sabia/CHANGELOG.md

# Changelog

**English** · [Português](CHANGELOG.pt-BR.md)

Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer.

## [1.0.2] - 2026-10-30

### Fixed
- The desktop app build on CI looked for its bundle under `target/`, but the
  runner's Cargo target directory is elsewhere and persists between runs; the
  Linux and Windows jobs failed before publishing anything. `v1.0.1`'s desktop
  app was never published for this reason — use `v1.0.2`.

## [1.0.1] - 2026-10-30

The project moved from GitHub to Gitea, and the update check followed it.

### Changed
- **Updates now come from Gitea.** `sabia update` and the desktop app's "Update now"
  read the latest release from `git.lucasrguerra.dev.br` instead of the GitHub API.
  Versions up to 1.0.0 still look at GitHub, which is no longer reachable, so they
  cannot find this release: download 1.0.1 once, and later updates are automatic.
- Release packages: the CLI for Linux x86_64 and aarch64 (built by the Gitea CI when
  a `v*` tag is pushed, with a `.sha256` next to each package), and the desktop app
  for Linux (`.AppImage`, `.deb`) and Windows (NSIS `.exe` installer, cross-compiled
  from Linux by `scripts/build-gui.sh`). **There is no Windows CLI and no macOS build
  any more**: the CLI is Linux-only, and macOS needs Apple's SDK and code signing,
  which this project's CI cannot provide.

### Fixed
- `sabia update` refuses to run from the desktop app's executable (`sabia-gui`).
  The release package contains the CLI, and replacing the app with it would have
  broken the app; the app now points to the downloads page instead.

## [1.0.0] - 2026-10-24

First stable release: real-hardware validation across the whole attack surface, a much more complete cracking pipeline, two new attacks (WPS, Evil Twin), a redesigned report, and several reliability fixes found only by testing against live Wi-Fi networks.

### Added
- **Cracking:** default dictionary replaced by a 9.7M-password list (rockyou +
  Probable-Wordlists, deduplicated, gzip-embedded); hashcat-style **mutation
  rules** (uppercase, numeric/symbol suffixes, simple leet); **mask brute
  force** (`?d?l?u?s?a` syntax); **`.hc22000` export** (single or batch) to
  hand a handshake to hashcat/John.
- **WPS attack:** PIN/Pixie Dust via a bundled `reaver` (extracted at
  runtime), or `bully` when installed on the system.
- **Evil Twin:** clones an already-seen AP (open SSID) on a second interface
  with a captive portal, for WPA/WPA2-PSK — the submitted password is only
  accepted after being verified against the real captured handshake, never
  "accepts anything". An **Enterprise (802.1X/EAP)** variant captures
  credentials automatically via `hostapd-wpe`, no portal or human action
  needed, since the credential travels in the EAP handshake itself.
- **CCMP traffic decryption** for a client once its handshake's password is
  known (Temporal Key derived from the cracked PMK).
- **Channel-interference scoring** per band and **security findings** (open
  network, missing PMF, WPS exposed, possible evil twin by duplicate SSID).
- **Redesigned audit report:** full-page cover with embedded logo, table of
  contents, running header/footer via `@page` margin boxes (current
  section, page numbers), KPI and findings cards with severity colors —
  still paginated by Paged.js in the browser, printable to PDF.
- `ScanSnapshot.warning`: tells you when a capture has been running for a
  while without receiving a single frame — a card that accepts turning
  monitor mode on without actually delivering capture (common with
  built-in laptop Wi-Fi) now says so, instead of silently "listening".

### Fixed
- **Handshake capture never completed on real networks:** `eapol.rs` read
  `key_info`/`replay_counter`/`key_data_len` as little-endian; those
  802.1X fields are big-endian. Deauth worked, EAPOL frames were seen, but
  `HandshakeTracker` silently discarded every one — 0 handshakes no matter
  how much traffic was generated. The project's own synthetic test frames
  made the same mistake symmetrically, so round-trip tests never caught
  it; verified live against a real AP after the fix.
- **Monitor mode fighting NetworkManager:** `set_monitor()` now releases
  the interface from NetworkManager before switching modes and returns it
  afterward — without this, NM reasserted its own connection within
  seconds and capture died with "is in managed mode".
- **Evil Twin left the system half-configured if the process died mid-run**
  (Ctrl+C, `kill -9`, power loss): both interfaces stuck `managed=no`
  forever, Wi-Fi gone from the system panel. A state file plus a
  self-healing pass on every engine start now undoes this automatically;
  `sabia ui` also handles SIGINT gracefully.
- **Repeated deauth/disassoc frames were dropped as duplicates** after the
  first send — the same Sequence Control was reused on every injection;
  now increments per frame.
- **Network list reordered under the cursor** during capture, as signal-based
  sorting reacted to every 1-2 dBm fluctuation; order is now stable
  (arrival order, signal rounded to 4 dBm buckets).
- **"Force handshake" failed if capture had been stopped:** it now resumes
  capture automatically and waits for the target to reappear with a known
  channel before starting the job, instead of locking onto whatever
  channel the scanner happened to be hopping through.
- **Attacks tab layout left large empty gaps** when two cards of very
  different heights shared a grid row; switched to a masonry-style column
  layout.

### Changed
- `crack_reader`/`crack_mask` parallelize across available cores and reuse
  the HMAC base per iteration instead of reconstructing it — roughly 640x
  faster in release builds versus the original debug/single-thread path.

## [0.1.0] - 2026-10-23

First release: CLI, desktop app and shared core.

### Added
- `sabia-core`: Wi-Fi interface discovery, **monitor mode** and channel control
  (via netlink/`iw`), **scanning** of 2.4, 5 and 6 GHz, raw 802.11 frame capture
  via **AF_PACKET** (no libpcap), **radiotap** and management-frame parsing
  (beacon, probe, EAPOL), aggregation of APs and clients, capture of the
  **4-way handshake** and **PMKID**, **offline dictionary cracking**
  (PBKDF2-HMAC-SHA1, MIC and PMKID) for WPA/WPA2-PSK, `.pcap` read and write,
  frame injection, a local hash-chained **audit trail**, and **self-update**
  from GitHub releases.
- `sabia`: CLI with `iface` (list/channels/monitor), `scan`, `analyze`, `crack`,
  `deauth` (with `--yes`), `doctor`, `audit` (verify/show), `update` and `ui`
  (local interface server).
- Desktop app (Tauri) with the same interface served by `sabia ui`, elevating to
  administrator automatically on startup — monitor mode and raw capture require
  root/admin.
- Interface: interface sidebar, capture panel with an animated signal line,
  networks table with signal bars and color-coded security badges, an
  **authorized-use** notice, a one-click **update** button, Auto/Light/Dark
  themes and **Portuguese and English** language.
- CI with caches (`rust-cache`, cached Tauri `.deb`) and a cross-platform release
  pipeline (CLI on 5 targets and desktop app via `tauri-action`).