fixes

Author: xonoxitron

.github/workflows/ci.yml

@@ -4,16 +4,6 @@ on: [push, pull_request]
 
 jobs:
   test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-      - run: cargo build --release
-      - run: cargo test
-
-  build-cross:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -24,3 +14,4 @@ jobs:
         with:
           toolchain: stable
       - run: cargo build --release
+      - run: cargo test

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+
 jobs:
   build:
     name: Build ${{ matrix.target }}
@@ -20,6 +23,7 @@ jobs:
             target: aarch64-unknown-linux-gnu
             artifact_name: polymorph
             asset_name: polymorph-linux-arm64
+            use_cross: true
           - os: macos-latest
             target: x86_64-apple-darwin
             artifact_name: polymorph
@@ -42,11 +46,17 @@ jobs:
           target: ${{ matrix.target }}
           override: true
 
-      - name: Install cross-compilation tools
-        if: matrix.target == 'aarch64-unknown-linux-gnu'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
+      - name: Install cross
+        if: matrix.use_cross
+        run: cargo install cross --git https://github.com/cross-rs/cross
+      
+      - name: Build with cross
+        if: matrix.use_cross
+        run: cross build --release --target ${{ matrix.target }}
+      
+      - name: Build native
+        if: "!matrix.use_cross"
+        run: cargo build --release --target ${{ matrix.target }}
 
       - name: Build
         run: cargo build --release --target ${{ matrix.target }}

CHANGELOG.md

@@ -1,16 +1,6 @@
 # Changelog
 
 ## [1.1.0] - 2026-01-18
-
-### Added
-- APE polyglot detection
-- Zig malware detection
-- WASM cryptominer detection
+- APE, Zig, WASM detection
 - 19 YARA rules
-- Cross-platform support
-
-### Features
-- Fast scanning (~50ms per 10MB)
-- JSON output
-- Risk scoring
-- Verbose mode
+- Fast scanning

CONTRIBUTING.md

@@ -1,17 +1,6 @@
 # Contributing
 
-We welcome contributions!
-
-## Getting Started
-
 1. Fork the repo
-2. Create a feature branch
-3. Make your changes
-4. Add tests
-5. Submit a pull request
-
-## Code Style
-
-- Run `cargo fmt`
-- Run `cargo clippy`
-- Add documentation
+2. Create feature branch
+3. Add tests
+4. Submit PR

Cargo.toml

@@ -14,11 +14,10 @@ keywords = ["security", "malware", "polyglot", "detection", "wasm"]
 categories = ["command-line-utilities", "development-tools"]
 
 [dependencies]
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
 
 [dev-dependencies]
 tempfile = "3.8"
+criterion = "0.5"
 
 [profile.release]
 opt-level = 3
@@ -30,3 +29,15 @@ panic = "abort"
 [[bin]]
 name = "polymorph"
 path = "src/main.rs"
+
+[[bench]]
+name = "benchmark"
+harness = false
+
+[[example]]
+name = "basic_scan"
+path = "examples/basic_scan.rs"
+
+[[example]]
+name = "batch_scan"
+path = "examples/batch_scan.rs"

README.md

@@ -9,66 +9,35 @@
 [![Rust](https://img.shields.io/badge/rust-1.70%2B-orange.svg)](https://www.rust-lang.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Security](https://img.shields.io/badge/security-malware%20detection-red)](https://github.com/xonoxitron/polymorph)
-[![Build Status](https://github.com/xonoxitron/polymorph/workflows/CI/badge.svg)](https://github.com/xonoxitron/polymorph/actions)
 
-[Features](#-features) • [Quick Start](#-quick-start) • [Documentation](#-documentation) • [Contributing](#-contributing)
+[Features](#-features) • [Quick Start](#-quick-start) • [Examples](#-examples)
 
 </div>
 
 ---
 
 ## 🚨 The Polyglot Malware Problem
 
-The malware landscape is evolving. Attackers exploit **polyglot files** - binaries valid in multiple formats simultaneously - to evade detection systems that traditional antivirus cannot catch.
+Modern malware exploits **polyglot files** - binaries valid in multiple formats simultaneously - to evade traditional antivirus.
 
