head 1.3; access; symbols pkgsrc-2026Q3:1.1.0.6 pkgsrc-2026Q3-base:1.1 pkgsrc-2026Q2:1.1.0.4 pkgsrc-2026Q2-base:1.1 pkgsrc-2026Q1:1.1.0.2 pkgsrc-2026Q1-base:1.1; locks; strict; comment @# @; 1.3 date 2026.10.10.20.51.51; author wiz; state Exp; branches; next 1.2; commitid GCeeR9OUjnhGoYYG; 1.2 date 2026.10.05.10.24.36; author pin; state Exp; branches; next 1.1; commitid 4PatRIEm8pTr5hYG; 1.1 date 2026.02.21.15.17.28; author pin; state Exp; branches; next ; commitid QYWipDPq4rhjYfvG; desc @@ 1.3 log @stng: add missing tool @ text @# $NetBSD: Makefile,v 1.2 2026/10/05 10:24:36 pin Exp $ DISTNAME= stng-1.7.1 CATEGORIES= textproc MASTER_SITES= ${HOMEPAGE}archive/ SITES.${DISTNAME}.tar.gz= -${MASTER_SITES}v${PKGVERSION_NOREV}${EXTRACT_SUFX} MAINTAINER= pkgsrc-users@@NetBSD.org HOMEPAGE= https://codeberg.org/HEXXDECIMAL/stng/ COMMENT= Language-aware string extraction for Go and Rust binaries LICENSE= apache-2.0 WRKSRC= ${WRKDIR}/${PKGBASE} USE_LANGUAGES+= c c++ USE_TOOLS+= gmake .include "cargo-depends.mk" .include "../../lang/rust/cargo.mk" .include "../../mk/bsd.pkg.mk" @ 1.2 log @textproc/stng: update to 1.7.1 v1.7.1 Features New stng-owned string cache (in-memory + disk) so consumers share one copy instead of re-extracting. Strings now carry their source byte extent, fixing span math for UTF-16LE, base64, and stack strings. Fixes Stack-string junk (stack fills, register-save patterns) no longer bypasses the garbage filter. Fixed a quadratic slowdown in XOR scanning on large payloads (tens of seconds → fast, identical output). Performance 40% faster test suite bumped jemalloc to 0.7 trimmed per-string memory (dropped unused metadata fields). v.1.7.0 Added generic decoded-string extraction for text inputs. Added base64-over-UTF-16LE decoding. Improved Go PE inline string recovery. Reduced PE/network false-positive IPs. Tightened URL-decoding false positives. Improved Python/JS code classification. Parallelized decoder and filtering hot paths. Added Deserialize for extracted string metadata. Added focused regression tests. Added pre-commit hook support. v1.6.2 Detection XOR decoder now drops strings ≥16 chars where one character is >50% of the content. Kills false positives from repeated-byte runs (e.g. spaces) that XOR into base64-looking junk. Expect fewer XOR hits, not more. Performance Dotted-pattern XOR scan: was up to 255 full-buffer passes per file, now one pass. Same output, much faster on large inputs. API (breaking) FormatHint::Binary removed. Use Auto. Text unchanged. Supply chain / cleanup Dropped thiserror dependency (consolidated on anyhow). Removed ~764 lines of dead amd64 code. Active extractors untouched. Routine bumps: cc, memchr, miniz_oxide, wasm-bindgen. No advisory fixes. v1.6.0 Detection XOR decoder now drops strings ≥16 chars where one character is >50% of the content. Kills false positives from repeated-byte runs (e.g. spaces) that XOR into base64-looking junk. Expect fewer XOR hits, not more. Performance Dotted-pattern XOR scan: was up to 255 full-buffer passes per file, now one pass. Same output, much faster on large inputs. API (breaking) FormatHint::Binary removed. Use Auto. Text unchanged. Supply chain / cleanup Dropped thiserror dependency (consolidated on anyhow). Removed ~764 lines of dead amd64 code. Active extractors untouched. Routine bumps: cc, memchr, miniz_oxide, wasm-bindgen. No advisory fixes. v1.5.2 Fixes XOR scan no longer mistakes pure-letter .NET identifiers (e.g. WrapNonExceptionThrows) for XOR keys — keys now require a digit or symbol IPv6 classification requires a multi-digit hextet, so noise like 0::c is no longer flagged as an IP Performance Raw extraction classifies runs in bounded 64K batches, capping intermediate memory on string-dense files function_meta is now boxed, shrinking every extracted string UTF-16 decode streams directly from bytes (no whole-file Vec) Rust section scanner borrows segments instead of copying the section --json streams to stdout instead of building the full document in memory v1.5.1 Fewer false-positive IPs in Windows PE files — compiler-emitted u16 tables (unwind info, C++ exception metadata, jump tables) no longer get mistaken for sockaddr_in structures. ~5x faster tests — cargo test drops from ~95s to ~17s via opt-level = 2 on the test profile. Rust 2024 cleanup and dependency updates. v1.5.0 Rust 2024 edition: bumped edition = "2021" → "2024" in Cargo.toml. Migrated codebase to 2024 syntax Dep bumps: goblin 0.10.5 → 0.10.6, log 0.4.29 → 0.4.30 (patch updates only). v1.4.0 Bugfixes extract_stack_off: no more panic on multibyte box-drawing chars in r2 output sockaddr_in scan now honors the binary's native endianness Registry classifier recognizes root-relative subkeys (Software\Microsoft\…, System\CurrentControlSet\…, SAM, SECURITY) Garbage filter keeps canonical UUIDs and hex runs ≥ 8 with ≥ 4 distinct digits Short-identifier filter keeps 4-char camelCase (iPad, hWnd), balanced call shapes (Run()), and whitespace-separated disasm (JMP +5). Build Optional jemalloc on Unix (skipped on the *BSDs / illumos / Solaris). New profiling profile and bench-build / heap-build / sampled-benchmark / heap-benchmark