- Added thread context inspection (RIP/EIP register analysis)
- Detect threads executing from RWX memory regions
- Detect threads in unbacked/private memory
- Thread start address vs current IP divergence detection
- Suspended thread analysis
- Support for both x86 and x64 architectures
- Cross-platform stubs for Linux/macOS
Detects MITRE ATT&CK T1055.003 (Thread Execution Hijacking).
Generated with [Claude Code](https://claude.com/claude-code)
- Implemented comprehensive PE parsing utilities
- Added IAT (Import Address Table) parsing from memory and disk
- Implemented IAT hook detection by comparing memory vs disk
- Added data directory and import descriptor parsing
- Helper functions for reading PE structures
- Cross-platform compilation support with Windows-specific code
- Support for both 32-bit and 64-bit PE files
Generated with [Claude Code](https://claude.com/claude-code)
- Enhanced error handling with expanded GhostError variants and From impls
- Fixed race conditions in TUI (ui.rs unwrap calls)
- Added comprehensive module documentation with doc comments
- Improved type safety with proper validation in DetectionConfig
- Implemented Linux process enumeration via procfs
- Refactored TUI for better state management and removed emojis
- Enhanced CLI with proper logging initialization
- Added example configuration file (examples/ghost.toml)
- Updated README with complete feature documentation
- Added performance optimizations (saturating arithmetic, reduced clones)
- Improved testing framework with proper struct initialization
- Added validation and preset modes to DetectionConfig
