-bindgen. No advisory fixes.

v1.6.0

Features

• Native PE import recovery now surfaces API names like CreateProcessW without radare2.
• Mach-O symbol extraction now types imports, exports, ObjC classes, and stub helpers.
• Callers can skip stng symbol extraction when symbols are already parsed upstream.

Performance

• Avoids duplicate symbol/import parsing when caller_provides_symbols is set.

Bugfixes

• Native Mach-O scans now preserve ObjC selectors and split command fragments without radare2.
• Fixed Mach-O dedup dropping strings that shared section-relative offsets.
• Go Mach-O packed __rodata recovery now finds high-signal URLs and find command fragments.

v1.5.2

Fixes

• XOR scan no longer mistakes pure-letter .NET identifiers (e.g. WrapNonExceptionThrows) for XOR keys — keys now
  require a digit or symbol
• IPv6 classification requires a multi-digit hextet, so noise like 0::c is no longer flagged as an IP

Performance

• Raw extraction classifies runs in bounded 64K batches, capping intermediate memory on string-dense files
• function_meta is now boxed, shrinking every extracted string
• UTF-16 decode streams directly from bytes (no whole-file Vec)
• Rust section scanner borrows segments instead of copying the section
• --json streams to stdout instead of building the full document in memory

v1.5.1

• Fewer false-positive IPs in Windows PE files — compiler-emitted u16 tables (unwind
  info, C++ exception metadata, jump tables) no longer get mistaken for sockaddr_in
  structures.
• ~5x faster tests — cargo test drops from ~95s to ~17s via opt-level = 2 on the test
  profile.
• Rust 2024 cleanup and dependency updates.

v1.5.0

• Rust 2024 edition: bumped edition = "2021" → "2024" in Cargo.toml.
• Migrated codebase to 2024 syntax
• Dep bumps: goblin 0.10.5 → 0.10.6, log 0.4.29 → 0.4.30 (patch updates only).

v1.4.0

Bugfixes

• extract_stack_off: no more panic on multibyte box-drawing chars in r2 output
• sockaddr_in scan now honors the binary's native endianness
• Registry classifier recognizes root-relative subkeys (Software\Microsoft\…, System\CurrentControlSet\…, SAM, SECURITY)
• Garbage filter keeps canonical UUIDs and hex runs ≥ 8 with ≥ 4 distinct digits
• Short-identifier filter keeps 4-char camelCase (iPad, hWnd), balanced call shapes (Run()), and whitespace-separated disasm (JMP +5).

Build

• Optional jemalloc on Unix (skipped on the *BSDs / illumos / Solaris).
• New profiling profile and bench-build / heap-build / sampled-benchmark / heap-benchmark targets for cleave-tuna
• MAKEFLAGS scrubbed so jemalloc-sys's nested make doesn't choke.

Testing

• Regression coverage for extract_stack_off on non-char-boundary input.
• New suites for PascalCase identifiers and per-endianness sockaddr acceptance.
• GUID classifier tests cover braced, bare, uppercase, and wrong-shape inputs.

v1.3.1

Pre-CackalackyCon release:

Bugfixes

• Added coverage for mixed script/binary inputs that previously could miss decoded campaign markers.

Testing:

• Added regression coverage for polyglot/unknown inputs to ensure embedded base64 payloads are decoded even when the file is mostly binary.
• Rizin/r2 cache tests now use isolated temporary cache directories, avoiding shared cache state across test runs.