Bug fixes

Author: elementmerc

Cargo.lock

@@ -4,7 +4,7 @@ resolver = "2"
 
 [package]
 name = "anya-security-core"
-version = "2.0.2"
+version = "2.0.3"
 edition = "2024"
 rust-version = "1.85"
 authors = ["Daniel Iwugo <daniel@themalwarefiles.com>"]

Cargo.toml

@@ -37,7 +37,7 @@ Anya analyses files without executing them. Drop a PE, ELF, Mach-O, PDF, Office
 
 | Platform | GUI | CLI |
 |---|---|---|
-| **Windows** | `.msi` installer | `.zip` |
+| **Windows** | `.exe` installer (NSIS) | `.zip` |
 | **macOS** | `.dmg` (Intel + Apple Silicon) | Universal binary (`.tar.gz`) |
 | **Linux** | `.AppImage` / `.deb` / `.rpm` | Static musl binary (`.tar.gz`) |
 
@@ -75,25 +75,21 @@ Full flag reference: `anya --help`
 
 ## GUI
 
-Launch Anya, drag a file or folder onto the drop zone — or use the **+** button for single file, batch analysis, or file comparison.
+Drag a file or folder onto the window, or use the **+** button.
 
-| Tab | What it shows |
-|---|---|
-| Overview | Risk score ring, file metadata, hashes, KSD match, forensic fragment |
-| Entropy | Section entropy chart, byte histogram, distribution flatness analysis |
-| Imports | DLL tree with expandable function lists and inline explanations |
-| Sections | Section permissions, per-section entropy, characteristics |
-| Strings | Extracted strings with IOC extraction, classification, and filtering |
-| Security | ASLR, DEP, Authenticode, overlay, debug artifacts, toolchain detection, certificate reputation |
-| Format | Format-specific analysis for JS, PowerShell, VBS, OLE, ZIP, HTML, XML, LNK, ISO, and more |
-| MITRE | Mapped ATT&CK techniques with tactic tagging and real-world attack examples |
-| Graph | IOC/Import evidence web (single file) or TLSH relationship graph (batch) with Obsidian-style interactions |
+- **Overview** — risk score, hashes, verdict, notes
+- **Entropy** — section chart, byte histogram, flatness
+- **Imports** — DLL tree with inline explanations
+- **Sections** — permissions, entropy, characteristics
+- **Strings** — extracted strings with IOC classification
+- **Security** — ASLR, DEP, Authenticode, toolchain, certificates
+- **Format** — deep analysis for 20+ file types
+- **MITRE** — mapped techniques with tactic grouping
+- **Graph** — evidence web (single file) or relationship graph (batch)
 
-**Batch Analysis** — drop a folder to scan all executables. Files appear in a searchable sidebar with colour-coded verdicts. The Graph tab shows an interactive relationship graph with TLSH similarity edges, cluster halos, and hover spotlight.
+**Batch mode:** drop a folder to scan everything. Searchable sidebar, interactive relationship graph.
 
-**Single-File Graph** — the Graph tab visualises DLLs, suspicious APIs, IOCs, and behavioural categories as an interconnected evidence web. Hover any node to spotlight its connections.
-
-**Teacher Mode** (toggle in Settings) surfaces contextual lessons as you navigate. Click any DLL, security card, IOC, or MITRE technique for beginner-friendly explanations with real-world examples.
+**Teacher Mode:** toggle in Settings for contextual explanations on every finding.
 
 ---
 
@@ -122,17 +118,17 @@ Anya's scoring engine is calibrated against real malware and benign samples. Eve
 ```mermaid
 xychart-beta
     title "Detection & False Positive Rate"
-    x-axis ["v1.0", "v1.1", "v1.2", "v2.0"]
+    x-axis ["v1.0", "v1.1", "v1.2", "v2.0", "v2.0.3"]
     y-axis "%" 0 --> 100
-    line "Detection" [73.0, 82.0, 87.5, 99.9]
-    line "FP rate (x10)" [27.0, 15.0, 3.0, 1.0]
+    line "Detection" [73.0, 82.0, 87.5, 99.9, 99.9]
+    line "FP rate (x10)" [27.0, 15.0, 3.0, 1.0, 0.0]
 ```
 
 *FP rate scaled 10x for visibility on the same axis.*
 
 | Version | Malware | Benign | Total | Detection | FP Rate |
 |---|---|---|---|---|---|
-| **v2.0** | **~5,100** | **~5,300** | **~10,300** | **99.9%** | **0.1%** |
+| **v2.0.3** | **~9,100** | **~11,300** | **~21,700** | **99.9%** | **0.0%** |
 
 > **Verify independently:** `anya benchmark ./your-samples/ --ground-truth malware --json`
 

