File:		changes.log
Project:	pestudio
Email		info@winitor.com
Web:		www.winitor.com
Warning:	This software is provided 'as-is', without any expressed or 
		implied warranty. In no event will the author be held liable for 
		any damage arising from the use of this software.

		Summary of the features of pestudio & pestudio-pro at following URL:
		www.winitor.com/tools/pestudio/current/pestudio-features.pdf
			
		Some features are availabe only in the professional version of pestudio.
		The free version of pestudio may not be used in a professional environment.

		When retrieving the scores from Virustotal, pestudio NEVER submits 
		the sample itself! pestudio only submits the hash (MD5) of the 
		sample being analysed.

Copyright (C) 2009-2019, Marc Ochsenmeier

Version 8.90
. detect more anomalies
. Show first-bytes-text of resources
. Add some missing items in the XML report file

Version 8.89
. Fix bugs
. Synchronize the content of the XML report with the GUI

Version 8.88
. Fix a bug when handling export XML file from the CLI
. Extend overview of time-date stamps
. Handle more malformation of sections and show indicators appropriately
. Add sample name analysed in the caption of pestudio GUI

Version 8.87
. Fix bugs
. Detect TLS Callback functions for 64bit executable
. Extend sections view with "self-modifying" tag
. Extend msdn search on imports
. Extend google search on exports
. Extend google search on strings
. Show hashes of Certificates to ease hunting

Version 8.86
. fix bugs
. Add search Google and Virustotal for resources

Version 8.81 to 8.85
. fix bugs
. clean API classification
. extend several context menus
. show time date stamp of directories
. Add google search to sections hash
. Compute hashes of Version blob
. Add google search using hashes of Version blob
. Show file hashes with and without overlay
. Fix a bug when handling embedded files
. Fix a crash on Win10
. Fix a bug when dumping sections
. Extend google search to imphash to ease hunting
. Extend google search to hashes of image, pdb, dos-stub, overlay to ease hunting
. Add underlining items to indicate google search URL link
. Add search google for strings view
. Show details of virustotal report

Version 8.76 - 8.80
. Fix bugs
. Handle characteristics specific to EFI executable files
. Extend detection of embedded executable to all sections
. Fix a bug when detecting resources types
. Compute SHA1 and SHA256 for dos-stub
. Compute SHA1 and SHA256 for debugger
. Extend the detection of embedded file(s) in overlay
. Fix sorting of Virustotal scores
. Extend context Menu of Virustotal view
. Add support of "favorite-engine" for Virustotal

Version 8.71 - 8.75
. Fix flickering of the views
. Extend strings detection by indicating presence of API and Libraries strings in the Import Table 
. Fix a bug with the creation of the XML report file
. Add functions groups to the strings View 
. Extend functions groups to the delay-loaded functions
. Show functions that are delay-loaded
. Fix a bug when handling deprecated functions
. Extend context menu for imports to cope with functions.xml file
. Extend groups of imports
. Extend groups of imports

Version 8.66 - 8.70
. Expose the indicators id number in the output XML file
. Extend grouping of utilities
. Extend grouping of imports by types and colors
. Add grouping of imports by types and colors
. Extend strings "hint" detection and mapping
. Extend signatures detection
. Extend strings "hint" detection and mapping
. Extend detection of strings "hint"
. Fix a bug when computing the position of the entry-point when located at the very beginning of a section
. Add detection of strings "hint" (e.g. GUID, RTTI, ..)

Version 8.61 - 8.65
. Compute the Sha256 of the image and the overlay
. Extend and consolidate the Indicators
. Fix a bug when handling a debug type
. Fix bug when showing exports of 64bit file
. Fix bug when showing the offset of the Security Directory
. Extend Indicators
. Add detection of whitelist (well-known) strings
. Add detection of deprecated functions
. Add detection of undocumented functions
. Consolidate indicators
. Extend the resource type detection
. Extend handling of malformed manifest
. Extend handling of the file signature
. Detect "unusual" dos-stub messages
. Increase performance when loading executable with large collection of exports
. Consolidate switches in settings.xml
. Consolidate API classification
. Fix a bug when handling the Thread-Local Storage (TLS)
. Fix a bug of the Manifest View
. Fix a bug when detecting 64-bit managed files
. Add online check of update in the "About" dialog
. Add support for ARM detection
. Indicate missing library
. Extend features of standard version

Version 8.56 - 8.60
. Add detection of Control Flow Guard (CFG)
. Add details for Virustotal view
. Show first bytes (hex) of resources
. Show first bytes (hex and text) of file
. Handle empty entry-point 
. Extend Indicators
. Fix a crash with some 64bit executables
. Add detection of missing libraries
. Extend status-bar
. Extend translations
. Extend Exports handling
. Extend Imports handling
. Extend signatures
. Clean and Extend indicators
. Show first bytes of entrypoint
. Show first bytes of overlay
. Show dos-stub message
. Compute file-ratio for resources, sections, overlay and dos-stub
. Extend file summary
. Extend file signature detection
. Fix bugs

