Skip to content

CHANGELOG.md

Latest commit

 

History

History
178 lines (141 loc) · 10.4 KB

CHANGELOG.md

File metadata and controls

178 lines (141 loc) · 10.4 KB
Raw

Changelog

Unreleased

1.3.5 — 2026-08-08

Fixed:

  • Flashing works in the standalone build again (critical). In a PyInstaller/frozen binary, invoking esptool re-launched the app instead of running esptool, so every flash / erase / detect silently failed on the downloadable v1.3.4 executables. esptool is now invoked correctly under a frozen build.
  • The Connect button + status re-sync when the flasher drops the serial session, so the UI no longer shows a stale "connected" after a flash takes the port.
  • No more flasher-open freeze — opening the flasher panel could hang the UI; the console output is now bounded and a window close during a flash is guarded.
  • Serial reader-thread race fixed — the race could kill the web tables and leave a stale "connected" after the reader thread died.
  • Suicide provisioning no longer crashes — the build_bundle wrapper had dropped flash_passes / fast_wipe, which crashed GUI provisioning.

Security:

  • Suicide provisioning bounds hardened — sd_passes, flash_passes, arm_pin, and max_att are clamped to the NVS u8 range before they're written, and the suicide password is NUL-safe. build_bundle now enforces the same validate_password checks as the CLI (an armed board could otherwise self-wipe on a malformed password) and uses a fresh output dir per call; the web deadman/armed integer parsing is guarded too.
  • Web / serial input hardened — a flash-busy connect guard, more robust list-routing / SSID parsing, and a de-duplicated git safe.directory entry.

Changed:

  • Releases now publish a SHA256SUMS.txt so downloads can be integrity-checked (sha256sum -c).
  • The suicide provisioner package is bundled into the PyInstaller build.

Docs:

  • Removed internal planning/handoff notes from the public tree and tightened the guide so the repo reads as a self-contained standalone app: deleted FORWARD-PLAN.md, dropped a duplicated "Works with" list plus its stray companion-rig references in GUIDE.md, and reworded the provisioner research digest to describe a generic constrained host.
  • Overhauled the README to the LxveLabs standard (accuracy, contact, structure), dropped the "Production/Stable" over-claim, condensed Status & Roadmap to the latest release, stripped stray tool-call artifacts from ARCHITECTURE.md, and fixed the broken partition-CSV links in the suicide INTEGRATION.md.

1.3.4 — 2026-07-07

Fixed (security — the shipped v1.3.3 binaries were affected):

  • Flasher panel crash. gui_qt used QSpinBox without importing it, so opening the flasher panel raised NameError. Imported it (and dropped two unused imports).
  • Two remote-reachable web holes closed — a wildcard CORS policy and a CR/LF command-injection path in the web UI / serial bridge.
  • Untrusted web input hardened — validate int/choice/required args in command build(); made the esptool busy-claim atomic (check-then-set race); warn on a non-localhost bind and confine the log dir under $HOME.
  • Controller thread-safety — send() now survives a concurrent disconnect; bounded serial writes, guarded reconnect, capped the read buffer.
  • Flasher robustness — bound chip detection and always reap the esptool child; reject an unparseable bundle offset; corrected P4/H4 bootloader offset to 0x2000 and C61 to 0x0 (matched to the uf_core SSOT); dropped a dead esp32c5 branch. Bounded AP/Station table rendering; enforced the updater timeout; fixed a capture-handle leak.

Changed:

  • Packaging: added a suicide optional-deps extra (nvs-partition-gen), folded into all.
  • Contacts rebranded to LxveLabs — discord.gg/lxvelabs + Proton emails (business LxveLabs@proton.me / direct lxveace@proton.me); README leads with lxvelabs.com and surfaces the PCBWay hardware collaboration. Added a GitHub Sponsors link.

1.3.3 — 2026-07-01

Fixed:

  • ESP32-C5 brick fix (critical). The C5's 2nd-stage bootloader offset is 0x2000, not 0x0; the flasher had grouped C5 with the 0x0-bootloader chips, so a C5 full-flash wrote the bootloader to the wrong offset and bricked the board (ROM-recoverable). Replaced the inline logic with an esptool-faithful _bootloader_offset() SSOT helper + a regression test.

Changed:

  • marauder_core.__version__ is now single-sourced from the installed distribution metadata (with a hardcoded fallback for source / frozen builds), so it can't drift from pyproject.toml again.
  • README refreshed for accuracy; added a Status & Roadmap section and a Connect/contact section.
  • Vendored Suicide-Marauder bundle synced to canonical (BootGate no longer telegraphs the locked state; guardcfg partition sizing fix so the gate activates; password-parity hardening; hardware-validated on CYD).