README.md

@@ -89,12 +89,9 @@ anya/
 │   └── lib/
 │       ├── db.ts                 # SQLite with versioned migration system
 │       └── tauri-bridge.ts       # Typed IPC wrappers (api_version aware)
-├── anya-stubs/                   # Stub crates (public repo)
-│   ├── scoring/                  # Scoring interface stubs
-│   └── data/                     # Data interface stubs
-└── anya-proprietary/             # Git submodule
-    ├── scoring/                  # Scoring crate
-    └── data/                     # Data crate
+└── anya-stubs/                   # Stub crates (public repo)
+    ├── scoring/                  # Scoring interface stubs
+    └── data/                     # Data interface stubs
 ```
 
 ---
@@ -207,6 +204,11 @@ invoke("get_ksd_neighborhood", { … })     →  { neighbors: KsdNeighbor[] }
 invoke("install_bundled_yara_rules")      →  copies rules from app resources
 invoke("is_first_run")                    →  "first_run" | "upgrade" | "current"
 invoke("complete_setup", { … })           →  writes version marker + installs YARA rules
+invoke("get_dll_explanations")            →  DLL descriptions JSON
+invoke("get_function_explanations")       →  API function descriptions JSON
+invoke("get_technique_explanations")      →  MITRE technique explanations JSON
+invoke("get_mitre_attack_data")           →  MITRE ATT&CK catalogue JSON
+invoke("get_category_explanations")       →  API category descriptions JSON
 ```
 
 ---
@@ -242,8 +244,10 @@ FileAnalysisResult
     ├── confidence::extract_signals() → SignalSet (80+ signals)
     │       │
     │       ▼
-    │   anya_scoring::score_signals() → weighted verdict + findings
+    │   score_signals() → weighted verdict + findings
     │
+    ├── Known sample lookup (tools, test files, known clean binaries)
+    ├── Family annotation lookup (malware family context)
     ├── KSD lookup (TLSH similarity to known malware)
     ├── Forensic fragment annotation (sub-100B files)
     │
@@ -306,7 +310,7 @@ AnalysisResult (schema_version: "2.0.0")
 | `react`, `react-dom` | UI framework |
 | `@tauri-apps/api`, `plugin-sql`, `plugin-dialog`, `plugin-fs` | Tauri IPC |
 | `force-graph` | 2D force-directed graph (canvas, d3-force) |
-| `recharts` | Charts (entropy, donut) |
+| `recharts` | Charts (entropy) |
 | `radix-ui` | UI primitives |
 | `tailwindcss` | Utility CSS |
 | `lucide-react` | Icons |
@@ -317,14 +321,14 @@ AnalysisResult (schema_version: "2.0.0")
 
 | Suite | Count | Runner |
 |---|---|---|
-| Rust unit tests | 263 | `cargo test -p anya-security-core` |
+| Rust unit tests | 23 | `cargo test -p anya-security-core` |
 | Frontend tests | 46 | `npx vitest run` |
-| Integration tests | 298 | `private/scripts/integration_test.sh` |
-| **Total** | **607** | |
+| Integration tests | 304 | `scripts/integration_test.sh` |
+| **Total** | **373** | |
 
 Integration tests cover: CLI flags, edge cases (unicode paths, malformed input, 1-byte files, all-zeros, random data), format parsers, report generation (HTML/PDF/Markdown), batch analysis, case management, YARA engine, schema versioning, and output invariants.
 
 ---
 
-**Last updated:** 2026-03-30 (v2.0.0-beta)
+**Last updated:** 2026-04-03 (v2.0.3)
 **Maintainer:** Daniel Iwugo — daniel@themalwarefiles.com

docs/ARCHITECTURE.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [2.0.3] - 2026-04-03
+
+### Detection
+- Calibrated against 21,700 samples: 99.9% detection, 0.0% false positives
+- Known sample verdicts for security tools, development utilities, and test files
+- Malware family context with descriptions and aliases for 50+ families
+
+### GUI
+- Notes section on Overview tab for known sample and fragment annotations
+- Teacher Mode guidance for Graph tab with interactive node explanations
+- Threat path highlighting in batch graph (click to trace connected clusters)
+- Expanded DLL and API category explanations in Teacher Mode
+
+### CLI
+- Coloured verdict output for TOOL, PUP, and TEST classifications
+- Known sample and family context annotations in analysis output
+
+### Other
+- Bug fixes and improvements
+
 ## [2.0.2] - 2026-04-01
 
 ### Detection

docs/CHANGELOG.md

@@ -1,7 +1,7 @@
 {
   "name": "anya",
   "private": true,
-  "version": "2.0.2",
+  "version": "2.0.3",
   "type": "module",
   "scripts": {
     "dev": "vite",

package.json

@@ -1,6 +1,6 @@
 [package]
 name = "anya-gui"
-version = "2.0.2"
+version = "2.0.3"
 edition = "2021"
 description = "Anya — PE malware analysis desktop app (Tauri GUI)"
 

