https://cybertoolchain.io/tools/refinery New releases and features in refinery, tracked by The Cyber Toolchain. en Mon, 26 Oct 2026 13:49:17 GMT https://github.com/binref/refinery/compare/0.11.2...0.11.3 https://github.com/binref/refinery/compare/0.11.2...0.11.3 Mon, 26 Oct 2026 13:49:17 GMT refinery 0.11.3 adds six new units (dau3, xtwim, xtiex, dns, huffman, batev, batfs) and breaks several meta variable names and command names⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `dau3` script deobfuscator for AutoIt3 scripts, `xtwim` unit for unpacking WIM archives, `xtiex` unit for unpacking IExpress setup files, `dns` unit for parsing DNS packets from PCAPs (used with the `pcap` and `udp` units), `huffman` unit as a low-level option to directly handle huffman-compressed data, `batev` unit to extract environment variables set during a batch emulation, and `batfs` unit to extract file system artifacts from batch emulation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Renames script deobfuscator commands (`js` becomes `djs`, `ps1` becomes `dps1`, `vba` becomes `dvba`, `php` becomes `dphp`) to remove shadowing of real script interpreters, and improves deobfuscation quality and speed in both `djs` and `dps1`. • Every unit that reports a `start` meta variable now also reports the matching `end` offset. • The `csv` unit now outputs minified JSON. • The `xtpdf` unit metadata paths now end in `.json`. • In `struct`, the format modifier `!0` now reads a bit field and `:` was added as a prefix option for peeking a value. Breaking changes: • The minimum supported Python version was raised from 3.10 to 3.11. • Script deobfuscator commands were renamed: `js` is now `djs`, `ps1` is now `dps1`, `vba` is now `dvba`, and `php` is now `dphp` — any pipeline or script using the old names will break. • The meta variable `offset` was renamed to `start` in `carve`, `rex`, `xtp`, `xtw`, all `carve*` units, `ngrams`, `perc`, `vsect`, `vsnip`, and `xtasar` — pipelines referencing `offset` will no longer find the value. • The meta variable `kind` was renamed to `type` in `xtw` and `xtpdf` — pipelines referencing `kind` from those units will no longer find the value. • The `xt7z` unit now reports the archive checksum as `checksum` rather than `crc32` — pipelines referencing `crc32` from `xt7z` will break. • In `struct`, the format modifier `!0` now reads a bit field and `:` was added as a prefix option for peeking — existing `struct` format strings using `!0` for other purposes will behave differently. • The `pd` and `pb` path handlers lost their separator argument and now always split on both slash and backslash — any invocation passing a separator argument will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 13 May 2026 06:28:44 GMT Refinery 0.11.0 requires Python 3.10+, switches speakeasy backend to 2.0, and adds script deobfuscation capabilities. • Raises the minimum Python version requirement to 3.10 • Switches the speakeasy emulator backend from a fork to speakeasy 2.0 • Adds new capabilities to the script deobfuscation engine Breaking changes: • Running `refinery` with a Python version lower than 3.10 will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Tue, 21 Apr 2026 12:22:47 GMT Refinery 0.10.11 adds `cmdarg`, `swf`, `bigint` units and rewrites deobfuscation with new parsers • Adds `cmdarg` unit to extract and unescape arguments passed to `wmic`, `cmd`, `start`, or `powershell` commands • Adds `swf` unit for extracting resources from Flash SWF files • Adds `bigint` unit for big-integer encoding, split from `base` • Rewrites deobfuscation system with full parsers and emulators: new `ps1`, `vba`, `js`, and universal `defu` units replace old `deob-ps1-*`, `deob-vba-*`, `deob-js-*` • Adds script decompiler outputting human-readable NSIS source to the `xtnsis` unit Breaking changes: • The old deobfuscation units (`deob-ps1-*`, `deob-vba-*`, `deob-js-*`) have been replaced by new units (`ps1`, `vba`, `js`, `defu`) • Big-integer encoding is now in the `bigint` unit instead of `base` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 23 Mar 2026 13:37:39 GMT Adds `unq` unit for restoring AV-quarantined files; simplifies modular dependency system options. • Adds the `unq` unit to restore AV-quarantined files • Simplifies modular dependency system with new options: `default`, `extended`, and `all` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Tue, 17 Mar 2026 08:37:53 GMT Refinery 0.10.3 adds PNG chunk extraction, binary refinery overview mode, and AI agent guidance. • `--brief` (`-b`) flag added to `binref` command to list all available units for quick reference. • `png` unit introduced to extract data chunks from PNG images. • `xtsf` unit extended to support SetupFactory 10 archives. • `py7zr` dependency removed; 7zip unpacker now supports all archive types without external dependencies. • AI usage guidance provided via a new `SKILL.md` file for use with language model based agents. Breaking changes: • The `hostname` regex pattern was renamed to `host`, requiring updates to any configurations or scripts using the old name. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 12 Mar 2026 10:53:25 GMT Refinery 0.10.2 adds xtsf, cbor, asn1, and dncode units for new extraction and parsing capabilities • Adds the `xtsf` unit for extracting SetupFactory binaries. • Adds the `cbor` unit for parsing the CBOR format. • Adds the `asn1` unit for generic ASN.1 structure parsing. • Adds the `xtrar` unit for extracting RAR archives. • Adds the `xtdmg` unit for extracting DMG volumes. • Adds `carve-elf` and `carve-pdf` units. • Adds the `a3xs` unit for extracting only the script part of an AutoIt3 binary. • Adds the `sm3`, `aria`, `twofish`, `scrypt`, and `simon` cryptographic units. • Adds the `plist`, `puny`, and `qp` units for various common encodings. • Adds the `dsstore` unit for parsing MacOS' `.DS_Store` files. • Adds `dncode` unit for extracting the MSIL code from functions in a .NET assembly. Breaking changes: • The `qr` unit can no longer parse arbitrary bar codes but is restricted to QR codes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 23 Feb 2026 19:11:44 GMT Refinery 0.10.0 adds bat, idbmeta, carve-tar, carve-png units and --try global option. • Adds `--try` as a new global option to forward input when a unit fails to process it • Adds the `bat` unit with a parser and emulator for Batch files • Adds the `idbmeta` unit to read metadata from older IDA databases • Adds the `carve-tar` unit for carving TAR files • Adds the `carve-png` unit for carving PNG files Breaking changes: • The `-T` switches in units `alu` and `pemeta` are removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 19 Nov 2025 08:52:56 GMT Adds hlg/hls/hlb syntax highlighting units and integer interval args to bruteforce unit • Adds `hlg`, `hls`, and `hlb` units for accessing different style flavors of syntax highlighting • The `bruteforce` unit now accepts integer intervals as argument rather than Python slices Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 17 Nov 2025 13:39:50 GMT Refinery 0.9.9 adds the `hl` terminal highlighting unit and obfuscated MSI support to `xtmsi` • Adds the `hl` unit for highlighting source code on the terminal Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 17 Oct 2025 06:25:52 GMT Refinery 0.9.5 adds strarray patterns to carve unit and slice-style args to vstack • Adds `strarray` pattern support in the `carve` unit for matching arrays of strings • Enables slice-style address arguments in the `vstack` unit to specify stop addresses more easily • Exposes the current binary-refinery version via the `binref` command Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 03 Sep 2025 09:02:07 GMT Refinery 0.9.0 adds pdfcrypt, qr, z85, flz units and PDF image extraction • Adds `pdfcrypt` unit for removing & adding passwords from & to PDF documents. • Adds `qr` unit for decoding barcodes (especially QR codes). • Adds `z85` unit implementing Base85 encoding scheme. • Adds `flz` unit implementing FastLZ, now included in the universal decompressor. • Extends `pdf` unit with support for extracting images based on the `mupdf` library. • Allows `xtzip` unit to extract archives partially and supports `--lenient` option. