What's New in v0.2.0
A wide-coverage release. Two new IR passes, three platform attestation runtime stubs, a full documentation site with Japanese translations, a CI fix for Windows / MSVC compatibility, two post-build CLI utilities, and a single-source-of-truth refactor for the pass registry.
📖 Full documentation: https://ykus4.github.io/kagura
📜 Full changelog: CHANGELOG.md
New passes
-kagura-cse-break— Defeats decompiler CSE-recovery (Ghidra, IDA hex-rays, Binary Ninja MLIL) by duplicating shared SSA expressions so every user sees a fresh definition.-kagura-string-split— Fragments long string literals (≥16 bytes) across multiple smaller globals; recombines at runtime. Composes withkagura-strto ensure neither plaintext nor ciphertext lives contiguously.
Platform attestation
runtime/ios/device_attest.c— Apple DeviceCheck (iOS 11+) and App Attest (iOS 14+) C bindingsruntime/windows/etw_detection.c— Windows ETW-based analysis tool detection- (Android Play Integrity already shipped in 0.1.x)
Documentation site
- Full MkDocs site at https://ykus4.github.io/kagura — auto-deployed from
main - Cookbook: Banking / FinTech · Mobile game / anti-cheat · SDK vendor · DRM — recipe-style pages with threat models, policies, build commands, and verification steps
- Security Model — STRIDE coverage matrix, hard non-goals, load-bearing assumptions
- Japanese localization at
/ja/— 30 translated pages
Tooling
scripts/kagura-strip.py— ScrubsLC_UUID(Mach-O) /.note.gnu.build-id(ELF) post-buildscripts/kagura-diff.py— Section / symbol / string diff between baseline and obfuscated binaries (text / HTML / JSON)
Developer experience
- Pass registry refactor:
lib/Transforms/PassRegistry.defis now the single source of truth. Plugin.cpp: 378 → 197 lines (−181). Options.cpp: 205 → 116 lines (−89). Adding a new pass = 1 line. - Issue & PR templates with structured YAML forms
- Windows CI: bumped LLVM 19 → 21 for new MSVC STL Clang ≥20 requirement
Prebuilt assets
Binaries for macOS arm64 / Linux x86_64 across LLVM 19 / 21 / 22 are attached below — published automatically by the release workflow.