Release Notes: V1.0.11

Released 2026-09-26 · Download this release · Full changelog

Added:

Added --unpack flag for explicit APK unpacking (default: report only, no device interaction)
Added --prefer-dump option to scan pre-dumped DEX directories directly
Added --sniffer / --no-sniffer flag (default: sniffing disabled for safety)
Added --scope authorized-domain list file (only listed domains are sniffed)
Added component version extraction (fastjson / bcprov / log4j) with CVE impact assessment
Added intermediate artifact size report (out/ usage with cleanup hint)
Added credential detection expanded to 56 rule sets (AI service keys / Chinese SDKs / database connections / map keys)
Added PII detection expanded to 14 rule sets (passport / VIN / IMEI / international phone / Chinese address)
Added dex partial decompilation fallback (scan smali output even when baksmali returns non-zero)
Added auto-update mechanism (update subcommand: GitHub Release check / download / MD5 verify / tool versions)
Added config format versioning (config_version field with cross-version auto-migration)
Added scan performance optimization (PII trigger pre-check + AK/SK prefix bucketing, 79% faster on plain code)
Added config deep merge (new rules auto-preserved on version upgrade, user customizations take priority)

Fixed:

Fixed frida detection false negatives in venv deployments (switched to find_spec)
Fixed PII false positives from cryptographic test vectors (blacklist + path-based downweighting)
Fixed USCC false positives (added format validation for dept/type codes)
Fixed old config.toml overwriting new rules (shallow replace changed to deep merge)
Fixed baksmali dependency errors discarding valid smali output (partial success now continues)

Improved:

Unpack pipeline: 120s per-stage timeout (anti-debug resilience), failure falls back to static scan
Log directory now follows -o output; stdout forced flush

Release Notes: V1.0.11 ​