v1.3.0

Features

• Better Go PE recovery with image-base-aware string structures, pclntab varint/null table extraction, and stack-built Win32 API names.
• Added Rust PE detection and structure-based .rdata string slicing.
• Better multi-key XOR recovery using rizin/r2 lea-near-xor analysis and high-entropy key candidates.
• Added blind decode fallback for high-confidence XOR keys, improving recovery of short/split IOCs.
• Raw/unknown inputs now run raw, wide, binary IP, stack-string, decoder, script, and requested XOR extraction.

Performance

• PE stack-string scans are limited to executable sections
• Go and Rust PE packed string sections are skipped by raw/wide scans to avoid huge concatenated blobs.
• Go PE pclntab varint and null-separated scanners run in parallel per section.
• ELF overlay detection reuses parsed ELF metadata instead of reparsing.

Bugfixes

• Fixed stripped Go PE detection to avoid false XOR payloads from pclntab data.
• Fixed Go PE image-base handling so {ptr,len} strings resolve correctly.
• Fixed Go varint length prefixes leaking into module/package path strings.
• Fixed noisy Go/Rust packed-string extraction that emitted merged .rdata blobs.
• Fixed x86 instruction-byte fragments leaking as strings with arch/section-aware filtering.
• Tightened binary IP detection to reject linear, gateway-like, and repeated low-octet false positives.