Skip to content

v1.2.0

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 24 Jul 05:17
· 144 commits to main since this release
v1.2.0
18e0b78

Features

  • macOS/arm64 stack-XOR decoder — recovers strings built on the stack via MOVZ/MOVK/ADD/STR, including pad reuse across blobs; handles fat binaries.
  • FormatHint (Auto/Binary/Text) lets callers skip XOR and other binary-only passes on known-text input.
  • Cancellation via ExtractOptions::cancel returns partial results when set.

Performance

  • XOR scan skips executable sections (60–80% fewer bytes scanned).
  • XOR scan skips Apple/Microsoft platform-signed binaries.
  • Stack-string extraction is now per-section and parallel on PE/Mach-O.
  • Validation hotpath moved from chained contains to Aho-Corasick.
  • Dead garble deobfuscation code removed (~4000 lines); rayon integration simplified.

Bug fixes

  • 18.0.0.23 and similar PE ProductVersion strings no longer classified as IPv4.
  • Go symbols (go.shape., syscall.Handle) no longer flagged as Python.
  • Stripped Go PEs detected via .symtab, stopping pclntab noise from producing garbled XOR "payloads".
  • Go module paths no longer misclassified as email/JWT; JWT now requires eyJ… header.
  • Timezone-shaped bytes (10-11-12-08-09+13) no longer produce spurious XOR IPs.
  • 32-bit section-range overflow fixed.
  • Panic hardening across stack_strings, entitlements, instr, overlay, and Go/Rust extractors.
Assets 2
Loading