Skip to content

Commit 7d68205

Browse files
8damon8damon
committed
chore(release): bump version to 1.4.0
1 parent bc95ea5 commit 7d68205

13 files changed

Lines changed: 239 additions & 90 deletions

File tree

‎resx-vscode/package-lock.json‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎resx-vscode/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "resx-vscode",
33
"displayName": "RESX Binary Viewer",
44
"description": "VS Code PE and Windows binary analysis viewer for EXE, DLL, and SYS files powered by RESX",
5-
"version": "1.0.3",
5+
"version": "1.4.0",
66
"publisher": "titan-softwork-solutions",
77
"license": "UNLICENSED",
88
"repository": {

‎resx/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "resx"
3-
version = "1.0.3"
3+
version = "1.4.0"
44
edition = "2021"
55
authors = ["TITAN Softwork Solutions"]
66
description = "Windows binary recon CLI for exports, PDB-backed symbols, CFG recovery, and triage"

‎resx/resx.manifest‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
22
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
3-
<assemblyIdentity version="1.0.3.0" processorArchitecture="*" name="TITANSoftworkSolutions.RESX" type="win32" />
3+
<assemblyIdentity version="1.4.0.0" processorArchitecture="*" name="TITANSoftworkSolutions.RESX" type="win32" />
44
<description>Windows binary recon CLI for exports, PDB-backed symbols, CFG recovery, and triage</description>
55
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
66
<security>

‎resx/src/analysis/follow/scan.rs‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,11 @@ fn read_import_slots(
154154
let ptr_size = if pe.arch == 64 { 8u32 } else { 4u32 };
155155
let ord_flag_64 = 1u64 << 63;
156156
let ord_flag_32 = 1u64 << 31;
157-
let name_mask = if pe.arch == 64 { ord_flag_64 - 1 } else { ord_flag_32 - 1 };
157+
let name_mask = if pe.arch == 64 {
158+
ord_flag_64 - 1
159+
} else {
160+
ord_flag_32 - 1
161+
};
158162

159163
loop {
160164
if off + 20 > raw.len() {

‎resx/src/commands/dump/mod.rs‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,8 @@ pub fn run(
284284
current_syscall: None,
285285
explain: None,
286286
};
287-
let json = serde_json::to_string_pretty(&versioned_object("dump", &result)).unwrap_or_default();
287+
let json = serde_json::to_string_pretty(&versioned_object("dump", &result))
288+
.unwrap_or_default();
288289
writeln!(w, "{}", json).ok();
289290
}
290291
return Ok(());
@@ -467,7 +468,14 @@ pub fn run(
467468
}
468469
}
469470
let xrefs = if cfg.show_xrefs {
470-
let x = find_xrefs(&raw, &pe, &exports, Some(&symbol_index), target_rva, &resolved_name);
471+
let x = find_xrefs(
472+
&raw,
473+
&pe,
474+
&exports,
475+
Some(&symbol_index),
476+
target_rva,
477+
&resolved_name,
478+
);
471479
progress.tick("collecting cross references");
472480
x
473481
} else {
@@ -848,7 +856,8 @@ pub fn run(
848856
}),
849857
explain: explain_result,
850858
};
851-
let json = serde_json::to_string_pretty(&versioned_object("dump", &result)).unwrap_or_default();
859+
let json =
860+
serde_json::to_string_pretty(&versioned_object("dump", &result)).unwrap_or_default();
852861
writeln!(w, "{}", json).ok();
853862
}
854863

‎resx/src/commands/explain.rs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ pub fn run(term: &str, cfg: &Config, w: &mut dyn Write, c: &Colors) -> Result<()
1313

1414
let result = explain_symbol(query, config_mode(cfg));
1515
if cfg.json {
16-
let out = serde_json::to_string_pretty(&versioned_object("explain", &result)).unwrap_or_default();
16+
let out =
17+
serde_json::to_string_pretty(&versioned_object("explain", &result)).unwrap_or_default();
1718
writeln!(w, "{}", out).ok();
1819
} else {
1920
print_explain_text(w, &result, c, false);

‎resx/src/commands/follow.rs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,8 @@ pub fn run(
121121
writeln!(
122122
w,
123123
"{}",
124-
serde_json::to_string_pretty(&versioned_object("callers", node_to_json(&root))).unwrap_or_default()
124+
serde_json::to_string_pretty(&versioned_object("callers", node_to_json(&root)))
125+
.unwrap_or_default()
125126
)
126127
.ok();
127128
} else {