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 16 Jun 2025 15:55:00 GMT Adds `pecdb`, `pefix`, and `pkw` units; enables zero-alignment struct peeking • Adds `pecdb` unit for parsing PE CDB (CodeView Debug) information • Adds `pefix` unit for fixing PE binary issues • Adds `pkw` unit for decompressing PKWare archives • In the `struct` unit, supports specifying an alignment value of zero to peek struct entries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 06 Jun 2025 12:49:03 GMT Refinery 0.8.19 adds MSIL disassembly (dnasm/dnopc), Access DB extraction (xtxs), image units (imgdb/imgtp), and filtering (iffc). • Adds `dnasm` unit for MSIL disassembly • Adds `dnopc` unit for MSIL disassembly • Adds `iffc` unit for filtering chunks by size constraints • Adds `xtxs` unit for extracting data from Microsoft Access databases • Adds `b2f` unit as a shortcut for `pick ::-1` Breaking changes: • The transposition option in `stego` has been removed. • The `HKDF` key derivation unit is now lowercase (`hkdf`); using the old capitalization will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sat, 26 Apr 2025 17:43:34 GMT Refinery 0.8.15 adds configurable rounds to tea/xtea and input control to couple unit • Adds `rounds` option to `tea` and `xtea` units for controlling the number of cryptographic rounds. • Adds `--noinput` flag to the `couple` unit to explicitly toggle mode where stderr is discarded by default. • Changes standard path formatting in `xtxml` and `xthtml` units to simplify filtering elements by tag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sat, 19 Apr 2025 07:09:07 GMT Refinery 0.8.14 adds rtfc unit, date regex in xtp, csb/csd stripspace arg, and block separators. • Adds the `rtfc` unit for file carving operations. • Adds a named `date` regular expression pattern available inside `xtp` expressions. • Adds `--stripspace` argument support to `csb` and `csd` shortcuts for `carve`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 06 Mar 2025 12:13:09 GMT Refinery 0.8.6 adds `escps` unit for PS1 string escaping, `escvb` for VB strings, and forward formatting to `rex`. • Adds `escps` unit (renamed from `ps1str`) to escape PowerShell strings • Adds `escvb` unit to escape and unescape Visual Basic strings • Adds input forward format character to `rex` for improved common use case support • Reworks `dnfields` unit to extract prettier paths based on method, type, and namespace Breaking changes: • The `ps1str` unit has been renamed to `escps` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 24 Feb 2025 22:53:29 GMT Refinery 0.8.5 adds xtsim and lzx units for smart install makers and LZX decompression • Adds the `xtsim` unit to extract smart install maker archives • Adds the `lzx` unit for LZX decompression • Adds LZX support to the `xtcab` unit Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 03 Feb 2025 20:56:54 GMT Refinery 0.8.3 adds extensive LZMA format support and embedded image extraction via xtinno unit. • The `lzma` unit now supports a lot more (especially custom) LZMA formats Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 27 Jan 2025 11:13:38 GMT Adds `xtinno`, `speck`, `maru`, `dnarrays` units and string encoding for `ifps`; `-ne` switch for `iff`. • Adds the `xtinno` unit for extracting files from InnoSetup installers • Adds the `speck` cipher unit • Adds the `maru` hash unit • Adds the `dnarrays` unit for extracting hard-coded arrays from compiled .NET code • Allows the `ifps` and `ifpsstr` units to accept a string encoding argument • Extends the `iff` unit with an `-ne` switch • Enables the `xjl` unit to collect frame contents into a JSON list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 13 Dec 2024 11:41:55 GMT Refinery 0.8.0 adds unicorn/speakeasy/icicle support in vstack and updates multibin handler syntax • `vstack` unit now supports three emulator engines: `unicorn`, `speakeasy`, and `icicle` (with `unicorn` as default) • `copy:` and `cut:` multibin handlers accept new argument format `[offset]:[length]:[step]` Breaking changes: • `copy:` and `cut:` multibin handlers change argument syntax from `[start]:[end]:[step]` to `[offset]:[length]:[step]` • `binref` command changes default search logic to conjunctive Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 20 Nov 2024 06:18:01 GMT Refinery 0.7.8 adds --stream to snip, CSV export to xtmsi, relative meta-variable deduplication, and case-insensitive path matching. • Adds `--stream` argument to the `snip` unit to allow offsets relative to previously extracted data • Enables `xtmsi` unit to extract all MSI tables as CSV alongside the JSON blob • Allows the `dedup` unit to specify a meta variable for deduplication via a new optional argument • Makes path extraction units match paths case-insensitively when