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 {
   "productName": "Anya",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "identifier": "com.anya.app",
   "build": {
     "frontendDist": "../dist",

src-tauri/tauri.conf.json

@@ -1,7 +1,12 @@
-import { describe, it, expect, vi } from "vitest";
+import { describe, it, expect, vi, beforeAll, afterAll } from "vitest";
 import { render, screen, fireEvent } from "@testing-library/react";
 import { TeacherModeContext, type TeacherModeContextValue } from "../../ui/hooks/useTeacherMode";
 import MitreTab from "../../ui/components/tabs/MitreTab";
+
+// Suppress expected console.warn from MitreTab when MITRE data isn't loaded via IPC in test env
+const originalWarn = console.warn;
+beforeAll(() => { console.warn = (...args: unknown[]) => { if (typeof args[0] === "string" && args[0].includes("[MitreTab]")) return; originalWarn(...args); }; });
+afterAll(() => { console.warn = originalWarn; });
 import type { AnalysisResult } from "../../ui/types/analysis";
 
 const teacherCtx: TeacherModeContextValue = {

src/__tests__/mitre-tab.test.tsx

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, fireEvent } from "@testing-library/react";
+import { render, screen, fireEvent, act } from "@testing-library/react";
 import { TeacherModeContext, type TeacherModeContextValue } from "../../ui/hooks/useTeacherMode";
 import SettingsModal from "../../ui/components/SettingsModal";
 
@@ -28,7 +28,7 @@ const defaultProps = {
   onClose: vi.fn(),
 };
 
-function renderSettingsModal(
+async function renderSettingsModal(
   contextOverrides: Partial<TeacherModeContextValue> = {},
   propOverrides: Partial<typeof defaultProps> = {}
 ) {
@@ -41,51 +41,50 @@ function renderSettingsModal(
     ...contextOverrides,
   };
   const props = { ...defaultProps, ...propOverrides };
-  return render(
-    <TeacherModeContext.Provider value={contextValue}>
-      <SettingsModal {...props} />
-    </TeacherModeContext.Provider>
-  );
+  let result: ReturnType<typeof render>;
+  await act(async () => {
+    result = render(
+      <TeacherModeContext.Provider value={contextValue}>
+        <SettingsModal {...props} />
+      </TeacherModeContext.Provider>
+    );
+  });
+  return result!;
 }
 
 describe("SettingsModal toggles", () => {
   beforeEach(() => {
     vi.clearAllMocks();
   });
 
-  it("renders the Bible Verses label", () => {
-    renderSettingsModal();
+  it("renders the Bible Verses label", async () => {
+    await renderSettingsModal();
     expect(screen.getByText("Bible Verses")).toBeInTheDocument();
   });
 
-  it("renders the Teacher Mode label", () => {
-    renderSettingsModal();
+  it("renders the Teacher Mode label", async () => {
+    await renderSettingsModal();
     expect(screen.getByText("Teacher Mode")).toBeInTheDocument();
   });
 
-  it("Teacher Mode toggle reflects context enabled state via aria-checked", () => {
-    renderSettingsModal({ enabled: true });
+  it("Teacher Mode toggle reflects context enabled state via aria-checked", async () => {
+    await renderSettingsModal({ enabled: true });
     const toggles = screen.getAllByRole("switch");
-    const teacherToggle = toggles.find(
-      (btn) => btn.getAttribute("aria-checked") !== null
-    );
-    // The Teacher Mode toggle is the first switch; aria-checked should match context
     expect(toggles[0].getAttribute("aria-checked")).toBe("true");
   });
 
-  it("Bible Verses toggle reflects bibleVersesEnabled prop via aria-checked", () => {
-    renderSettingsModal({}, { bibleVersesEnabled: false });
+  it("Bible Verses toggle reflects bibleVersesEnabled prop via aria-checked", async () => {
+    await renderSettingsModal({}, { bibleVersesEnabled: false });
     const toggles = screen.getAllByRole("switch");
-    // Bible Verses is the second switch in the Learning section
     const bibleToggle = toggles[1];
     expect(bibleToggle.getAttribute("aria-checked")).toBe("false");
   });
 
-  it("clicking the Bible Verses toggle calls onSetBibleVerses", () => {
+  it("clicking the Bible Verses toggle calls onSetBibleVerses", async () => {
     const onSetBibleVerses = vi.fn();
-    renderSettingsModal({}, { bibleVersesEnabled: true, onSetBibleVerses });
+    await renderSettingsModal({}, { bibleVersesEnabled: true, onSetBibleVerses });
     const toggles = screen.getAllByRole("switch");
-    fireEvent.click(toggles[1]);
+    await act(async () => { fireEvent.click(toggles[1]); });
     expect(onSetBibleVerses).toHaveBeenCalledWith(false);
   });
 });