‎resx/src/commands/peinfo/detect.rs‎

Lines changed: 95 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,12 @@ pub fn assess_build(
166166
&["__rust_alloc", "__rust_dealloc", "__rust_panic_cleanup"],
167167
);
168168
if rust_markers {
169-
push_candidate(&mut langs, "Rust", 100, "Rust runtime strings/symbols detected");
169+
push_candidate(
170+
&mut langs,
171+
"Rust",
172+
100,
173+
"Rust runtime strings/symbols detected",
174+
);
170175
push_candidate(
171176
&mut tools,
172177
"rustc / Cargo",
@@ -178,7 +183,13 @@ pub fn assess_build(
178183
if contains_prefix(&import_dlls, "python")
179184
|| strings_contains_any(
180185
&strings,
181-
&["pyi_rth_", "pyimod", "meipass", "pyinstaller", "python3.dll"],
186+
&[
187+
"pyi_rth_",
188+
"pyimod",
189+
"meipass",
190+
"pyinstaller",
191+
"python3.dll",
192+
],
182193
)
183194
{
184195
push_candidate(
@@ -196,7 +207,11 @@ pub fn assess_build(
196207
}
197208
if strings_contains_any(
198209
&strings,
199-
&["nuitka", "__nuitka_binary_dir", "onefile_child_grace_time_int"],
210+
&[
211+
"nuitka",
212+
"__nuitka_binary_dir",
213+
"onefile_child_grace_time_int",
214+
],
200215
) {
201216
push_candidate(&mut tools, "Nuitka", 95, "Nuitka loader markers detected");
202217
push_candidate(
@@ -210,13 +225,23 @@ pub fn assess_build(
210225
push_candidate(&mut tools, "py2exe", 90, "py2exe bundle markers detected");
211226
}
212227
if strings_contains_any(&strings, &["cx_freeze", "initscripts\\console"]) {
213-
push_candidate(&mut tools, "cx_Freeze", 90, "cx_Freeze bundle markers detected");
228+
push_candidate(
229+
&mut tools,
230+
"cx_Freeze",
231+
90,
232+
"cx_Freeze bundle markers detected",
233+
);
214234
}
215235

216236
if contains_any(&import_dlls, &["node.dll", "libnode.dll", "chrome_elf.dll"])
217237
|| strings_contains_any(
218238
&strings,
219-
&["electron.asar", "app.asar", "crashpad_handler", "resources.pak"],
239+
&[
240+
"electron.asar",
241+
"app.asar",
242+
"crashpad_handler",
243+
"resources.pak",
244+
],
220245
)
221246
{
222247
push_candidate(
@@ -419,7 +444,10 @@ pub fn assess_build(
419444

420445
fn apply_rust_crate_heuristics(list: &mut Vec<(&'static str, Candidate)>, strings: &[String]) {
421446
let crate_markers: [(&str, &[&str]); 13] = [
422-
("Tokio", &["tokio::", "tokio-runtime-worker", "tokio::runtime"]),
447+
(
448+
"Tokio",
449+
&["tokio::", "tokio-runtime-worker", "tokio::runtime"],
450+
),
423451
("Serde", &["serde::", "serde_json::", "serde_yaml::"]),
424452
("Reqwest", &["reqwest::", "hyper::client"]),
425453
("Hyper", &["hyper::", "h2::proto"]),
@@ -428,7 +456,10 @@ fn apply_rust_crate_heuristics(list: &mut Vec<(&'static str, Candidate)>, string
428456
("Rusqlite", &["rusqlite::", "libsqlite3-sys"]),
429457
("Clap", &["clap::", "clap_builder::"]),
430458
("Anyhow", &["anyhow::", "thiserror::"]),
431-
("Tracing", &["tracing::", "tracing_subscriber::", "env_logger::"]),
459+
(
460+
"Tracing",
461+
&["tracing::", "tracing_subscriber::", "env_logger::"],
462+
),
432463
("Regex", &["regex::", "regex-automata::"]),
433464
("Rayon", &["rayon::", "rayon-core::"]),
434465
("Egui", &["egui::", "eframe::", "epaint::"]),
@@ -452,19 +483,47 @@ fn apply_component_heuristics(
452483
strings: &[String],
453484
) {
454485
let dll_components: [(&str, &[&str], &str); 13] = [
455-
("OpenSSL", &["libssl", "libcrypto", "ssleay32", "libeay32"], "OpenSSL import DLL detected"),
456-
("libcurl", &["libcurl", "curl.dll"], "libcurl import DLL detected"),
486+
(
487+
"OpenSSL",
488+
&["libssl", "libcrypto", "ssleay32", "libeay32"],
489+
"OpenSSL import DLL detected",
490+
),
491+
(
492+
"libcurl",
493+
&["libcurl", "curl.dll"],
494+
"libcurl import DLL detected",
495+
),
457496
("SQLite", &["sqlite3.dll"], "SQLite import DLL detected"),
458-
("zlib", &["zlib1.dll", "zlibwapi.dll"], "zlib import DLL detected"),
459-
("Qt", &["qt5core.dll", "qt6core.dll", "qt5gui.dll", "qt6gui.dll"], "Qt runtime import DLL detected"),
497+
(
498+
"zlib",
499+
&["zlib1.dll", "zlibwapi.dll"],
500+
"zlib import DLL detected",
501+
),
502+
(
503+
"Qt",
504+
&["qt5core.dll", "qt6core.dll", "qt5gui.dll", "qt6gui.dll"],
505+
"Qt runtime import DLL detected",
506+
),
460507
("SDL2", &["sdl2.dll"], "SDL2 import DLL detected"),
461508
("GLFW", &["glfw3.dll"], "GLFW import DLL detected"),
462509
("Vulkan", &["vulkan-1.dll"], "Vulkan loader detected"),
463510
("OpenGL", &["opengl32.dll"], "OpenGL import detected"),
464-
("Direct3D", &["d3d11.dll", "d3d12.dll", "dxgi.dll"], "Direct3D import detected"),
511+
(
512+
"Direct3D",
513+
&["d3d11.dll", "d3d12.dll", "dxgi.dll"],
514+
"Direct3D import detected",
515+
),
465516
("libuv", &["libuv.dll"], "libuv import DLL detected"),
466-
("wxWidgets", &["wxmsw", "wxbase"], "wxWidgets import DLL detected"),
467-
("OpenCV", &["opencv_world", "opencv_core"], "OpenCV import DLL detected"),
517+
(
518+
"wxWidgets",
519+
&["wxmsw", "wxbase"],
520+
"wxWidgets import DLL detected",
521+
),
522+
(
523+
"OpenCV",
524+
&["opencv_world", "opencv_core"],
525+
"OpenCV import DLL detected",
526+
),
468527
];
469528

