Feature/v0.7.3 into main#30

Merged

malx-labs merged 40 commits into

mainfrom

May 11, 2026

Commits on May 4, 2026

Add validators and reason codes first draft
malx-labs
committed
Add missing heuristics rich C source code
malx-labs
committed
The order of heuristics has changed: entrypoint_out_of_bounds now comes first along with other reorderings. Import_rva_invalid is now consumed within data_directory_zero_rva_nonzero_size
malx-labs
committed
Re-write heuristics unit tests based on the refactored structural checks
malx-labs
committed
Removed invalid_rva size = 0 heuristic as this is valid under PE rules and should not be flagged as an anomaly
malx-labs
committed
import_rva_invalid now taken care of by data_directory_out_of_range and related rva graph checks - altered contract test expected output to match this refactor
malx-labs
committed
tls_callback_anomaly is now a pe_structure_anomaly with a callback_outside_tls_range reason. moved to the end of the heuristics output
malx-labs
committed
entrypoint_out_of_bounds now at the start of the heuristics section, section_raw_misaligned after that, and optional_header_inconsistent_size after that
malx-labs
committed
Import rva_invalid rva=0 and size=0 is now not treated as an anomaly (i.e. not part of heuristics) as this is valid under PE rules
malx-labs
committed
import_rva_invalid now taken care of by data_directory_out_of_range and related rva graph checks - altered contract test expected output to match this refactor
malx-labs
committed

Commits on May 5, 2026

Commits on May 6, 2026

Commits on May 7, 2026

Rewrite the TLS structural validator with full loader-accurate semantics: multiple tls directory support, range sanity checks, detection of missing callbacks, section-aware callback mapping
malx-labs
committed

Commits on May 8, 2026

Commits on May 10, 2026