-### The Emerging Threats
+### The Threats
 
-**Actually Portable Executables (APE)**
-- Single binary runs natively on Windows, Linux, macOS, and BSD
-- Combines PE + ELF + Mach-O formats in one file
-- Perfect for cross-platform malware campaigns
+- **APE (Actually Portable Executable)**: Single binary runs on Windows/Linux/macOS/BSD
+- **Zig Malware**: Direct syscalls bypass EDR (Hell's Gate, Halo's Gate)
+- **WASM Cryptominers**: 75% of WASM modules are malicious (CrowdStrike, 2024)
 
-**Zig Malware**
-- Direct syscalls bypass EDR hooks (Hell's Gate, Halo's Gate)
-- Compile-time obfuscation defeats static analysis
-- Growing adoption in APT toolkits
+### Research Shows Defenses Fail
 
-**WebAssembly Cryptominers**
-- Near-native performance in browsers
-- Binary format evades string-based detection
-- **75% of WASM modules in the wild are malicious** (CrowdStrike, 2024)
+- **20/36 detectors** bypassed by polyglots (Jana & Shmatikov, 2012)
+- **90% evasion rate** against VirusTotal for WASM (Cabrera-Arteaga, 2024)
 
-### Research Proves Traditional Defenses Fail
-
-- **20 out of 36 malware detectors** bypassed by polyglot files (Jana & Shmatikov, 2012)
-- **4 leading commercial tools** missed 199 polyglot samples (Bridges et al., 2023)
-- **90% evasion rate** against VirusTotal for WASM (Cabrera-Arteaga et al., 2024)
-
-**No open-source production tool detects APE, Zig, AND WASM threats together.**
-
-**PolyMorph fills this gap.**
-
----
-
-## 🎯 What is PolyMorph?
-
-First open-source static analyzer for:
-
-✅ **Cosmopolitan APE** polyglot binaries  
-✅ **Zig-based malware** with EDR evasion  
-✅ **WebAssembly cryptominers**  
-✅ **Direct syscall patterns** (Hell's Gate, Halo's Gate)  
-✅ **Anti-debugging/anti-VM** mechanisms  
-✅ **Process injection** across platforms  
-
-Built in Rust for performance (~50ms per 10MB), safety, and portability.
+**No open-source tool detects APE + Zig + WASM together. PolyMorph fills this gap.**
 
 ---
 
 ## ⚡ Quick Start
 
 ```bash
-# Clone and build
 git clone https://github.com/xonoxitron/polymorph
 cd polymorph
 cargo build --release
@@ -77,66 +46,30 @@ cargo build --release
 ./target/release/polymorph suspicious.exe
 
 # JSON output
-./target/release/polymorph --json malware.com
+./target/release/polymorph --json malware.wasm
 ```
 
 ---
 
-## 📚 Documentation
-
-- [Quick Start Guide](docs/QUICKSTART.md)
-- [Architecture](docs/ARCHITECTURE.md)
-- [WASM Detection](docs/WASM_DETECTION.md)
-- [YARA Rules](rules/polymorph.yar)
-- [Contributing](CONTRIBUTING.md)
-
----
-
-## 💻 Usage Examples
+## 💻 Examples
 
-### Malware Analysis
-```bash
-polymorph /tmp/suspicious.exe | grep -E "CRITICAL|HIGH"
-```
-
-### CI/CD Integration
-```yaml
-- name: Scan artifacts
-  run: polymorph --json ./build/app.exe || exit 1
-```
-
-### SOC Automation
-```python
-import subprocess, json
-
-def scan(path):
-    result = subprocess.run(['polymorph', '--json', path], 
-                          capture_output=True, text=True)
-    return json.loads(result.stdout)
-
-report = scan('/quarantine/sample.com')
-if report['risk_score'] >= 80:
-    alert_soc_team(report)
-```
+See `examples/` directory:
+- `basic_scan.rs` - Simple file scanning
+- `batch_scan.rs` - Multiple file processing
 
