v0.3

SnowFastULP v0.3

⭐ New features

• Skip already ingested files: sfu and sfl can share a history database now. Already-processed files get skipped automatically.

• Teach sfu new formats: -parse-delims and -parse-rules take regex. A raw CSV dump can go straight into the library.

• Search many patterns in one go: sfs -f mytargets.txt runs a batch search in one pass, one pattern per line in the file, one output file per pattern.

• Combo generator: sfs -combo keeps only login:pass. Also works per-pattern with -f.

• Chain tools or make your own harness: -json streams progress and a summary as NDJSON on all three tools. Failed runs exit non-zero.

• Finish bell: -bell plays a short sound when a run completes.

• Interesting files export: sfl -env copies tdata folders and interesting env files next to the extraction dest.

• Old configs survive the upgrade: they migrate to the new template on first run.

• Runs on Android: android-arm64 builds for all three tools.

• Indexes that fix themselves: dedup and search sidecars are rebuilt on drift.

⭐ Parser update

One grammar everywhere: sfu extraction, sfl ingest, and sfs search all parse credentials with the same rules now. What one tool finds, the others read the same way.

Fields keep their meaning:

• host.com/path:login:pass:with:colons keeps the whole password, colons included.
• Numeric logins (123456:pass) are no longer mistaken for host:port.
• URL paths stay in the URL column.

It remembers passwords: the password that opened the last archive is tried first on the next one. Archives sharing a password confirm it once per run, not once per archive.

Teach it your format: named-group regex, one line:

^(?P<host>[^,]+),(?P<login>[^,]+),(?P<password>.+)$

Then: mv dump.csv dump.txt ; sfu dump.txt -parse-rules rules.txt -odr library ingests the CSV as-is in dry-run mode.

⭐ Bugfixes and tests

• 290 commits since v0.2.
• 150+ of them are bug fixes.
• 1,000+ new tests: 780 test functions in v0.2, 1,875 now.
• New fuzz targets hammer the code with random input.
  • ❄️ Fuzzed so much we even found an issue in the external 7z lib used by sfl lol

⭐ TL;DR

Tool	Flag	What it does	Docs
sfu, sfl	-history, -history-path	shared history skips already-processed sources	docs
sfu	-parse-delims, -parse-rules	regex parsers for custom formats	docs
sfs	-f FILE	multi-pattern search in one pass	docs
sfs	-combo	write only login:password per hit	docs
sfu, sfs, sfl	-json	NDJSON progress and summary stream	docs
sfu, sfs, sfl	-bell	completion sound on run finish	docs
sfl	-env	copy tdata folders and env files	docs

v0.2

SnowFastULP 0.2

v0.1 had sfu and sfs. v0.2 adds sfl, secret scanning, one-line installers, and update on all three binaries.

New

• sfl — pull ULP lines from stealer log folders and archives (zip/rar/7z, passworded, nested)
• Secrets — sfl -secrets finds tokens/keys; sfs -sec searches them
• Install — install.sh / install.ps1 for Linux, macOS, Windows
• Self-update — sfu update, sfs update, sfl update

Quick start

curl -fsSL https://raw.githubusercontent.com/snowx-dev/SnowFastULP/main/scripts/install.sh | bash
sfl ./logs/ -od ./library/
sfs ./library "facebook.com:"

Binaries

Binary	Does
sfu	Clean + dedup ULP dumps
sfs	Search .txt / .zst (and secrets DB)
sfl	Extract ULP from stealer logs

Platforms: linux-amd64, macos-arm64, windows-amd64. Verify with sha256sum -c SHA256SUMS.

Full flags and docs: https://snowfast.snowx.dev

Verifying

sha256sum -c SHA256SUMS

Platform notes

• Linux: chmod +x and run
• macOS: chmod +x then first run may require System Settings, Privacy and Security, "Allow anyway". Binaries are unsigned.
• Windows: SmartScreen may warn, click "More info" then "Run anyway". Binaries are unsigned.

v0.1

SnowFastULP 0.1

Cross-platform binaries built reproducibly via GitHub Actions. Each release is built twice and verified to produce identical SHA256 hashes before publishing.

Verifying

sha256sum -c SHA256SUMS

Platform notes

• Linux: chmod +x and run
• macOS: chmod +x then first run may require System Settings, Privacy and Security, "Allow anyway". Binaries are unsigned.
• Windows: SmartScreen may warn, click "More info" then "Run anyway". Binaries are unsigned.

Full Changelog: https://github.com/snowx-dev/SnowFastULP/commits/v0.1