Skip to content

v2.1.0 – Stability & Reliability Fixes

Latest
Latest

Choose a tag to compare

View all tags
@SecurityM SecurityM released this 04 Jul 00:01
v2.1.0
ad39c9d

IntegrityGap v2.1.0 — Bug Fix & Accuracy Release

Overview

IntegrityGap v2.1.0 closes out every issue found in the v2.0.0 static code audit, and adds several additional fixes uncovered during follow-up review.
This release focuses on correctness — making the CLI match its own documentation, fixing scoring logic that silently ignored part of its own model, and reducing false positives across multiple engines — plus one new analysis engine.

Major Changes

Critical Fixes

  • CLI flags now match the README — all 19 standalone flags (--all, --concurrency, --taint, --crypto, --privacy, --compliance, --memory, --dependencies, --config, and more) are recognized, instead of only the internal --mode <name> syntax
  • Fixed confidence-scoring bug where every function's anomaly confidence was compared against a constant instead of its own value, making the adjustment meaningless
  • 3 of 10 scoring dimensions (memory safety, configuration, supply chain — 22% of total weight) are now actually calculated instead of always defaulting to 0

High Severity

  • Eliminated duplicate execution of all 8 specialized engines when --mode all is combined with HTML, Markdown, or SARIF output — was silently doubling analysis time

Medium Severity

  • Firmware analysis results now appear in combined HTML/Markdown/SARIF reports (previously always isolated)
  • 10 previously dead CLI flags are now functional: --csv, --junit, --cache-enabled, --cache-directory, --min-severity, --max-findings, --fp-reduction, --enable-remediation, --enable-cvss, --config-file
  • Concurrency score is now visible in JSON/plain output
  • Specialized engine findings (taint, crypto, compliance) now factor into the overall threat classification, instead of running as disconnected results

Low Severity

  • Threat classification extended from 6 to 16 reachable categories, including rootkit, bootkit, infostealer, and worm

Documentation

  • README now discloses that the CVE database is a static, point-in-time snapshot
  • Firmware analysis scope documented accurately

🔍 New Analysis Engine

v2.1.0 adds a new module to the analysis suite:

  • String analysis (--strings)
    • Extracts and classifies strings into 13 categories
    • URLs, IPv4/IPv6 addresses
    • Windows/Unix paths, registry keys
    • Shell commands, hardcoded crypto keys
    • Emails, JWT tokens, base64 blocks, hex strings

🎯 Additional Accuracy Fixes

Found outside the original audit, during follow-up review:

  • Fixed a concurrency-analysis bug where lock/unlock detection always returned the same result regardless of the binary's actual code
  • Reduced false positives in null-pointer-dereference detection — now requires a real memory access near the zeroed register, not just the assignment
  • Fixed a scope bug in memory-leak counting that inflated leak counts across an entire binary instead of per function
  • Compliance findings now carry a confidence level (confirmed / likely / heuristic / unknown), avoiding false negatives on stripped binaries with no symbols
  • Optimized taint analysis performance for large binaries
  • Removed a false-positive crypto finding that flagged code disabling insecure legacy TLS versions as if it were the reverse

📈 Test Coverage

Compared with the audited v2.0.0 build:

Metric v2.0.0 (audited) v2.1.0
Tests passing 397 / 653 685 / 689
Pass rate 60.8% 99.4%

🔄 Upgrade Notes

No breaking changes to the JSON schema or CLI flags that were already working in v2.0.0. Scripts relying only on --mode <name> continue to work unchanged; the new standalone flags are additive.

Full Changelog: v2.0.0...v2.1.0

Assets 5
Loading