470529
for (label, needles, evidence) in dll_components {
@@ -476,7 +535,10 @@ fn apply_component_heuristics(
476535
if strings_contains_any(strings, &["webview2", "msedgewebview2", "icorewebview2"]) {
477536
push_candidate(list, "WebView2", 80, "WebView2 strings detected");
478537
}
479-
if strings_contains_any(strings, &["openssl/", "libcurl/", "sqlite format 3", "zlib"]) {
538+
if strings_contains_any(
539+
strings,
540+
&["openssl/", "libcurl/", "sqlite format 3", "zlib"],
541+
) {
480542
if strings_contains_any(strings, &["openssl/"]) {
481543
push_candidate(list, "OpenSSL", 55, "OpenSSL version string detected");
482544
}
@@ -520,16 +582,31 @@ fn apply_packer_heuristics(
520582
|| has_section(sections, ".themida")
521583
|| strings_contains_any(strings, &["vmprotect", "themida"])
522584
{
523-
push_candidate(list, "VMProtect / Themida", 95, "VMProtect/Themida markers detected");
585+
push_candidate(
586+
list,
587+
"VMProtect / Themida",
588+
95,
589+
"VMProtect/Themida markers detected",
590+
);
524591
}
525592
if has_section(sections, ".enigma1")
526593
|| has_section(sections, ".enigma2")
527594
|| strings_contains_any(strings, &["the enigma protector"])
528595
{
529-
push_candidate(list, "Enigma Protector", 95, "Enigma Protector markers detected");
596+
push_candidate(
597+
list,
598+
"Enigma Protector",
599+
95,
600+
"Enigma Protector markers detected",
601+
);
530602
}
531603
if strings_contains_any(strings, &["pyinstaller"]) {
532-
push_candidate(list, "PyInstaller", 85, "PyInstaller one-file markers detected");
604+
push_candidate(
605+
list,
606+
"PyInstaller",
607+
85,
608+
"PyInstaller one-file markers detected",
609+
);
533610
}
534611

535612
let high_entropy_exec = pe

‎resx/src/commands/peinfo/mod.rs‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,14 @@ pub fn run(dll_arg: &str, cfg: &Config, w: &mut dyn Write, c: &Colors) -> Result
7878

7979
let known_names = collect_known_names(&file_name, &metadata);
8080
let image_kind = detect_image_kind(&pe, &file_name);
81-
let assessment = assess_build(&pe, &raw, &imports, &debug, clr.as_ref(), load_config.as_ref());
81+
let assessment = assess_build(
82+
&pe,
83+
&raw,
84+
&imports,
85+
&debug,
86+
clr.as_ref(),
87+
load_config.as_ref(),
88+
);
8289
let veh_imports = detect_veh_imports(&imports);
8390
let startup_routines = find_startup_routines(&pe, &raw);
8491

0 commit comments

Comments
 (0)