 ---
 
-## 🔬 Comparison to Existing Tools
-
-| Tool | APE | Zig | WASM | Open Source | Production Ready |
-|------|-----|-----|------|-------------|------------------|
-| **PolyMorph** | ✅ | ✅ | ✅ | ✅ | ✅ |
-| MINOS | ❌ | ❌ | ⚠️ | ⚠️ | ❌ |
-| MinerRay | ❌ | ❌ | ✅ | ❌ | ❌ |
-| ClamAV | ❌ | ❌ | ❌ | ✅ | ✅ |
+## 📚 Documentation
 
-**PolyMorph: Only tool with APE+Zig+WASM detection in production-ready open-source package.**
+- [Quick Start](docs/QUICKSTART.md)
+- [Architecture](docs/ARCHITECTURE.md)
+- [WASM Detection](docs/WASM_DETECTION.md)
 
 ---
 
 ## 🤝 Contributing
 
-Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md).
+Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md)
 
 ---
 
@@ -146,14 +79,6 @@ MIT License - see [LICENSE](LICENSE)
 
 ---
 
-## 📧 Support
-
-- **Issues**: [GitHub Issues](https://github.com/xonoxitron/polymorph/issues)
-- **Discussions**: [GitHub Discussions](https://github.com/xonoxitron/polymorph/discussions)
-- **Security**: [SECURITY.md](SECURITY.md)
-
----
-
 <div align="center">
 
 Made with ❤️ by the security community

SECURITY.md

@@ -1,7 +1,3 @@
 # Security Policy
 
-## Reporting Vulnerabilities
-
-Email: security@polymorph-project.org
-
-Do not open public issues for security vulnerabilities.
+Report vulnerabilities via GitHub Security Advisories.

docs/ARCHITECTURE.md

@@ -1,28 +1,11 @@
 # Architecture
 
-## Overview
-
-PolyMorph uses static analysis to detect polyglot malware patterns.
-
 ## Components
-
-- **Scanner**: Orchestrates detection modules
-- **Detectors**: APE, Zig, WASM, evasion analysis
-- **Report**: Human and JSON output
-- **Utils**: Helper functions
-
-## Detection Flow
-
-1. Read binary file
-2. Run format-specific detectors
-3. Analyze evasion techniques
-4. Calculate risk score
-5. Generate report
+- **Scanner**: Orchestrates detection
+- **Detectors**: APE, Zig, WASM, evasion
+- **Report**: Human/JSON output
+- **Utils**: Formatting, hashing
 
 ## Risk Scoring
-
-```
-Risk = Σ(severity_points) + binary_type_bonus
-Severity: Low=5, Medium=15, High=25, Critical=40
-Binary bonus: Cosmopolitan=+10, Hybrid=+20
-```
+Risk = Σ(severity) + binary_type_bonus
+Max: 100

docs/QUICKSTART.md

@@ -1,38 +1,20 @@
-# Quick Start Guide
-
-## Installation
+# Quick Start
 
+## Build
 ```bash
-git clone https://github.com/xonoxitron/polymorph
-cd polymorph
 cargo build --release
 ```
 
-## Basic Usage
-
+## Scan
 ```bash
-# Scan a binary
 polymorph suspicious.exe
-
-# JSON output
-polymorph --json malware.com
-
-# Verbose with offsets
-polymorph -v --offsets binary.elf
+polymorph --json malware.wasm
 ```
 
-## Understanding Output
-
-- **0-40**: Low risk
-- **40-60**: Medium risk
-- **60-80**: High risk
-- **80-100**: Critical threat
-
 ## Exit Codes
-
-- `0`: Clean
-- `1`: Low
-- `2`: Medium
-- `3`: High
-- `4`: Critical
-- `5`: Error
+- 0: Clean
+- 1: Low (0-40)
+- 2: Medium (40-60)
+- 3: High (60-80)
+- 4: Critical (80+)
+- 5: Error