What's new in 0.8.0

New in 0.8.0

Antinomie 0.8.0 is in development on the release-0.8.0 branch and is not released yet; the current release is 0.7.1. This page lists what 0.8.0 adds so far. The release notes summarise every version, and the product’s CHANGELOG.md has every item.

Samples and custody

Library › Samples lists every sample across runs and VMs: name, description, tags, run count, parents and children, latest run and SHA-256, with search, a tag filter and Roots only. Add file… hashes a file without running or unpacking it. Everything uploaded into a VM is archived first, as an encrypted zip with the password infected.
A sample has its own window, with Summary, Runs and Custody log tabs. The Summary adds up Triage over the sample’s runs (highest suspicion, rules matched, ATT&CK techniques, evasion attempts, indicators), and has a lineage graph, a file viewer, the runs’ output files and similar samples by TLSH distance.
A custody log chains everything done to or by each sample by SHA-256, so an edited, removed or reordered entry is found. Export custody record… writes JSON or HTML, optionally signed with your own minisign or SSH key.

Library › Samples with three samples: install.sh tagged malicious and dropper with two runs, .x with one run that ended with signal 9, and notes.txt tagged benign that never ran. Search, Tags and Roots only sit above the table; Verify all, Custody log, Download… and Add file… at the top right. — Antinomie 0.8.0, synthetic data.

The sample window for install.sh on its Summary tab: verdict malicious, highest suspicion High in 1 of 2 runs, the YARA rule cron_dropper matched, the ATT&CK technique T1053.003 Scheduled Task/Job: Cron, one virtual machine evasion check, and two runs with their suspicion. — Antinomie 0.8.0, synthetic data.

The Custody log tab of install.sh: Log verified, 4 entries, every link matches, with the head hash and a Verify button, and the entries Added, Edited, Seen in a run and Seen in a run, each with a check mark. — Antinomie 0.8.0, synthetic data.

Read The sample library, The sample window and Custody log.

Report export and evidence bundle

Triage › Export report… writes the whole run as HTML, PDF, JSON (a versioned schema), a MISP event or a STIX 2.1 bundle, with a checkbox per section. The report covers the whole run, whatever the tables are filtered to. An optional evidence bundle holds the packet captures, the files the run dropped in an inner AES-256 zip (password infected), the sample’s custody record and a SHA-256 manifest. Defanging applies to HTML and PDF only. Nothing in a report is a verdict.

The Export report dialog over Triage: section checkboxes from Summary to Custody log head with Network unticked, formats HTML, PDF and JSON ticked and MISP and STIX 2.1 unticked, Evidence bundle unticked, Defang indicators in HTML and PDF ticked, and the folder <recording>/report. — Antinomie 0.8.0, synthetic data.

See Report export and evidence bundle.

File evidence and File Reconstruction

Written content is kept within a budget. Every write the kernel captured reads back exactly from the recording, up to 64 MiB per file and 1 GiB per run by default (Settings › Advanced). Past a cap the first writes are kept and later ranges are listed as not captured.
Earlier bytes of changed files. When a run ends, the bytes the changed files had before the run are copied into its recording from the disk the boot started from, so they stay readable after the base or a checkpoint is gone.
Writes land where the kernel put them: O_APPEND writes, shared descriptors, sendfile, splice, copy_file_range, reflink clones, fallocate and writes through shared mmap mappings. Needs a 0.8.0 base.
File Reconstruction replays a file’s reads, writes and resizes in the order the file system applied them and shows what each byte is known to be, step by step; it can hash a state and save it with a mask of unknown bytes.

Triage › Files › Per-file history of /tmp/analysis-note.txt: the graph open, read ×2, write; the calls with their offsets; Content changes showing 2 bytes that differ at 0x00000001 (65 6c → 58 59); the line Written content: 2 bytes kept with the caps; and the Reconstruct contents… button. — Antinomie 0.8.0, synthetic data.

