v2.1.1

Fixes

• Escape control, C1 and bidi characters in CLI output, blocking terminal-escape injection.
• Pass absolute paths to rizin so filenames like -x or dbg:// aren't misparsed.
• Kill rizin after 300 seconds and drop output over 512 MiB.
• Decode rizin output as lossy UTF-8 so one bad symbol can't void analysis.
• Write the rizin cache with 0700 permissions and atomic renames.
• Cap zlib inflation at 40 MB per pass in base64 and script deobfuscation.
• Cap batch %var% expansion at 256 MiB and Lua folding output at 16 MiB.
• Reject NaN, infinite, fractional and >2^53 numbers in Lua constant folding.
• Bound Mach-O symbol iteration by file size, defeating forged nsyms values.
• Bound XOR scanning on fat Mach-O slices and files over 5 MiB.
• Use checked arithmetic for offsets across ELF, Mach-O, PE, .NET, Go and Rust decoders.
• Log XOR keys and version-info IPs as escaped fields, preventing log forgery.
• Fall back to normal scanning when decoy Go sections lack Go string structures.
• Raw-scan bytes after Java class constant pools, recovering appended payload strings.
• Decode UTF-16-BOM 8-bit text despite stray NULs or invalid UTF-8.
• Extract URLs from SuspiciousPath strings, surfacing C2 URLs in stealer configs.
• Fix multibyte-boundary bugs that dropped non-ASCII JavaScript and reversed payloads.

Features

• IOC URL parsing reads hosts like browsers: hex, octal and integer IPv4, percent-escapes.
• Minimum Rust version raised from 1.94 to 1.97.

Optimizations

• Skip overlapping sections in Go/Rust scans, avoiding duplicate work from repeated headers.
• Use binary search for skip ranges in raw, wide and XOR scans, removing quadratic behavior.
• Make CLI line wrapping single-pass, fixing quadratic printing of huge strings.
• Use smarter scan advancement in Go funcnametab extraction and PowerShell base64 filtering.
• Reuse one buffer across multi-key XOR rotations.