augure 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +21 -3
- data/lib/augure/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: ff5020e141d36fa45052119447dec8505ffe4625d24b7baf9076c96f18ce2c3a
|
|
4
|
+
data.tar.gz: 2abf0f3747192515a9388b38321d9384d25bbf3b8d9d20d0fc2258617941347b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 1bccb18fe44204206624df0810a76c8d2ef9c57625c38759d16921d96cfbff35ce353c5002ffcb369881f79eab881ab03b086293ea885a9626fc220f3b3e633b
|
|
7
|
+
data.tar.gz: 3054313b19a418e28a90d95f67d5786f9cc5ee2c8245c6f46fd89e02e7e212adb6a187b308781a0540a15ade24cba7647552c949184982fddd4cca9b02a36339
|
data/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [0.3.0] - 2026-10-30
|
|
11
|
+
|
|
12
|
+
- The profiler emits the vuln facts the binary itself carries: the
|
|
13
|
+
static frame read is the evidence, so an unsafe call site feeding an
|
|
14
|
+
rbp-frame buffer becomes `vuln("sof")` with `vuln_function` and
|
|
15
|
+
`sink` facts, and a printf-family format argument living on the
|
|
16
|
+
stack becomes `vuln("fmtstr")` + `fmtstr_read`. The operator's
|
|
17
|
+
suggest stays for the knowledge no ELF can show (a lib-side overflow,
|
|
18
|
+
a heap class, a filter).
|
|
19
|
+
- The sized-copy family (read, fgets, memcpy, memmove, strncpy) gets a
|
|
20
|
+
boundedness guard: when the length argument is an immediate at most
|
|
21
|
+
as large as the room between the buffer and the return slot, the
|
|
22
|
+
call is a bounded copy, not the overflow - the scan moves on. The
|
|
23
|
+
length register is per-sink (rdx, rsi for fgets). Sites without an
|
|
24
|
+
rbp-frame buffer (a global, a pointer arg) no longer stop the scan:
|
|
25
|
+
a later site may carry the overflow.
|
|
26
|
+
- augure-profiler 0.0.3.
|
|
27
|
+
|
|
10
28
|
## [0.2.0] - 2026-10-29
|
|
11
29
|
|
|
12
30
|
- The callme technique pack: three consecutive PLT calls with the
|
|
@@ -16,9 +34,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
16
34
|
- The ret2csu_v2 pack's build layout now teaches the WIN call measured
|
|
17
35
|
end to end on the corpus binary: the csu pair populates rsi/rdx (the
|
|
18
36
|
newer gcc flavor truncates edi, rdi never rides the csu), the mov
|
|
19
|
-
block's mandatory call lands on
|
|
20
|
-
cell (a no-op call preserving every argument register), the
|
|
21
|
-
seven-slot junk slide absorbs the loop epilogue, then pop_rdi
|
|
37
|
+
block's mandatory call lands on the `fini` stub through the .dynamic
|
|
38
|
+
DT_FINI cell (a no-op call preserving every argument register), the
|
|
39
|
+
seven-slot junk slide absorbs the loop epilogue, then `pop_rdi`
|
|
22
40
|
carries the full 64-bit first argument. The canonical puts leak
|
|
23
41
|
stays documented as the reference variant.
|
|
24
42
|
- Profiler: `pop rsi; pop r15; ret` joins the gadget vocabulary (the
|
data/lib/augure/version.rb
CHANGED