v1.4.0
Added
- Permit more granular control over which data directories are parsed by rabbitstack #72.
- Support parsing the different
retpoline
types: Imported Address, Indirect Branch and Switchable retpoline #70. - Unit tests for load config directory #70.
- Unit tests for TLS directory #69.
- Unit tests for debug directory #68.
- Unit tests for resource directory and add functions to prettify resource (sub)languages #66.
- Annotate PE structures with JSON tags during JSON encoding #64, #65 and #67.
- Improve PE dumper to print imports and unit test parsing imports data directory#63.
- Improve PE dumper to print section headers #62.
- Improve PE dumper to print PE headers #61.
- Add
SerialNumber
,SignatureAlgorithm
andPubKeyAlgorithm
to theCertInfo
#60. - Option to disable certificate validation #59.
- Improve PE dumper to print exceptions #57.
- Unit tests for debug directory #49.
Fixed
- Bug while iterating over VolatileInfoRangeTable entries #70.
- Bug while iterating (additional padding and loop condition) over DVRT relocation block entries #70.
- Bug while appending (twice) Control Flow Guard IAT entries #70.
- Bug while parsing
POGO
debug entry types #68. Authentihash()
for instances w/o fd thanks to flanfly #47.
Changed
- Some fields has been renamed for consistency:
RichHeader.XorKey
->RichHeader.XORKey
.- Any
Rva
substring ->RVA
and anyIat
substring ->IAT
. - And many more.
- Some fields used internally in imports parsing were changed from a slice of pointers to a simple slice.
- Certificate.Content changed from
*pkcs7.PKCS7
topkcs7.PKCS7
. Section.Entropy
changed fromfloat64
tofloat64*
to distinguish between the case when the section entropy is equal to zero and the case when the entropy is equal to nil - meaning that it was never calculated.- Remove
cobra
dependency fromcmd/pedumper
#56.
New Contributors
- @flanfly made their first contribution in #47
- @smallzhong made their first contribution in #53
- @rabbitstack made their first contribution in #72
Full Changelog: v1.3.0...v1.4.0