Skip to content

v0.3.0 - Known-process database

Choose a tag to compare

View all tags
@gsjonio gsjonio released this 15 Jul 11:37
· 28 commits to main since this release
v0.3.0
20d6f81
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A foundation release. hightower now ships a curated database of well-known Windows processes, embedded in the binary.

What changed

  • Embedded, offline known-process database (svchost, csrss, winlogon, wininit, services, lsass, smss, explorer) with expected directories, publisher, category, and plain-language EN/PT descriptions.
  • EmbeddedKnowledgeRepository implements the knowledge-lookup port (case-insensitive).
  • hightower --version now correctly reports the release version.

Note: no visible change yet

This release is internal groundwork. hightower scan --all behaves exactly as in v0.2.0 -- the database is not yet used to explain or judge processes. That wiring (the risk classifier) is the next milestone, v0.4.0.

The attached hightower-v0.3.0-x86_64-pc-windows-msvc.exe is therefore functionally the same as v0.2.0 for now; it is published for consistency. Unsigned (SmartScreen may warn); building from source works too.

Next

v0.4.0 -- risk heuristics: path masquerading, unsigned binaries, unknown processes.

Assets 3
Loading