diff --git a/CHANGELOG.md b/CHANGELOG.md index 013e43b..5633274 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,17 @@ All notable changes to OffsetScan are documented in this file. The project follows semantic versioning. +## [0.2.2] - 2026-07-21 + +### Documentation + +- Rewrite the README "Verified parity" section as a real side-by-side: it now shows the + actual `offsetscan ioc` JSON (array, `/` paths) next to the actual `Get-OffsetIOC | + ConvertTo-Json` output (object, `\` paths), and notes that field *values* are identical + while the only differences are cosmetic serialization. The prior version implied a + left/right comparison but showed a single stylized block matching neither tool's real + output. No code changes. + ## [0.2.1] - 2026-07-21 ### Documentation diff --git a/Cargo.lock b/Cargo.lock index 89e8e1d..16c8f1e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -488,7 +488,7 @@ dependencies = [ [[package]] name = "offsetscan" -version = "0.2.1" +version = "0.2.2" dependencies = [ "chrono", "clap", diff --git a/Cargo.toml b/Cargo.toml index c95d1d1..62fb0b2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "offsetscan" -version = "0.2.1" +version = "0.2.2" edition = "2021" authors = ["DreadHost Research"] description = "Standalone native corpus-scale engine for PE parsing, entropy, string extraction, and IOC panels — schema-compatible with OffsetInspect.Result/ThreatScanResult JSON output." diff --git a/README.md b/README.md index e52a8f2..0acff94 100644 --- a/README.md +++ b/README.md @@ -43,27 +43,57 @@ by unit tests so the interchange contract can't silently drift. ### Verified parity -Both engines against the same Windows system DLL — `offsetscan ioc` on the left, -`Get-OffsetIOC | ConvertTo-Json` on the right: - -```text -File C:/Windows/System32/kernel32.dll -FileSize 836232 -MD5 46e3ab50afcb6d871b70676f562e01ce -SHA1 732af3ed087e2033d7e7ccaa0f4498deb2e46e8c -SHA256 26410f4948e0ed66936880596e2b5a59efce481a7c97086049b385f00325c341 -OverallEntropy 6.361191 -HighEntropyWindows 25 -PrintableStringCount 5665 -IsPE true -Machine x64 (AMD64) -ImpHash a6c6d5a8f6e13c556e2c3fbc4a3dc407 -ImportedDllCount 104 -HasOverlay true -OverlaySize 17032 +Both engines produce the same IOC panel for a file — captured at runtime against the same +Windows system DLL. + +`offsetscan ioc C:\Windows\System32\kernel32.dll`: + +```json +[ + { + "File": "C:/Windows/System32/kernel32.dll", + "FileSize": 836232, + "MD5": "46e3ab50afcb6d871b70676f562e01ce", + "SHA1": "732af3ed087e2033d7e7ccaa0f4498deb2e46e8c", + "SHA256": "26410f4948e0ed66936880596e2b5a59efce481a7c97086049b385f00325c341", + "OverallEntropy": 6.361191, + "HighEntropyWindows": 25, + "PrintableStringCount": 5665, + "IsPE": true, + "Machine": "x64 (AMD64)", + "ImpHash": "a6c6d5a8f6e13c556e2c3fbc4a3dc407", + "ImportedDllCount": 104, + "HasOverlay": true, + "OverlaySize": 17032 + } +] ``` -Every field matches, including the imphash and entropy to six decimal places. +`Get-OffsetIOC C:\Windows\System32\kernel32.dll | ConvertTo-Json`: + +```json +{ + "File": "C:\\Windows\\System32\\kernel32.dll", + "FileSize": 836232, + "MD5": "46e3ab50afcb6d871b70676f562e01ce", + "SHA1": "732af3ed087e2033d7e7ccaa0f4498deb2e46e8c", + "SHA256": "26410f4948e0ed66936880596e2b5a59efce481a7c97086049b385f00325c341", + "OverallEntropy": 6.361191, + "HighEntropyWindows": 25, + "PrintableStringCount": 5665, + "IsPE": true, + "Machine": "x64 (AMD64)", + "ImpHash": "a6c6d5a8f6e13c556e2c3fbc4a3dc407", + "ImportedDllCount": 104, + "HasOverlay": true, + "OverlaySize": 17032 +} +``` + +Every field value matches, including the imphash and entropy to six decimal places. The +only differences are cosmetic serialization: OffsetScan always wraps results in an array +(its JSON-mode convention, even for a single file) and normalizes path separators to `/`, +while `ConvertTo-Json` emits a bare object with Windows `\` paths. String extraction is compared as a set, not just a count. For `ntdll.dll` (2,517,928 bytes), `offsetscan strings` and `Get-OffsetString` both return