Scopr Change History
====================

XBow SDK
--------
5.0.1309  Added Bitcoin address extraction support to XAPI.
5.0.1301  Added XBOW_TYPE_RPMSG, associated Restricted Permission Message (RPMSG) file type identification and
          extraction engine.  Note: Auto-decrypt of the DRMContent stream is not supported.
5.0.1291  Added XBOW_TYPE_SYLK and associated Microsoft Symbolic Link (SYLK) file type identification.
5.0.1274  Added ALZip auto-decrypt support.
5.0.1270  Added XBOW_SUBTYPE_FPX and associated OLE2 object subtype identification for the Kodak FlashPix file format.
5.0.1244  Added Quick Response (QR) code extraction engine.
5.0.1235  Added XAPI configuration options:
          * MaxExtractTotalSize
          * MaxTotalItems
5.0.1233  Added XBOW_TYPE_PYC and Python bytecode file type identification.
5.0.1228  Added XAPI configuration options:
          * GDPRCompliantMetadata
          * OLESSParallelDecryptedPackage
5.0.1216  Added Direct Access Archive (DAA) extraction engine.
5.0.1212  Added XBOW_TYPE_DAA and Direct Access Archive file type identification.
5.0.1199  Added decode and extract of JavaScript string arrays via Text Extract Hex option.
5.0.1197  Added RTF metadata and URL extraction.
5.0.1192  Fixed XRay's reported processing elapsed time.
5.0.1177  Improved RTF hex data extraction.
5.0.1173  Added xbowddd.cgi query string parameters documentation page.
5.0.1169  Added extraction of base64-encoded objects out of window.atob("<base64>") JavaScript code.
          Added extraction of <script> blocks out of HTML.
5.0.1161  Added normalizedname and datatypeextension to JSON and XML output.
5.0.1159  Always append the file-type-correct extension to the end of the random filename link.
          This guarantees that all returned URL links to the extracted data use the file-type-correct extension.
          Thus applications that use these URLs to download extracted files can depend on the extension in their
          decision-making.
5.0.1156  Added per-user enable/disable URL processing option to XRay.
          Can only be changed by an XRay administrator.
5.0.1141  Added PDF and JPG links to XRay JSON output.
5.0.1135  Fixed XRay per-user key handling.
5.0.1122  Added XRay server log display pages - for administrators only.
5.0.1110  Improved XRay user interface.  Removed use of HTML frames.
5.0.1106  Duplicated all XRay local file processing options on URL processing page.
5.0.1103  Added heuristic detection of malicious sequences of periods before the file extension.
5.0.1073  Added XRay xbowddd.ini max log size options:
          * MaxLogSize
          * MaxXAPILogSize
5.0.1068  Added excludedurllist.txt and onetimeuseurlkeywordslist.txt to XRay configuration.
          Added EnableVirusTotalURL XRay configuration option.
5.0.1065  Added ClamAV scan of all processed objects to XRay.
5.0.1050  Added XRay metadata extraction options for email addresses, IPv4 addresses, phone numbers, credit card
          numbers, and URLs.
5.0.1039  Added subsystem to EXE/DLL object details.
5.0.1010  Decode and extract HTML entities in Microsoft Office online video embeddedHTML objects.
5.0.1007  Added XBOW_TYPE_AU3 and AutoIt3 file type identification.
5.0.1006  Removed non-Windows x86 downloads from XRay.
5.0.1005  Added SHA-1 and SHA-256 hashes to XRay Show Activity page.
5.0.1004  Added XRay per-user option to show/hide unidentified data streams.
5.0.1003  Added xid -i option to report per-engine information: version, file type, engine name, module name,
          and license info.
          Auto-decrypt read-only Excel documents using Microsoft Excel's default password "VelvetSweatshop".
5.0.1002  Added APM, Intel Hex, PPMD, QCOW, VHD, VHDX, FreeARC, BH, PA, ZPAQ and FLV file type identification.
          Added FTP/HTTP URL processing XAPI configuration options:
          * MaxHTTPCacheSize
          * MaxFTPCacheSize
          * ConnectTimeout
          * ReceiveTimeout
          * SendTimeout
          * DataReceiveTimeout
          * DataSendTimeout
          * MaxFTPIndexMemorySize
          * MaxHTTPIndexMemorySize
          Added Intel Hex and VHD file extraction engines.
          Fixed CPIO binary file extraction.
5.0.1000  Added support for inline processing extracted URLs.
          Added XAPI options to control the maximum number of URLs processed per object and per object chain.
          Added button to clear user's HTTP/FTP cache.
          Added logic to prevent recursive URL processing loops.
          Added extraction of ftp:// and sftp:// URLs.
          Added username and password support for FTP URLs.
