Skip to content

v1.1.0

Latest
Latest

Choose a tag to compare

View all tags
@MrLouisWright MrLouisWright released this 20 Oct 08:33
· 3 commits to main since this release
v1.1.0
8083a81
  • Mach-O support: thin and universal binaries, segments/sections, dylibs, rpaths, code signature (ad-hoc / Developer ID / team), PIE, stack execution, canary, dylib-hijack risk, Mach task injection imports.
  • Capabilities now come from capa-style rule files (rules/builtin.yml). Load your own with --rules <file|dir> (api, import, export, string, substring, section, format, os, arch, match, and/or/not/optional/N-or-more); matches are reported as capability-rule.
  • Authenticode verification: image hash, message digest and signer signature, nested signatures, chain, timestamp and validity (signature-invalid, signature-untrusted, signature-expired). --no-verify-signatures to skip.
  • PE resources and version info: embedded executables in resources, high-entropy resources, version-info-mismatch and masquerading.
  • New reusable API: parseMachO, verifyAuthenticode, parseResources, parseVersionInfo, loadRules, parseRules, matchRules, featuresOf, extractStrings, resolveRules.
  • Dual ESM + CommonJS build with generated type declarations.

npm: https://www.npmjs.com/package/binary-sentinel/v/1.1.0
Tarball attached is the exact file published to npm.

Assets 3
Loading