PackerScope v0.3.0 — Interactive Shell TUI, Memory Safety & Core Precision Engine

🚀 PackerScope v0.3.0 Release Notes

PackerScope v0.3.0 brings a major upgrade featuring an all-new Interactive Terminal UI (TUI), critical memory safety optimizations preventing gigabyte-level RAM spikes, and enhanced precision heuristics that eliminate false positives on clean binaries.

---

What's New

1. Interactive Shell Mode (TUI)

• Launching packerscope with no arguments now opens a beautiful, rich terminal-driven interactive shell.
• Features included:
  • [1] Single & Directory Scan Wizard: Step-by-step guidance with live results.
  • [2] Batch Scan Wizard: Multi-threaded scanning with custom format choices and unpacking toggles.
  • [3] File Info Viewer: Quick PE headers, section mappings, and cryptographic hashes without running heavy detectors.
  • [4] Settings Menu: Live runtime configuration tweaks (max file sizes, workers, report directories).
  • [5] Session History: Tracks scanned files, detected packers, and verdicts in real-time.

---

2. Memory & Concurrency Safety

• Bounded Decompression (32 MB Cap): Fixed a critical memory issue where unpacking 75 MB+ installer overlays (e.g. Electron / NSIS) expanded unbounded payloads into 22 GB RAM. Static decompression is now safely bounded using streaming decompressors.
• Worker Pool Safety Clamping: Thread pools are now safely clamped to a maximum of 16 workers, preventing memory multiplication under high concurrency.
• In-Memory Buffer Deduplication: PEContext and PEParser share underlying raw byte allocations with immediate teardown on cleanup.
• Large-Binary Checksum Fast-Path: Files > 20 MB bypass the 40-million-iteration pure-Python checksum loop, reducing scan times from 35s down to 5.7s (6x speedup).

---

3. Precision Heuristics & False-Positive Elimination

• Clean Binary Guard (iat_detector): Whitelisted standard .text/.data/.rdata sections with normal entropy and no suspicious APIs — minimal student C programs and benign binaries now evaluate to 0% CLEAN (down from 8% false-positive noise).
• Suspicious APIs Clean-up: Removed normal compiler runtime APIs (SetUnhandledExceptionFilter, VirtualFree, CreateThread, GetTickCount, etc.) from default suspicion lists.
• Contextual Correlation:
  • Stripped debug information is only penalized when ≥2 other suspicious signals exist.
  • Epoch timestamp == 0 is guarded for reproducible builds.
  • NOP sled threshold raised from 5 to 16 for compiler alignment compatibility.

---

4. CLI & Usability Improvements

• Cleaner, human-readable single-line error messages for files exceeding configured size limits (file.exe: Error — 846.8MB > 100MB limit).
• Concurrent multi-threading enabled by default for packerscope scan <directory>.
• Automatic extension filtering in the public Python batch_scan() API (.exe, .dll, .sys, etc.).

---

Test Suite & Quality

• 116 / 116 tests passing (pytest across Python 3.10, 3.11, 3.12, 3.13 on both Ubuntu and Windows).
• 100% compliant with ruff check and ruff format.

---

Installation & Upgrade

pip install --upgrade packerscope

v0.2.2

What's Changed in v0.2.2 🚀

Official Metadata & Citation

• Added official author (Salman Mallah), maintainer, email, and PyPI metadata.
• Added BibTeX citation in README.md for researchers and analysts.

Python & Environment Compatibility

• Python 3.10+ Support: Added backward-compatibility fallbacks (StrEnum, typing polyfills) to support Python 3.10, 3.11, 3.12, and 3.13.
• Package-Relative Paths: Default signature and plugin paths now resolve relative to the package installation root.

Bug Fixes & Stability

• Orchestrator Thread-Safety: Added mutex locks to prevent race conditions during concurrent batch analysis.
• Exception Fixes: Resolved constructor parameter mismatch in FileTooLargeError.
• UPX Unpacker Optimization: Removed redundant file copy operations before unpacking and added configurable process timeouts.
• Path Sanitization: Added filename sanitization across JSON, CSV, Markdown, and HTML reporters.

Testing & CI/CD

• Test Suite Expansion: Expanded test suite to 101 tests (100% passing) with 73% statement coverage.
• Multi-Platform CI: Automated GitHub Actions matrix testing across Windows & Ubuntu on Python 3.10–3.13.
• Automated Publishing: Added PyPI Trusted Publishing integration.

v0.2.1

What's Changed in v0.2.1 🚀

Python & Environment Compatibility

• Python 3.10+ Support: Added backward-compatibility fallbacks (StrEnum, typing polyfills) to support Python 3.10, 3.11, 3.12, and 3.13.
• Package-Relative Paths: Default signature and plugin paths now resolve relative to the package installation root.

Bug Fixes & Stability

• Orchestrator Thread-Safety: Added mutex locks to prevent race conditions during concurrent batch analysis.
• Exception Fixes: Resolved constructor parameter mismatch in FileTooLargeError.
• UPX Unpacker Optimization: Removed redundant file copy operations before unpacking and added configurable process timeouts.
• Path Sanitization: Added filename sanitization across JSON, CSV, Markdown, and HTML reporters.

Testing & CI/CD

• Test Suite Expansion: Expanded test suite to 101 tests (100% passing) with 73% statement coverage.
• Multi-Platform CI: Automated GitHub Actions matrix testing across Windows & Ubuntu on Python 3.10–3.13.
• Automated Publishing: Added PyPI Trusted Publishing integration.
  Full Changelog: v0.2.0...v0.2.1