          Added link to VirusTotal graph in SHA-256 column.
5.0.998   Added xid option -m to scan all processed files with AntiMalware Cloud Scan.
          Extract all extractable OLESS streams up to the point where the FAT chain is invalid/broken rather than
		  aborting the entire extraction process.
          Added Depth column to HTML output.
          Added support for cloud scan URL options in XRay xbowddd.ini:
          * AntiMalwareCloudScanURL1
          * AntiMalwareCloudScanURL2
          Added .vba as an allowed extension for XBOW_TYPE_VBSCRIPT.
5.0.997   Improved extraction of hex objects from RTF files.
          Improved URL extraction.
          Added option to show/hide extracted URLs in HTML view.
          Added PDF details.
          Added extraction of embedded images from PDF files.
5.0.996   Added URL extraction from TEXT, HTML, MIME bodies, and some XML files.
          Improved how encryption keys are shown in object details.
          Minimum length of automatically discovered encryption keys reduced from 4 to 3 characters.
          Upgraded liblzma and XZUtils to 5.2.3.
5.0.995   Added file type identification:
          * Microsoft InternetShortcut .url with associated target URL extracted as a detail.
5.0.992   Improved ISO-14496 file type identification.
          Improved base64 extraction.
          Improved hex extraction.
          Fixed ZIP AES-encrypted+stored file extraction.
          Upgraded 7zip engine to LZMA SDK 18.01.
5.0.990   Added file type identification:
          * DDS
          * INDD
          * MOV/QT
          * OLESS:MPP
          * VCF
          * OLESS:VSD
          * ZIP:VSDX
5.0.980   Added file type identification:
          * Mach-O
          * Mach-O Universal Binary
          * BALZ
          * EGG
          * ISZ
          * LZ4X
          * PEA
          * ZPAQ
          * ZIP:HWP
          * ZIP:IPA
          * ZIP:XPS
          Improved UUE and XXE extraction engines.
5.0.950   Added extraction of VBA scripts from OLESS documents.
5.0.910   Added "Show Activity" button on XRay "My Account" page.  Shows statistics for all files processed
          by your user account.
5.0.900   Added file type identification for:
          * ARM Image Format (.aif)
          * AutoCAD Drawing Exchange Format (.dxf)
          * Audio Interchange File Format (.aiff)
          * Audio Interchange File Format - Compressed (.aifc)
          * Packet Capture (.pcap)
          * True Type Font (.ttf)
          Added Content-Transfer-Encoding to extracted MIME object's details as "encoding".
5.0.800   Microsoft Icon/Cursor (.ico/.cur) file type identification and extraction engine.
5.0.700   Added file type identification for:
          * AxCrypt (.axx)
          * Digital Imaging and Communications in Medicine (.dcm)
          * iCalendar (.ics)
          * vCalendar (.vcs)
          * TIFF (.tif)
          * AutoCAD Drawing (.dwg)
          Added file sub-type identification for ZIP-based PowerPoint, Excel, and Word file formats
		  (e.g. .pptx, .xlsx, .docx).
          Added file sub-type identification for Java Archives (.jar).
          Text engine extracts hex-encoded sequences of 32 bytes or more (e.g. "090AF0FF...").
          Text engine extracts Base64-encoded embedded objects out of HTML.
5.0.610   Added Nested Container Extensions (NCE) path to object details.
          Added support for displaying UTF-8 object names.
          Added option to show the encryption key/password for encrypted objects.
          Infected objects are highlighted with a red background in the HTML view.
          Upgraded RAR engine to the unrar 5.5.7 source code level.
5.0.540   Added extraction of base64-encoded pkg:binaryData objects out of XML documents.
          Added two new XRay output formats:
          * JSON (JavaScript Object Notation)
          * HTML Zoomable Bubble Graph
5.0.530   Added LZip and LZMA file extraction engines.
5.0.520   Added PHP Archive (PHAR) file extraction engine.
5.0.510   Added ActiveMime, Snappy, WARC, XZ, XXE and ACE v2 file extraction engines.
          Added password-protected ACE and Microsoft Office document extraction.
          Added automatic decryption of password-protected mail attachments if the correct password is found
		  within the body of the mail message.
          New per-user options:
          * Extract text from Microsoft Word documents.
          * Extract text from PDF documents.
          * Redact sensitive information from MIME message header fields.
          * Redact the MIME message body.
          * Redact all MIME message attachments.
          Added embedded HTML img src base64 object extraction.
          Added Javascript file type identification
          Added Javascript, Python, VBScript, and Perl script extraction out of Windows Script File (WSF) XML documents.
5.0.371   Added ALZip, LHA, RTF, TNEF, and ISO 9660 CD/DVD image extraction.
          Added password-protected 7Zip extraction.