Upgrading

Updating the app never replaces an installed base, a VM’s disk or a recording. Data migrations happen on the first start of the new version, in place, and keep the old records.

How to update

Run ./install.sh from the newer release archive. It replaces the executable and keeps your data in ~/antinomie (or your --data-dir). See Installation.

0.8.0 has no release archive yet: to try it, build it from source on the release-0.8.0 branch.

Back up before trying a development build

0.8.0 migrates the sample records on its first start (below). These pages do not describe going back to 0.7.1 afterwards. Copy the data directory first, or point the development build at a separate one with --data-dir.

From 0.7.x to 0.8.0 New in 0.8.0

On the first start

• Samples move into the library. The archives that Tools → Malware samples… kept as samples/<sha256>.zip, with a JSON record each, are moved into the new library layout (a folder per first two hex digits of the SHA-256) and entered in its database. The old JSON records are kept in samples/legacy/. The move is a rename, never a copy, it can safely be repeated, and a record whose archive is missing is left where it is. These samples are marked as recorded before the library. See The sample library.
• Plain events become the custody log. The events earlier versions kept for each sample are brought into the hash chain once, and each such entry is marked recorded before the custody log: the log can show that they were not changed since the migration, not what happened before it. See Custody log.

Settings

• Toast for live HIGH findings (Settings → Notifications) is now off by default and stored under a new key, because 0.7 saved its default for everyone. A computer that had it on turns it on again once.
• Settings → Advanced gains the File activity caps: written content kept and earlier bytes kept, each 64 MiB per file and 1024 MiB per run by default.

Bases: guest revision 18

0.8.0 uses guest contract revision 18. Bases built for 0.7.x (revision 17) keep working and are labelled Outdated. They lack only:

Needs a 0.8.0 base	With a 0.7.x base
Real file positions and in-kernel copy operands (file.position, file.copy)	Appends and writes through shared descriptors count as at an unknown offset
Writes through shared file mappings	Not seen
Typed group lists, directory entries and LDT reads	Shown as bytes
The fairer Never drop send wait	Records can still be dropped while the host is reading
Kernel BTF without the recorder’s names	No /sys/kernel/btf/vmlinux on BusyBox and Debian Minimal; the desktop kernel’s BTF names the recorder
Debian Minimal’s GRUB boot code, kernel banner, initramfs modules, and a UEFI disk for UEFI profiles	As built by 0.7.1

To get them, download or build a base with 0.8.0 and create new VMs from it. Existing VMs keep the base they were created from. Building Debian Minimal natively now needs a Debian 13 host; on any other host, use Podman, Docker or the QEMU builder. Building the minimal kernel from source needs pahole (dwarves). See Compatibility and Bases and the container builder.

Existing VMs and snapshots

• Stealth profiles take their machine’s corrected firmware values (no QEMU strings in SMBIOS) at the VM’s next boot. VMs on the old Supermicro X12STH-F profile keep their network card slot until you change the machine; 0.8.0 replaces that profile with the X11SCL-F.
• Snapshots taken before 0.8.0 have no recorded stealth profile, so they restore as they are, with a note. New snapshots refuse to restore under a different profile and offer Switch profile and restore.

Existing recordings

Recordings made by 0.7.x stay readable. A few things are new only for runs recorded or opened by 0.8.0:

• The sample window adds up Triage from a digest Triage keeps when it reads a finished run; a run Triage never opened says not triaged.
• The earlier bytes of changed files are copied into a recording when a boot recorded by 0.8.0 ends.
• Sigma results saved by 0.7.x show without the note on category acceptance.

From 0.6.x to 0.7.1

0.7.1 is the first release after 0.6.2; the 0.7.0 work was not published separately.

• Bases. 0.7.1 uses guest revision 17. Bases made for 0.6.x (revision 16) keep working and are labelled Outdated; the debugger, file hashes, credentials, larger cores and the other features listed in Compatibility need a 0.7.x base.
• Host packages. Debian VMs need guestfish (libguestfs-tools); the release needs glibc 2.39 or newer. See Installation.
• Rule manager. Tools → Rule manager… became the Library → Detection rules page.
• Licence. The host application is GPL-3.0-only from 0.7.0; earlier releases stay MIT. See Licensing.

Older data folders under ~/.local/share/antinomie are copied to ~/antinomie on a default start, verified, and kept as a backup; do not use both as separate copies of the same VM.