unambiguous Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 07 Nov 2024 21:15:15 GMT Refinery 0.7.7 adds `httprequest` and `b62` units, and aPLib header support • Adds the `httprequest` unit for parsing HTTP requests. • Adds the `b62` unit (thanks to [@lukaskuzmiak][]). • Adds support for aPLib compressed data with headers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 30 Oct 2024 07:10:46 GMT Adds brotli decompression, pym marshal interface, XChaCha/XSalsa units, and prng/rng argument handlers • Adds the `brotli` decompression unit. • The `pym` unit was added which provides an interface to Python's marshal serialization. • The units `xsalsa`, `xchacha`, and `chacha20poly1305` were added. The latter only performs the decryption part of the scheme. • The argument handlers `prng` and `rng` were added for random number generation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 07 Oct 2024 13:59:05 GMT Refinery 0.7.4 adds symlink control to `ef`, `--join` improvements, and EA05 support in `a3x` • Adds the `-s/--symlinks` option to the `ef` unit to control whether directory symlinks and junctions are followed during extraction. • `autoxor` key scaling method adjusted for larger keys to reduce false positives in scanning results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sun, 08 Sep 2024 17:38:41 GMT Refinery 0.7.2 adds p1/p3 chunk shortcuts, `loop` abort options, and regex handlers • Adds `p1`, `p2`, and `p3` units as shortcuts for picking the first 1, 2, or 3 chunks from a frame • Enhances `loop` unit with more options to abort execution based on regular expression patterns • Reworks conditional units (`iff`/`iffp`/`iffx`/`iffs`) `-R` switch to control boolean negation • Adds new handler `f:` for regular expression arguments to initialize from `carve` formats Breaking changes: • The `-s` switch was removed from conditional units (`iff`/`iffp`/`iffx`/`iffs`) • The `cull` unit was removed from refinery • Conditional units now use a separate switch (not `-s`) to control whether chunks are hidden instead of being discarded Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 06 Sep 2024 19:51:46 GMT Refinery 0.7.1 adds `loop` unit, multi-bin suffix support, Kramer deobfuscator, and more • Adds `--iff` option to units for format-specific application • Adds `loop` unit to apply multibin suffixes repeatedly • Allows piping a `Chunk` object directly to a pipeline • Adds `csb` and `csd` shortcuts for `carve` applications • Enables `reduce` unit to work with multibin suffix • Adds deobfuscator for the `kramer` obfuscator • `xtmsi` unit now extracts embedded CAB files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Mon, 05 Feb 2024 15:50:56 GMT Refinery 0.6.28 removes init value in reduce and splits queue into qf/qb units • Adds optional argument to `reduce` to consume only a limited number of chunks instead of processing all available data • Replaces the `queue` unit with two new units: `qf` (queue front) and `qb` (queue back) for queuing chunks into the current frame Breaking changes: • `reduce` no longer accepts an initialization value argument; the first chunk is always used as the base. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 29 Nov 2023 11:22:48 GMT Adds `sosemanuk` cipher unit and improves `vbastr` capability in refinery 0.6.24 • Improves the capabilities of the `vbastr` unit. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sat, 18 Nov 2023 09:37:15 GMT Refinery 0.6.19 adds whitespace-resilient `b85` unit and synthesized section extraction to `vsect`/`vsnip`. • `b85` unit is now resilient against white space Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 27 Oct 2023 19:10:59 GMT Refinery 0.6.16 isolates path formatting in xhtml/xtxml units and adjusts vstack zero-byte patch logic. • Isolates the path formatting feature in the `xthtml` and `xtxml` units Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 25 Oct 2023 16:38:48 GMT Adds `refinery.shell` string interface, `vstack`, `lzw`, `hc256`, and more units/options • Adds the ability to instantiate units via string arguments imported from `refinery.shell` • Adds the `--more` option to the `struct` unit for unparsed rest data • Adds the `--length` option to the `snip` unit • Adds the `lzw` decompression unit • Adds the `xtmagtape` unit for extracting files from SIMH tape files • Adds the `hc256` cipher unit • Adds