Skip to content

v0.3.5.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Aug 05:50
· 64 commits to main since this release
v0.3.5.3
d5e19f7

CLI Analyzer v0.3.5.3 — GUI 应用识别加固

变更

  • 导入表二次判定：部分 GUI 程序（如 NetSarang Xshell）以控制台（CUI）子系统构建——运行时不会闪黑窗，但 PE 的 Subsystem 字段是"假"的，仅靠子系统标志会漏判。现在系统会继续解析 PE 导入表：直接导入 user32 / gdi32 / comctl32 / uxtheme / dwmapi / d2d1 的一律判定为 GUI 应用并排除（纯命令行工具不会直接链接这些库；shell32/ole32 等命令行工具也常用，不在排除之列）
  • 覆盖 PE32 与 PE32+（32/64 位）两种格式

下载

  • macOS：Apple Silicon CLI-Analyzer-0.3.5.3-macos-arm64.dmg ｜ Intel CLI-Analyzer-0.3.5.3-macos-amd64.dmg
  • Windows：安装器 CLI-Analyzer-0.3.5.3-windows-amd64-installer.exe ｜ 便携 CLI-Analyzer-0.3.5.3-windows-amd64-portable.zip
  • Linux：CLI-Analyzer-0.3.5.3-linux-amd64.deb ｜ 便携 CLI-Analyzer-0.3.5.3-linux-amd64.tar.gz

构建产物未签名：macOS 首次打开需右键 → 打开；Windows 会提示"未知发布者"，属正常。

更新说明

  • v0.3.0 及以上用户会在启动时收到本版本更新提示（下载校验通过后引导安装）

English

CLI Analyzer v0.3.5.3 — hardened GUI-app detection.

Changes

  • Import-table second opinion: some GUI apps (e.g. NetSarang Xshell) are built with the console (CUI) subsystem — no console window flashes at launch, but the PE Subsystem flag lies, so the subsystem check alone missed them. The scanner now also parses the PE import table: executables that directly import user32 / gdi32 / comctl32 / uxtheme / dwmapi / d2d1 are classified as GUI apps and excluded (pure CLI tools never link those directly; shell32/ole32 are commonly used by CLI tools and stay out of the exclusion list)
  • Covers both PE32 and PE32+ (32/64-bit)

Downloads

  • macOS: Apple Silicon CLI-Analyzer-0.3.5.3-macos-arm64.dmg ｜ Intel CLI-Analyzer-0.3.5.3-macos-amd64.dmg
  • Windows: installer CLI-Analyzer-0.3.5.3-windows-amd64-installer.exe ｜ portable CLI-Analyzer-0.3.5.3-windows-amd64-portable.zip
  • Linux: CLI-Analyzer-0.3.5.3-linux-amd64.deb ｜ portable CLI-Analyzer-0.3.5.3-linux-amd64.tar.gz

Builds are unsigned: right-click → Open on macOS; "unknown publisher" on Windows — expected.

Updating

  • Users on v0.3.0+ are notified of this release at startup (SHA256-verified before guided installation)
Assets 9
Loading