Version 8.51 to 8.55
. Extend Indicators
. Dump PKCS7 Certificate
. Fix bug with libraries
. Show overlay strings numbers
. Detect duplicated exported symbols
. Enhance unicode strings detection
. Show strings location map with colors
. Differentiate URLs referenced in the certificate
. Differentiate between standard and professional (pro) versions of pestudio
. Add deletion of overlay
. Add computation of entropy
. Add detection of TLS Callback functions
. Show more details about sections
. Fix bugs and crash
. Rename pestudioprompt.exe into pestudiox.exe
. Add virustotal scoring of hardcoded URL
. Add detection of pipes
. Add Network Watchdog to update Virustotal score automatically
. Add XML switches to define the colors of the front-end
. Fix ordinal functions mapping for 64bit images
. Fix a crash when handling overlay
. Fix a bug when retrieving the Description of the delay-loaded libraries

Version 8.00 to 8.50
. Fix a bug when handling exported functions of 64bit executables
. Add detection of Windows builtin services
. Fix a bug when handling strings
. Extend Thresholds
. Extend Indicators
. Show virustotal score for Overlay (when available)
. Fix an issue in the Debug detection
. Fix an issue in imported symbols by ordinal for 64bit files
. Add computation of Imports Hash (imphash)
. Add detection of strings embedded in non-PE files
. Fix a crash with malformed files
. Corrected duplicates during collection of functions statistics
. Add Virustotal aging and submission date
. Extend Languages detection and mapping
. Add PeID Signature detection 
. Add XML-based detection of OIDs
. Add XML-based detection of useragent
. Add detection of references to Firefox API
. Add MD5 Blacklist for a file and its Resources 
. Extend detection of Overlay
. Extend validation of Sections
. Add Blacklist of MD5 dedicated to the Overlay
. Extend detection of files embedded in Resources
. Add detection of Regular Expressions and Threshold
. Fix a bug when handling the imports of some images
. Add Functions Groups classification
. Resources with unknown Signature and containing only text are now tagged as Text
. Fix a bug when handling the Characteristics of the FileHeader
. Add MD5, SHA1 and Virustotal Score for Overlay
. Fix bugs 

Version 6.00 to 7.00
. Add Dump of Indicators
. Add Dump of Manifest
. Add Context menu for Certificates
. Add Dump of Certificates
. Raw discovery of fundamental characteristics of the Certificate(s) embedded in the Image
. Handle non-printable characters in XML report
. Add more Indicators specific to the location of the Entry Point
. Add more details (offset and size) for each file Cave detected
. Show the name of the section BaseOfCode is located in
. Fix reporting of the Libraries in the XML report
. Add Indicators specific for First and Last Sections
. Take virtual Section into account when pointing the overlay
. Fix detection of MPRESS under 64bit

Version 5.00 to 6.00
. Fix a bug by reading Symbols
. Correct missing Dependencies for some types of images
. Rename *.XML files to PeStudio*.XML
. Interfaces to PeParser (PeParser.h and PeParser.lib) are now part of the Package.
. Add Indexing of String
. Add Detection of duplicated Section Names
. Allow Strings length choice for filtering at the UI
. Show Strings at the UI
. Add Strings count in output XML
. Detect Section-less images and added in Indicators.XML
. Correct Address Offset of reported Strings

Version 4.00 to 5.00
. The Strings contained in the file analysed can now be exported to the output XML file
. Add validation Check of AddressOfEntryPoint field
. Custom Resources are shown in orange colour
. Correct handling of Certificate Directory
. Correct colouring of Indicators
. When handling a resources only images, some validity checks are different
. Enhanc detection of device driver images
. Rename parameters for command prompt (see Prompt support description above)
. Add detection of CAB, PDF, RIFF, GIF, PNG files
. Add detection of "requireAdministrator" Execution Level from the Manifest
. Add Command Prompt support (see Prompt support description above)
. Add "The image exports XY Symbols" as new Indicator
. Add more obsolete functions in the WindowsFunctionsDeprecated.xml file (delivered with this project)

Version 1.0 to 4.00
. Support 64bit Images on 32bit Platform
. Show Resources Languages
. Show Type of Debug information (NB09, NB10, NB11, RSDS )
. Show imported Functions of missing libraries
. Show total number of Bytes available in Caves
. Show Gaps in Exported Symbols collection
. Show Section Name the Base of Data belongs to
. Add OptionalHeader to XML report
. Add detection of duplicated Sections names
. Add detection of Code-less images
. Add detection of Section containing the Entry point
. Correct filtering of Obsolete Imported Functions
. Correct Imported Symbols for 64bit images
. Correct Page-able Section Flag
. Correct detection of msstyles "Resources Only" Images
. Correct a crash that takes place when switching between Tree and list View in Resources Tab
. Add Detection of Image Obfuscation (encryption, compression) as Evidence
. Un-decorate function names
. Support Manifest dependentAssembly.
. support Side-by-Side libraries.
. Support Forwarded Functions
. Filtering Obsolete Functions
. Enumeration of Implicit dependencies and other general information