
File:		changes.log
Project:	pestudio
Email		info@winitor.com
Web:		www.winitor.com
Legal:		Only the professional version of pestudio is allowed to be used in a professional environment

Copyright (C) 2009-2017, Marc Ochsenmeier

Version 8.70
. Expose the indicators id number in the output XML file
. Extend grouping of utilities
. Extend grouping of imports by types and colors

Version 8.69
. Add grouping of imports by types and colors
. Extend strings "hint" detection and mapping

Version 8.68
. Extend signatures detection
. Extend strings "hint" detection and mapping

Version 8.67
. Extend detection of strings "hint"

Version 8.66
. Fix a bug when computing the position of the entry-point when located at the very beginning of a section
. Add detection of strings "hint" (e.g. GUID, RTTI, ..)

Version 8.61 - 8.65
. Compute the Sha256 of the image and the overlay
. Extend and consolidate the Indicators
. Fix a bug when handling a debug type
. Fix bug when showing exports of 64bit file
. Fix bug when showing the offset of the Security Directory
. Extend Indicators
. Add detection of whitelist (well-known) strings
. Add detection of deprecated functions
. Add detection of undocumented functions
. Consolidate indicators
. Extend the resource type detection
. Extend handling of malformed manifest
. Extend handling of the file signature
. Detect "unusual" dos-stub messages
. Increase performance when loading executable with large collection of exports
. Consolidate switches in settings.xml
. Consolidate API classification
. Fix a bug when handling the Thread-Local Storage (TLS)
. Fix a bug of the Manifest View
. Fix a bug when detecting 64-bit managed files
. Add online check of update in the "About" dialog
. Add support for ARM detection
. Indicate missing library
. Extend features of standard version

Version 8.56 - 8.60
. Add detection of Control Flow Guard (CFG)
. Add details for Virustotal view
. Show first bytes (hex) of resources
. Show first bytes (hex and text) of file
. Handle empty entry-point 
. Extend Indicators
. Fix a crash with some 64bit executables
. Add detection of missing libraries
. Extend status-bar
. Extend translations
. Extend Exports handling
. Extend Imports handling
. Extend signatures
. Clean and Extend indicators
. Show first bytes of entrypoint
. Show first bytes of overlay
. Show dos-stub message
. Compute file-ratio for resources, sections, overlay and dos-stub
. Extend file summary
. Extend file signature detection
. Fix bugs

Version 8.51 to 8.55
. Extend Indicators
. Dump PKCS7 Certificate
. Fix bug with libraries
. Show overlay strings numbers
. Detect duplicated exported symbols
. Enhance unicode strings detection
. Show strings location map with colors
. Differentiate URLs referenced in the certificate
. Differentiate between standard and professional (pro) versions of pestudio
. Add deletion of overlay
. Add computation of entropy
. Add detection of TLS Callback functions
. Show more details about sections
. Fix bugs and crash
. Rename pestudioprompt.exe into pestudiox.exe
. Add virustotal scoring of hardcoded URL
. Add detection of pipes
. Add Network Watchdog to update Virustotal score automatically
. Add XML switches to define the colors of the front-end
. Fix ordinal functions mapping for 64bit images
. Fix a crash when handling overlay
. Fix a bug when retrieving the Description of the delay-loaded libraries

Version 8.00 to 8.50
. Fix a bug when handling exported functions of 64bit executables
. Add detection of Windows builtin services
. Fix a bug when handling strings
. Extend Thresholds
. Extend Indicators
. Show virustotal score for Overlay (when available)
. Fix an issue in the Debug detection
. Fix an issue in imported symbols by ordinal for 64bit files
. Add computation of Imports Hash (imphash)
. Add detection of strings embedded in non-PE files
. Fix a crash with malformed files
. Corrected duplicates during collection of functions statistics
. Add Virustotal aging and submission date
. Extend Languages detection and mapping
. Add PeID Signature detection 
. Add XML-based detection of OIDs
. Add XML-based detection of useragent
. Add detection of references to Firefox API
. Add MD5 Blacklist for a file and its Resources 
. Extend detection of Overlay
. Extend validation of Sections
. Add Blacklist of MD5 dedicated to the Overlay
. Extend detection of files embedded in Resources
. Add detection of Regular Expressions and Threshold
. Fix a bug when handling the imports of some images
. Add Functions Groups classification
. Resources with unknown Signature and containing only text are now tagged as Text
. Fix a bug when handling the Characteristics of the FileHeader
. Add MD5, SHA1 and Virustotal Score for Overlay
. Fix bugs 

Version 6.00 to 7.00
. Add Dump of Indicators
. Add Dump of Manifest
. Add Context menu for Certificates
. Add Dump of Certificates
. Raw discovery of fundamental characteristics of the Certificate(s) embedded in the Image
. Handle non-printable characters in XML report
. Add more Indicators specific to the location of the Entry Point
. Add more details (offset and size) for each file Cave detected
. Show the name of the section BaseOfCode is located in
. Fix reporting of the Libraries in the XML report
. Add Indicators specific for First and Last Sections
. Take virtual Section into account when pointing the overlay
. Fix detection of MPRESS under 64bit

Version 5.00 to 6.00
. Fix a bug by reading Symbols
. Correct missing Dependencies for some types of images
. Rename *.XML files to PeStudio*.XML
. Interfaces to PeParser (PeParser.h and PeParser.lib) are now part of the Package.
. Add Indexing of String
. Add Detection of duplicated Section Names
. Allow Strings length choice for filtering at the UI
. Show Strings at the UI
. Add Strings count in output XML
. Detect Section-less images and added in Indicators.XML
. Correct Address Offset of reported Strings

Version 4.00 to 5.00
. The Strings contained in the file analysed can now be exported to the output XML file
. Add validation Check of AddressOfEntryPoint field
. Custom Resources are shown in orange colour
. Correct handling of Certificate Directory
. Correct colouring of Indicators
. When handling a resources only images, some validity checks are different
. Enhanc detection of device driver images
. Rename parameters for command prompt (see Prompt support description above)
. Add detection of CAB, PDF, RIFF, GIF, PNG files
. Add detection of "requireAdministrator" Execution Level from the Manifest
. Add Command Prompt support (see Prompt support description above)
. Add "The image exports XY Symbols" as new Indicator
. Add more obsolete functions in the WindowsFunctionsDeprecated.xml file (delivered with this project)

Version 1.0 to 4.00
. Support 64bit Images on 32bit Platform
. Show Resources Languages
. Show Type of Debug information (NB09, NB10, NB11, RSDS )
. Show imported Functions of missing libraries
. Show total number of Bytes available in Caves
. Show Gaps in Exported Symbols collection
. Show Section Name the Base of Data belongs to
. Add OptionalHeader to XML report
. Add detection of duplicated Sections names
. Add detection of Code-less images
. Add detection of Section containing the Entry point
. Correct filtering of Obsolete Imported Functions
. Correct Imported Symbols for 64bit images
. Correct Page-able Section Flag
. Correct detection of msstyles "Resources Only" Images
. Correct a crash that takes place when switching between Tree and list View in Resources Tab
. Add Detection of Image Obfuscation (encryption, compression) as Evidence
. Un-decorate function names
. Support Manifest dependentAssembly.
. support Side-by-Side libraries.
. Support Forwarded Functions
. Filtering Obsolete Functions
. Enumeration of Implicit dependencies and other general information