Docs:

  • Added canonical DISCLAIMER.md (authorized lawful use, as-is / no-warranty / no-liability, not legal advice) and linked it from the README.
  • Scrubbed hardcoded local-session paths and personal-identity strings from public docs.

1.3.2 — 2026-06-10

  • Synced the vendored Suicide-Marauder bundle to canonical: forensic overwrite-then-erase wipe and red-team round 3 (encryption-aware verify, resume convergence, factory/scratch coverage, RAM scrub).

1.3.1 — 2026-06-10

New stuff:

  • Suicide-build provisioner integrated into all four UIs (Qt, Tk, TUI, web).
  • macOS arm64 standalone build added to the release workflow.

Changed:

  • README expanded with full feature coverage (command categories, BLE, GPS, flasher details, suicide-build docs) and a universal-flasher roadmap section pointing at the now-released universal-flasher.

1.3.0 — 2026-06-09

Multi-firmware flasher, Suicide-build support, standalone builds, and security hardening.

New stuff:

  • Multi-firmware flasher — profile-based flashing for ESP32 Marauder, ESP32-DIV (cifertech), Bruce (pr3y), and any custom local .bin. Each FirmwareProfile defines its own partition layout, chip map, and support files.
  • Suicide-build flash path — dedicated flash_suicide flow for pre-provisioned Suicide-Marauder bundles with manifest validation and SHA256 integrity checks.
  • Standalone executables — PyInstaller-based Windows .exe, Linux x64, and Linux ARM64 binaries on the Releases page. No Python needed. Built automatically via GitHub Actions CI on each release.
  • build.py for local PyInstaller builds (python build.py --onefile)
  • Hover tooltips across all desktop UIs — shared uihelp.py module with a GLOSSARY of plain-language term explanations
  • Web UI flash panel — full feature parity with desktop GUIs (multi-firmware + Suicide-build + tooltips)
  • ARM64 Linux builds for Raspberry Pi and ARM SBCs

Security:

  • Path-traversal guard on bundle extraction — rejects entries that resolve outside the target directory
  • SHA256 integrity verification for all files in Suicide-Marauder bundles (strict mode: missing/empty hash = hard fail)
  • Red-team round 2 fixes: corrected path-traversal check + stricter bundle schema validation

Changed:

  • Flasher window expanded with firmware profile selector and Suicide-build tab in all desktop UIs
  • GUIDE.md updated with multi-firmware and Suicide-build documentation
  • README updated with standalone binary download links and ARM64 instructions
  • Docs cleanup (SECURITY.md, DISCLAIMER.md, CONTRIBUTING.md trimmed)

1.2.0 — 2026-06-08

Added a browser-based UI, standalone executables, and project policies.

New stuff:

  • Browser UI — Flask + SocketIO at localhost:5000. Full command sidebar, live console over WebSocket, AP/Station tables, parameter forms, raw command input with history, auto-list, logging, keyboard shortcuts (Ctrl+L/K/.), dark theme, --mock and --host 0.0.0.0 support.
  • headless-marauder-web launcher for Linux and Windows
  • run-web.sh / run-web.bat dev scripts
  • SECURITY.md, DISCLAIMER.md, CONTRIBUTING.md, this changelog
  • Standalone executables (Windows .exe, Linux x64/ARM64 binaries) on the Releases page — no Python needed
  • build.py for local PyInstaller builds
  • GitHub Actions CI to auto-build on each release

Fixed:

  • Web UI: flasher.detect_chip() crash from missing callback argument
  • Web UI: XSS through malicious SSIDs in the AP/Station tables
  • Web UI: autolist timer stacking when toggled rapidly
  • Web UI: keyboard shortcuts not working when the command input was focused

Changed:

  • requirements.txt and pyproject.toml updated for Flask/SocketIO deps
  • Installers now include the web UI launcher
  • README updated with browser UI docs

1.1.0 — 2026-06-08

Cross-platform release — Windows support, pip install.

  • Windows installer (install.bat) with venv, PATH, Start Menu shortcut
  • pip install git+....[all] for cross-platform installs
  • pyproject.toml with optional dep groups ([qt], [tui], [all])
  • Updated install.sh / uninstall.sh with TUI launcher

1.0.1 — 2026-06-08

  • In-app Guide tab with full tool reference
  • GUIDE.md — attack chaining walkthrough and integration guide for other tools
  • Hover tooltips on all command buttons

1.0.0 — 2026-06-08

Initial release.

  • PyQt5 GUI with live AP/Station tables, target picker, firmware flasher, logging
  • Tkinter GUI (lightweight alternative)
  • Textual TUI for terminal/SSH use
  • marauder_core shared library — serial controller, 70+ command catalog, stream parser, firmware flasher (ESP32 + S3), capture logger, self-updater
  • Linux installer with app menu entry and PATH launchers
  • Auto-detect serial port at 115200 baud
  • --mock mode for dev/demo without hardware
  • MIT License