bbb28b3aa6
An app folder survey says when a file couldn't be opened, and its coverage is partial ( #453 )
...
app_folder_explain counts files it couldn't open to look inside (unopened_files) and reports partial coverage then, and when its walk couldn't read something, instead of a complete 'nothing points to a runtime'. Fixes #292 .
2026-11-03 00:24:10 +07:00
fed67edd38
Pinned builds keep runtime models in obj folders (R2.10) ( #439 )
...
Frozen and light pins keep a project's runtime models in assets/obj; only obj folders beside a .NET project file are left out as build output. Fixes #274 .
2026-11-03 00:16:57 +07:00
c6c8f35612
List a remote Frida device without frida-ls-devices -H ( #227 )
...
Listing Frida devices with a remote address returns that remote as one device, marked not contacted, instead of running frida-ls-devices with a -H flag it doesn't have.
2026-11-03 00:12:33 +07:00
4a6d87a107
ARM32 loads and stores keep their memory operands in pseudo-C ( #450 )
...
ARM32 and Thumb loads and stores keep their memory operands, so pseudo-C shows r0 = *(uint32_t*)(r1 + 4); instead of r0 = 0;; write-back and shifted or subtracted index forms are shown as written. Fixes #277 .
2026-11-03 00:12:07 +07:00
d6780ff30e
build_file_read shows a line longer than a page, cut, instead of nothing ( #447 )
...
build_file_read always shows the first line of a page, cut to 256 KiB with a note when it is longer, so a long minified line no longer reads as an empty page that no offset gets past. Fixes #280 .
2026-11-03 00:00:38 +07:00
11166b3589
Deep mode decompiles position-independent programs by name: addresses move between our image base and Ghidra's ( #426 )
...
In Deep mode, a position-independent program is decompiled by name: addresses move between our image base and the one Ghidra loaded it at (the bridge now reports it), with engine_entry and an engine_rebased limitation when they differ.
2026-11-02 23:50:33 +07:00
531f546dc0
The same files in another archive order are the same content tree ( #445 )
...
An inventory's content id hashes its (path, sha256) pairs sorted, so the same files listed in another archive order are the same content tree and compare as identical. Fixes #281 .
2026-11-02 23:50:01 +07:00
923cbc025c
Treat explicit interface property accessors as implicit ( #443 )
...
Explicit interface property accessors (Interface.get_X) count as implicit once their properties match, instead of showing as missing. Fixes #347 .
2026-11-02 23:49:24 +07:00
315ed8d441
Check Simple-mode text sizes with a test (R2.9) ( #354 )
...
A test keeps Simple-mode text at 12 pt or more outside the workbench; eight smaller monospace labels now use the caption size. R2.9.
2026-11-02 23:49:21 +07:00
e80df1da4e
Build usage includes context-summary calls (R2.1) ( #442 )
...
Build usage and cost include the model calls that summarise earlier work to make room, and each is journaled. Fixes #272 .
2026-11-02 23:48:58 +07:00
694b41929e
List slash commands and complete them with Tab ( #228 )
...
Typing / in the prompt box lists the slash commands, and Tab completes a partial command name when only one matches.
2026-11-02 23:48:55 +07:00
fa4aae2e79
Compare WebAssembly exported tag parameter types (R0.5) ( #441 )
...
WebAssembly comparison reports changes to exported tags' parameter types. Fixes #309 .
2026-11-02 23:48:32 +07:00
66ffd738ed
App comparisons keep every unassigned window (R3.10) ( #440 )
...
App version comparisons keep each unassigned window's preference changes instead of folding them into one. Fixes #237 .
2026-11-02 23:48:06 +07:00
a7a04333c0
Show a pin's folder from its right-click menu ( #215 )
...
A pin's right-click menu has Show folder, which opens the pinned build's folder (project_open_folder takes pin).
2026-11-02 23:47:24 +07:00
6c615210f6
A Mach-O executable with only __mh_execute_header counts as stripped ( #373 )
...
A Mach-O executable whose only local symbol is the linker's __mh_execute_header counts as stripped. Fixes #256 .
2026-11-02 23:43:28 +07:00
4158083708
Mach-O sections inherit read/write from their segment ( #372 )
...
Mach-O sections inherit read and write from their segment, so read-only stub and unwind sections aren't reported as writable. Fixes #255 .
2026-11-02 23:43:01 +07:00
89bcd06190
Minified esbuild modules keep their dependencies (R0.5) ( #438 )
...