Settings › Advanced: Show FPS counter, and File activity: written content kept and earlier bytes kept, each 64 MiB per file and 1024 MiB per run, with an explanation under each. — Antinomie 0.8.0, synthetic data.

See Files and File Reconstruction.

Cloud VPS profiles and stealth

Cloud VPS preset. A VM can be an instance of Tencent Cloud CVM, Alibaba Cloud ECS, DigitalOcean Droplet or Vultr VC2: the provider’s firmware strings, chipset, virtio devices, MAC prefix and network, and a lived-in instance on the disk. On a Routed VM the gateway answers the provider’s metadata address with canary credentials that are new for each run, and Triage reports any use of them.
About 40 real machines for the realistic presets, picked per VM and kept for its life, with every value taken from a public hardware report, and no QEMU strings left in the SMBIOS tables.
Snapshots keep their stealth profile. Restoring under another profile offers Switch profile and restore.

Antinomie 0.8.0, synthetic data.

See Cloud VPS profiles, Stealth profile and Snapshots.

Bases and the container builder

Build base… builds where you choose: Automatic, Native, Podman, Docker or the QEMU builder. Podman and Docker build in a pinned Debian 13 container, so Debian Minimal gets Debian’s exact kernel banner on any host. A choice that cannot run says why.
Debian Minimal looks more like an installed system: GRUB’s boot code, Debian’s kernel banner, an installed system’s initramfs, and a UEFI PC’s disk for a VM whose profile boots UEFI. Needs a 0.8.0 base.
Guest kernels have BTF without the recorder’s names in it, as Debian’s kernel does. Needs a 0.8.0 base.

See Bases and the container builder.

Terminal Raw view

Each process terminal has a Formatted / Raw switch. Raw shows the byte stream with escapes written out, searchable and copyable, and highlights escapes that can hide output: cursor moves, line erases, overwrites, concealed text, control strings such as the OSC 52 clipboard command, and the alternate screen. Formatted now draws bold and italic. See Terminal.

Notifications

Toasts that close by themselves show their time left as a thin bar along the bottom edge; hovering pauses it. Settings › Notifications › Toast for live HIGH findings is now off by default.

Four toasts stacked at the bottom right: Starting debian-13-lab with a time-left bar, Rule trigger fired ×2, Sigma input failed ×3 and Saving the run failed, each with Open Activity, above the Activity log with the same four rows. — Antinomie 0.8.0, synthetic data.

See Settings and shortcuts.

Transport and recording reliability

A transport reconnect takes well under a second instead of waiting for the disk, and a command no longer times out before the guest could see it.
Terminal output is no longer dropped on a busy screen.
In Never drop, a waiting guest sender keeps its turn, so the host no longer loses records while it is still reading. Loss is reduced, not gone, and is still counted. Needs a 0.8.0 base.
Summary › Health lists the host’s telemetry read gaps with their cause, so a guest drop can be tied to what held the host up.
Starting a VM again before the previous boot’s recording is saved asks you to wait, and snapshot changes on a stopped VM wait for those saves, so the earlier bytes of changed files are not lost.

See Loss counters and Telemetry transport settings.

Syscall decoding

Captured data reads by its type: strings are always quoted, data buffers are quoted with every byte (binary bytes escaped), and structures, times, integers and pointers show in hex. More structures are decoded by member: signal sets by name, siginfo_t, sigevent, stack_t, bpf’s union bpf_attr by command, capability headers and sets, directory entries, group lists, file_handle, io_uring_params, System V messages, iptables headers and LDT entries. The group lists, directory entries and LDT reads arrive typed only from a 0.8.0 base. Filter keywords cover every bpf command’s members.

Syscall Trace of a recorded run with a write call selected: the Info column shows buf as the quoted string original line, unchanged line, and Details lists fd 3, the 29 captured bytes as text and in hex, and count 29. — Antinomie 0.8.0, a recorded run.

See Syscall Trace and The syscall inventory.

Upgrading from 0.7.xWhat moves on first start, which bases to rebuild and which settings change.