v3.2.0

FLOSS v3.2.0

This release fixes a security issue in how FLOSS loads vivisect workspaces, adds basic ELF support, fixes several bugs including a crash on Rust binaries, and requires Python 3.10 or newer.

Security

Crafted .viv files could execute code when FLOSS analyzed a sample: either the sample itself named *.viv, or a <sample>.viv next to it. FLOSS now always parses samples as PE or ELF and only loads an existing <sample>.viv when FLOSS_LOAD_VIV_WORKSPACE=1 is set. Only enable this for .viv files you trust. The IDA Pro plugin follows the same rule.

Affected: v3.1.1 and earlier, and the QUANTUMSTRAND pre-releases.

New features

• basic ELF support (#1071)
• Ghidra import script migrated to PyGhidra (#1190)

Bug fixes

• fix a crash rendering stack strings from Rust binaries (#1259)
• no traceback on Ctrl+C (#1244)
• raise an error on invalid decoded string types (#1154)
• also check the location type in import taint analysis (#1243)
• honor skip_libs when scoring calls to a function (#1242)
• fix string type hints and related bugs (#1103)

Performance

• faster is_all_zeros check (#1294)
• more efficient rendering (#1235)

Breaking changes

• Python 3.10 or newer is required (#1070)
• FLOSS_SAVE_WORKSPACE only accepts 1/true/yes/on