Minified esbuild bundles keep the dependencies between their modules: wrapper calls are matched by binding, not by a require_/init_ name. Fixes #270 .
2026-11-02 23:42:49 +07:00
ffe15c9165
Find class usage in multidimensional object arrays (R0.5) ( #437 )
...
Class usage search finds a class in multidimensional object-array allocations (multianewarray). Fixes #325 .
2026-11-02 23:42:23 +07:00
858037dc3d
Use ARM32 registers in value-flow graphs (R0.5) ( #436 )
...
ARM32 and Thumb value-flow graphs use r0–r3 and r12 for calls and r0 for returns instead of x86 registers. Fixes #239 .
2026-11-02 23:41:56 +07:00
0ce375bcba
Bun text assets report their stored UTF-16LE encoding (R3.11) ( #435 )
...
Bun's stored-text encoding 2 is labelled utf16le, as Bun writes it, and member bytes are kept as stored. Fixes #257 .
2026-11-02 23:41:30 +07:00
a094ed23a9
Fail builds when required Windows resource embedding fails ( #427 )
...
The app build scripts stop the build when required Windows resources fail to embed (cargo::error instead of the ignored cargo:error). Fixes #264 .
2026-11-02 23:40:59 +07:00
cf87e54725
A Haswell request picks the x86_64h Mach-O slice ( #371 )
...
A request for x86_64h picks the Haswell slice of a universal Mach-O instead of the generic x86_64 one. Fixes #322 .
2026-11-02 23:40:33 +07:00
004e1c1dfc
Firmware extraction reports a region-scan cap as partial ( #366 )
...
firmware_image_extract reports a region scan stopped at its cap as truncated, partial coverage. Fixes #302 .
2026-11-02 23:40:07 +07:00
f58c3a66ba
Triage says a damaged ELF, PE or Mach-O header can't be read ( #365 )
...
Triage says a file that starts like an ELF, PE or Mach-O but can't be read is damaged, with the parse error, instead of calling it an unknown format. Fixes #319 .
2026-11-02 23:39:40 +07:00
d57649cf7a
ARM and Thumb branches point at their real targets ( #363 )
...
ARM and Thumb branches, BL/BLX calls and CBZ/CBNZ point at the targets llvm-objdump reports, so Thumb calls no longer land four bytes early. Fixes #250 .
2026-11-02 23:39:14 +07:00
df18c969b2
Allow packaged programs with crash in their names ( #376 )
...
Play's packaged-program choice skips crash reporters by name (crashreport, crashhandler, crashpad), not every name containing crash. Fixes #275 .
2026-11-02 23:38:48 +07:00
54bef1e6e2
Trace universal helper executables ( #375 )
...
Library resolution also follows universal (fat) helper executables found in app bundles. Fixes #276 .
2026-11-02 23:38:22 +07:00
d8314238ae
Files inside extended SquashFS directories are recovered (R0.5) ( #434 )
...
Extended SquashFS directory inodes read their listing offset from the right field, so files inside them are recovered. Fixes #338 .
2026-11-02 23:37:59 +07:00
6e9fc1a3d2
External tools' stderr survives a cap inside a multibyte character ( #364 )
...
objdump's and rtl_433's stderr keep the text before a cap that falls inside a multibyte character instead of losing it all. Fixes #287 .
2026-11-02 23:35:13 +07:00
53586bb9cf
Call resolution retains the known memory slot of an indirect import ( #424 )
...
native_call_site_resolve keeps the memory slot of a call through an import. Fixes #349 .
2026-11-02 23:34:56 +07:00
3357daf48e
Claude Code gets its message on stdin, so a long brief starts on Windows ( #430 )
...
Claude Code's message goes to its stdin instead of argv, so a builder brief over Windows' 32,767-character command-line limit no longer stops the build with os error 206. Fixes #402 .
2026-11-02 23:34:47 +07:00
0c0a776ed6
Return header metadata for unencrypted IoStore containers without a directory index ( #396 )
...
Unencrypted IoStore containers without a directory index return their header facts and a not_indexed limitation, with unknown file totals. Fixes #303 .
2026-11-02 23:34:29 +07:00
766234ba40
Record folder truncation notices in js_sources_restore ( #392 )
...
js_sources_restore notes when a folder listing was cut short by its file-count or depth limit. Fixes #332 .
2026-11-02 23:34:02 +07:00
8f81b8edf2
Reopening raw bytes with a new architecture or address uses them ( #432 )
...