a second argument to the `btoi` handler for interlaced integers • Adds the `dnsfx` unit for extracting .NET file bundles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 13 Oct 2023 22:28:56 GMT Refinery 0.6.14 adds ngrams/bruteforce units, shellcode execution in vstack, and Y: shortcut. • `ngrams` and `bruteforce` units added for simple brute forcing tasks • `vstack` unit can now execute shellcode blobs • `vstack` registers can be initialized using shell environment variables • `trim` unit performs case-insensitive trimming via new behavior • `salsa` and `chacha` units accept a 64-byte key for full initial state matrix initialization • `perc` unit extracts resource languages • `yara:` handler supports the shorter `Y:` shortcut for regular expression arguments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Tue, 12 Sep 2023 15:06:51 GMT Refinery v0.6.11 adds machometa, pestrStrip/trim, and xtnuitka units for advanced binary metadata and overlay extraction • Adds `machometa` unit to extract Mach-O binary metadata • Introduces `petrim` unit to remove overlays from PE files • Adds `xtnuitka` unit to extract Nuitka archives Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 31 May 2023 10:17:28 GMT Adds --discard option to stream cipher units; removes vstack call tracing • All stream cipher units now support the `--discard` option to drop initial keystream bytes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 04 May 2023 17:17:30 GMT Adds `xtmsi` for MSI extraction and `csv` reverse operation for JSON-to-CSV • Adds the `xtmsi` unit to extract MSI files and stream metadata as a synthesized JSON document • Adds a reverse operation to the `csv` unit to convert simple JSON documents back to CSV format Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sat, 22 Apr 2023 07:50:04 GMT Refinery 0.6.3 adds xtnode for pkg/nexe extraction and AES support to xtzip • Adds `xtnode` unit for extracting contents of Node.js executables created with `pkg` or `nexe` • Adds AES-encrypted archive support to `xtzip` via the `pyzipper` module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 06 Apr 2023 00:02:07 GMT Refinery 0.6.0 adds `a3x` decompiler unit and path extractor fuzzy-matching controls • Adds the `a3x` AutoIt decompiler unit • Adds switches to control fuzzy matching behavior in path extractor units Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 30 Mar 2023 13:05:51 GMT Adds --swap, --block-size, and --segment-size options to cipher units in refinery 0.5.10 • Adds `--swap` flag to `tea` and `xtea` units to switch endianness • Adds `--block-size` argument to `xxtea` unit to enable block cipher mode Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 01 Dec 2022 14:24:55 GMT Refinery 0.5.2 adds lzg, ntlm, vmemref, vstack, min, max units and lzf chunked support • Adds `lzg` unit for LZG compression handling • Adds `ntlm` hash unit • Adds `vmemref` and `vstack` units (experimental) • Adds `min` and `max` units to replace `sorted [| pick 0 ]` patterns • `lzf` unit now supports the chunked format produced by the command-line `lzf` tool Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Tue, 22 Nov 2022 17:02:32 GMT Refinery 0.5.0 adds variable scoping, `mvg`/`mvc` units, removes `wm`, adds `vaddr`. • `pop` unit now propagates variables to parent scope • `mvg` and `mvc` units introduced for variable scope management • `vaddr` unit added to convert virtual addresses to file offsets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sat, 12 Nov 2022 15:02:19 GMT Adds `pkcs7sig` unit for PKCS#7 signature processing; improves `pemeta` and `dedup` units. • `dedup` unit now uses MD5 instead of Python's built-in hash function because of the high risk of collisions. • The `pemeta` unit now also displays the module name stored in the export directory. • The `pkcs7sig` unit was added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Wed, 12 Oct 2022 17:06:59 GMT refinery 0.4.48 adds [mod]:[exp] RSA input format and `--pretty` for `perc`. • `rsa` and `rsakey` units now accept `[modulus]:[exponent]` hex format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Thu, 22 Sep 2022 08:44:38 GMT Adds `queue` unit, `xtnsis` unit for `xt`, `--glob` flags for `ef` on POSIX, and improved RICH header display in `pemeta`. • The names of urlencode patterns for `carve` were shortened. • Adds the `xtnsis` unit to the units used in `xt`. • By default, the `ef` unit does no longer use glob-patterns on posix systems. The behavior can be explicitly adjusted using new command-line flags. