- Remove POST /diff/files endpoint that allowed arbitrary host file reads
(CWE-22); clients must now read files locally and POST content to
/diff/blobs instead
- Add validatePublicURL() to /info remote endpoints, rejecting URLs that
resolve to loopback, private, link-local, or multicast addresses to
prevent SSRF; also remove attacker-controlled proxy/insecure params
- Add SanitizeArchivePath() helper that verifies extracted archive entry
paths stay within the destination directory (zip-slip / tar-slip,
CWE-22); replace bare filepath.Join(dest, filepath.Clean(name)) calls
in SearchZip, OTA parser, AA payload extractor, and ota_extract
- Fix server listen address to use net.JoinHostPort to respect Host config
Resolve imported symbol names from kernelcache for reverse engineering.
Scans all fileset entries to build a symbol map, then injects resolved
addresses as N_ABS|N_EXT symbols into extracted KEXTs. (closes#182)
- Add --imports to resolve undefined symbols from kernelcache
- Add --force to overwrite existing files
- Add -o shorthand for --output
- Fix os.Stat error handling (propagate real errors, not just skip)
- Fix typo: "KEXT-xtraction" → "KEXT extraction"
- Update kernel extract guide with --imports example
Extraction now produces correct standalone MachOs validated against
Apple ramdisk dylibs, KDK KEXTs, Rust oracle, and IDA Pro.
- Unhide dyld extract (go-macho v1.1.266 fixes segment layout)
- Remove experimental warning
- Fix help text: "Split ALL dylibs" → "Extract all dylibs"
- Short: "Extract dylib(s) for reverse engineering"
- Replace broken symlink handling with filepath.EvalSymlinks
- Delete dead code: imports flag, debug prints, commented-out blocks
- Switch from github.com/pkg/errors to std errors
- Differentiate split vs extract in help text and Long description
- Clean up dyld split: same symlink fix, drop pkg/errors
blacktop
Thatchapon UnprasertandGitHub
Sean DeatonandGitHub
Noah GregoryandGitHub