targets for cleave-tuna MAKEFLAGS scrubbed so jemalloc-sys's nested make doesn't choke. Testing Regression coverage for extract_stack_off on non-char-boundary input. New suites for PascalCase identifiers and per-endianness sockaddr acceptance. GUID classifier tests cover braced, bare, uppercase, and wrong-shape inputs. v1.3.1 Bugfixes Added coverage for mixed script/binary inputs that previously could miss decoded campaign markers. Testing: Added regression coverage for polyglot/unknown inputs to ensure embedded base64 payloads are decoded even when the file is mostly binary. Rizin/r2 cache tests now use isolated temporary cache directories, avoiding shared cache state across test runs. v1.3.0 Features Better Go PE recovery with image-base-aware string structures, pclntab varint/null table extraction, and stack-built Win32 API names. Added Rust PE detection and structure-based .rdata string slicing. Better multi-key XOR recovery using rizin/r2 lea-near-xor analysis and high-entropy key candidates. Added blind decode fallback for high-confidence XOR keys, improving recovery of short/split IOCs. Raw/unknown inputs now run raw, wide, binary IP, stack-string, decoder, script, and requested XOR extraction. Performance PE stack-string scans are limited to executable sections Go and Rust PE packed string sections are skipped by raw/wide scans to avoid huge concatenated blobs. Go PE pclntab varint and null-separated scanners run in parallel per section. ELF overlay detection reuses parsed ELF metadata instead of reparsing. Bugfixes Fixed stripped Go PE detection to avoid false XOR payloads from pclntab data. Fixed Go PE image-base handling so {ptr,len} strings resolve correctly. Fixed Go varint length prefixes leaking into module/package path strings. Fixed noisy Go/Rust packed-string extraction that emitted merged .rdata blobs. Fixed x86 instruction-byte fragments leaking as strings with arch/section-aware filtering. Tightened binary IP detection to reject linear, gateway-like, and repeated low-octet false positives. v1.2.2 Features Better multi-key XOR recovery using rizin/r2 lea-near-xor analysis and high-entropy key candidates. Added blind decode fallback for high-confidence XOR keys, improving recovery of short/split IOCs. Raw/unknown inputs now run binary IP, stack-string, and requested XOR extraction. Performance Simplified rizin/r2 integration while preserving key extraction paths. PE stack-string scans now only inspect executable sections. Go binaries skip raw/wide scans over packed string blobs. Bugfixes Fixed noisy Go string extraction that emitted huge concatenated .rodata blobs. Fixed ARM64 Go inline string offsets so strings dedupe correctly. Improved stripped Go PE detection to reduce false XOR payloads. Fixed decoded URL cleanup for multibyte domains and IP:port URLs. v1.2.1 Features Detect Telegram bot tokens Detect Swift mangled symbols Bugfixes Require eyJ prefix for JWT matches Skip XOR IP matches inside binary data tables Stop misdetecting Java/Kotlin code as Python v1.2.0 Features macOS/arm64 stack-XOR decoder — recovers strings built on the stack via MOVZ/MOVK/ADD/STR, including pad reuse across blobs; handles fat binaries. FormatHint (Auto/Binary/Text) lets callers skip XOR and other binary-only passes on known-text input. Cancellation via ExtractOptions::cancel returns partial results when set. Performance XOR scan skips executable sections (60–80% fewer bytes scanned). XOR scan skips Apple/Microsoft platform-signed binaries. Stack-string extraction is now per-section and parallel on PE/Mach-O. Validation hotpath moved from chained contains to Aho-Corasick. Dead garble deobfuscation code removed (~4000 lines); rayon integration simplified. Bug fixes 18.0.0.23 and similar PE ProductVersion strings no longer classified as IPv4. Go symbols (go.shape., syscall.Handle) no longer flagged as Python. Stripped Go PEs detected via .symtab, stopping pclntab noise from producing garbled XOR "payloads". Go module paths no longer misclassified as email/JWT; JWT now requires eyJ… header. Timezone-shaped bytes (10-11-12-08-09+13) no longer produce spurious XOR IPs. 32-bit section-range overflow fixed. Panic hardening across stack_strings, entitlements, instr, overlay, and Go/Rust extractors. v1.1.8 Features XOR detection improvements for ELF binaries Better PE/XOR support (fixes office_update sample handling) Performance Switched to iced-x86 + rayon for faster disassembly with parallelism Aho-Corasick algorithm for XOR/string classification (significant speedup over linear scan) Better SHA/rizin result caching to avoid redundant work Linux micro-optimizations and timing improvements throughout v1.1.7 Bugfixes Fixed false positives where #! appearing later in a file could misclassify plain text or shell content as Python or JavaScript. Performance Reduced overhead in XOR validation by avoiding unnecessary overlapping pattern scans. v1.1.6 Fix bug with incorrectly detecting she-bang programs as having embedded shell v1.1.5 Add raw string fallback for Go-based ELF/machO binaries (PE already had this) v1.1.4 Bugfixes Fix false positive PHP detection from .reloc section garbage matching