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sat, 23 Jul 2022 12:42:41 GMT Adds carve-lnk, carve-rtf, subfiles, xtnsis, ifps units; b64 unit now supports urlsafe variant • Adds `carve-lnk` unit to extract Windows Shortcut files from unstructured data • Adds `carve-rtf` unit to extract Rich Text Format documents from unstructured data • Adds `subfiles` unit which unifies all structured file format carvers into a single interface • The `b64` unit now automatically detects and switches to the urlsafe encoding variant • Adds `xtnsis` unit to extract files from NSIS archives and disassemble setup scripts • Adds `ifps` and `ifpsstr` units to disassemble and extract strings from compiled Pascal script files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 24 Jun 2022 17:25:48 GMT Refinery 0.4.39 adds `vbapc`, `vbastr`, `mscf`, `b58`, `xkey`, `autoxor` units and variable conversion syntax to `pop`. • Adds `vbapc` and `vbastr` units to extract (decompiled) VBA p-code and VBA strings from Word documents. • Adds `xkey` and `autoxor` units to automatically decrypt XOR-encrypted files using frequency analysis. • Adds `mscf` unit which implements part of the Microsoft Compression API formats. • Adds `b58` unit for base58 encoding. • Adds multibin handler prefix syntax to variables in the `pop` unit to convert input data before storage. • Changes `put` unit behavior: storing current chunk in a variable when no second argument is provided. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sun, 15 May 2022 08:40:38 GMT Refinery 0.4.31 adds `xt`, `xtasar`, `lnk`, `urlfix`, and `xjl` units; `peek` gains colorization. • Adds the `xtasar` unit to extract data from ASAR files • Adds the `lnk` unit to extract metadata from Windows shortcut files • Adds the `urlfix` unit to strip URL fragments and query strings • Adds the `xjl` unit to convert JSON lists into a sequence of JSON chunks • Adds colorization to the `peek` hexdump preview, controlled via the `-g` switch Breaking changes: • The `xvar:` handler is renamed to `eat:` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Fri, 11 Mar 2022 14:11:56 GMT Refinery 0.4.27 adds `deob-vba` unit, `camellia` cipher, `struct` wide strings, and `dnfields` enhancements • Adds `deob-vba` unit to apply multiple VBA/VBS deobfuscation units in one step. • Adds `camellia` cipher support via the `camellia` unit. • Adds `w` format character for `struct` unit to decode wide strings. • Extends `dnfields` unit to extract string fields assigned a unique value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sun, 06 Mar 2022 11:51:36 GMT Refinery 0.4.24 adds six new decompression and deobfuscation units (szdd, lzjb, isaac, bat, groupby) and meta-variable checks for `iff` • Adds the `szdd` decompression unit. • Adds the `lzjb` decompression unit. • Adds the `isaac` cipher unit. • Adds the `bat` unit for deobfuscating batch scripts. • Adds the `groupby` unit. • Adds an option to the `iff` unit to check for the existence of a certain meta variable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Sat, 19 Feb 2022 11:28:47 GMT New hash units (RIPEMD), crypto wallet extraction (`xtw`), entropy heatmap (`iemap`), and PE header size calculation. • `ripemd160` and `ripemd128` units added for RIPEMD hash calculations • `xtw` unit added to extract cryptocurrency wallet addresses from text streams • `iemap` unit added to display colored entropy heatmaps • `struct` unit gains new syntax for byte alignment handling • `rsakey` unit now supports an option to output the public key portion of a private key • `pemeta` unit now computes PE file size based on header information • New comparison operator switches added to the `iff` unit Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md https://github.com/binref/refinery/blob/HEAD/CHANGELOG.md Tue, 15 Feb 2022 17:54:29 GMT Refinery 0.4.21 adds `xlmdeobf` for Excel macro deobfuscation and `carve-7z` for 7zip extraction • Adds the `xlmdeobf` unit, wrapping XLMMacroDeobfuscator to extract and deobfuscate Excel V4 macros • Adds the `carve-7z` unit for carving 7zip archives from binary blobs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/refinery