Reopening the same raw bytes with another architecture or entry point replaces the open target instead of silently keeping the first settings and caches. Fixes #305 .
2026-11-02 23:32:25 +07:00
cf267b0f9d
Recognise bare Java classes in target triage ( #431 )
...
Triage of a bare .class file says it is a compiled Java class and recommends the java toolset (java_class_show, java_classes_find) instead of calling it an unrecognised format. Fixes #348 .
2026-11-02 23:29:55 +07:00
51f48fe6f0
Live coverage and module traces record the scripts they show ( #429 )
...
web_coverage_measure and web_modules_trace settle their page size once (limit 0 shows one), and record the scripts they show as examined. Fixes #331 .
2026-11-02 23:23:07 +07:00
3861132c04
A remote OpenAI-compatible service gets the cloud context budget and its price, not a local model's (R2.1) ( #379 )
...
Only an OpenAI-compatible server on this computer or its network (loopback, private and link-local addresses, bare and .local/.lan/.home.arpa/.internal names) or reached over ssh counts as a local model; a remote gateway gets the cloud context budget and its price. Fixes #374 .
2026-11-02 23:22:40 +07:00
0f580c7722
HAR request hosts no longer include query text when the URL has no path ( #422 )
...
A HAR URL's host ends at the first /, ? or #, so query or path text with an @ never reaches the host (same cause as #308 , in the HAR reader).
2026-11-02 23:22:13 +07:00
c217cd6f99
Classic pcap files with FCS bits in the link-type word decode as Ethernet and raw IP again ( #421 )
...
Classic pcap files read the link type from the low 16 bits, so FCS metadata no longer hides Ethernet and raw IP. Fixes #326 .
2026-11-02 23:21:47 +07:00
dd0731f8e9
Display annotated function name in native function tool summaries ( #418 )
...
Native function summaries use a function's annotated name after a rename. Fixes #350 .
2026-11-02 23:14:04 +07:00
510b4111e3
Report actual matching function count beyond cap in feature_paths ( #415 )
...
feature_paths reports the real number of matches beyond its 200-entry cap and marks the result truncated. Fixes #351 .
2026-11-02 23:13:37 +07:00
0748ef1be7
Start DX12 only by default on Windows to avoid Intel Vulkan driver crashes ( #414 )
...
On Windows the app starts only DX12 by default, since starting Vulkan crashed on some Intel drivers before any window opened; WGPU_BACKEND still picks others. Fixes #394 .
2026-11-02 23:13:10 +07:00
71b0524fce
Only treat code/module CArchive members as PyInstaller crypto_key markers ( #398 )
...
Only code and module members named crypto_key mark PyInstaller modules as encrypted; a data file with that name no longer does. Fixes #334 .
2026-11-02 23:12:43 +07:00
34216be702
Apply pcapng interface if_tsoffset to packet and capture timestamps ( #397 )
...
pcapng if_tsoffset is added to packet and capture timestamps. Fixes #327 .
2026-11-02 23:12:18 +07:00
d908b73d2c
Zero-fill ext4 unwritten extents during file reads ( #391 )
...
ext4 unwritten extents read as zeros instead of the blocks' old contents. Fixes #321 .
2026-11-02 23:11:52 +07:00
4bb8f76158
Walkthrough preflight rejects timeout_secs values outside 1..=600 ( #390 )
...
The walkthrough check refuses timeout_secs outside 1..=600, as the recorder does. Fixes #288 .
2026-11-02 23:11:25 +07:00
735a96db2f
URL sanitization only strips @ userinfo inside the authority ( #389 )
...
URL sanitising only strips user-info before the path, so an @ in a path or query is kept. Fixes #308 .
2026-11-02 23:10:59 +07:00
d7583c8063
Generated Ghidra function names parse their address suffix as hexadecimal ( #388 )
...
Generated Ghidra names such as FUN_00401000 are read as hexadecimal addresses. Fixes #318 .
2026-11-02 23:10:30 +07:00
87b191a6be
Capture teardown stops surviving group helpers after a normal leader exit ( #387 )
...
Capture teardown stops a helper left in the process group after the leader exits normally. Fixes #361 .
2026-11-02 23:10:03 +07:00
80cf0b8a50
A GraphQL document that begins with a comment is still read ( #386 )
...
js_app_map keeps a literal GraphQL document that begins with a # comment, and a lone CR ends a comment. Fixes #260 .
2026-11-02 23:09:36 +07:00
BFlat