Acidcat

Latest version: v0.59.0

Safety actively analyzes 971914 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 13

0.59.0

Added

- **Amiga music-format walkers** (`core/walk/amiga.py`), from the acidcat-cassie
corpus: **SMUS** (IFF `FORM/SMUS`, the Sonix score and Deluxe Music
Construction Set save format -- SHDR tempo/volume/tracks, NAME, INS1
instruments, TRAK tracks); **Oktalyzer** (`OKTASONG` -- CMOD channel-split
giving 4-8 voices, the SAMP sample table); and recognize-plus-header for
**MED/OctaMED** (`MMD0`-`MMD3`) and **Future Composer** (`SMOD`/`FC14`). All
magic-sniffed, never-raise; field-tested on 29 corpus specimens (0 crashes).
The magic-less 15-instrument Ultimate Soundtracker (`mod15`) is intentionally
not sniffed (it would require guessing).

0.58.0

Added

- **IFF 8SVX walker** (`core/walk/svx.py`) -- the Amiga 8-bit sampled-voice
format, a direct big-endian ancestor of RIFF/WAVE. Decodes the `VHDR` voice
header (rate, octave count, raw vs Fibonacci-delta compression, 16.16 volume),
the `NAME`/`AUTH`/`ANNO`/`(c) ` text set (`ANNO` is the Amiga-side `ISFT`
authoring-tool tell), `ATAK`/`RLSE` envelopes, `CHAN`, and `BODY` with derived
duration; flags the FORM-size undercount writer bug. Field-tested on 492 real
Amiga specimens (0 crashes). Plus a mirrored 8SVX anatomy datasheet in
`docs/formats/`.
- `clm ` chunk recognized as **Xfer Serum** wavetable export (corpus-confirmed
against 43 files, all wavetables, none carrying an `acid` chunk -- correcting
the old "Sonic Foundry" web lore). Format tag **0x0039** named Roland RDAC
(RFC 2361), noting mmreg.h's unregistered Crystal IMA ADPCM squat at the same
value.

0.57.0

Added

- **`acidcat census`** -- a scaled-up, read-only chunk-ID histogram and
open-question survey over a corpus of RIFF-family files (containers, format
tags, LIST types, fact sizes, bext versions, and flags for the rare/
undocumented chunks). Engineered for millions of files: an explicit-stack
`os.scandir` traversal that never stats a file it will not open (extension +
`d_type` off the dirent), is loop-safe and boundary-aware (unconditional
`(st_dev, st_ino)` directory dedup catches symlink loops and same-device bind
mounts; autofs mountpoints read from the mount table, never probed; optional
`--one-file-system`), positioned `pread` reads of chunk headers only (no audio
payload), with `posix_fadvise` readahead suppression + `DONTNEED` so a scan
does not evict the page cache, and an SSD/HDD-aware reader thread pool. Fixes
two bugs carried by the prototype: the bext version was read at payload offset
602 instead of 346, and non-printable FOURCCs from corrupt files were emitted
raw (now grouped as `hex:` tokens so the JSON stays well-formed). RF64/BW64
data-chunk sizes are resolved from the `ds64` chunk, so the walk reaches
trailing chunks past the `0xFFFFFFFF` sentinel instead of stopping at `data`.

0.56.1

Fixed

- **Kurzweil `.KRZ` keymap sample references.** The keymap decoder assumed the
modern 5-byte entry layout (method `0x13`: tuning, sampleID, subSample) and
always read the referenced sampleID at entry offset +2. Real Sweetwater
soundset banks use method `0x03`: a 3-byte entry with no tuning prefix, so the
sampleID sits at offset 0 and was misread (e.g. sample 200 reported as 256).
The decoder now locates the sampleID after the optional 2-byte tuning prefix,
keyed on the method `0x10` bit, with a bounds-guarded read; `entry_size`
remains the authoritative stride. Correct for every no-tuning method
(`0x01`-`0x0f`); tuning methods (`0x11`-`0x19`) unchanged. Swept the Sweetwater
corpus (0 crashes); verified against real banks (e3_bass -> sample 200,
angkorw -> 201/203/204).

Docs

- Added the Kurzweil `.KRZ` anatomy datasheet (`docs/formats/krz-anatomy.html`):
a 7-tab interactive byte map (PRAM header, object framing, Sample, Keymap,
Program, SROM) built from real specimen bytes. Homogenized the anatomy fleet
onto one canonical renderer and added the color-key legend to the emu and mpc
sheets.

0.56.0

Docs

- Regenerated `docs/codebase_explorer.html` (was a v0.9.0 fossil): reframed from a
WAV metadata explorer to the current byte-level dissection / reverse-engineering
tool, updated to 23 CLI verbs, 26 walkers, the dissection surface
(inspect/probe/carve/shape + the repair/validate/audit constraint model), the
grammar engine, and provenance -- in the locked amp-orange aesthetic with the
hover margin cards.

Changed

- Provenance writer signatures now live in a sidecar data file
(`core/data/provenance_signatures.json`) instead of being hardcoded in
`provenance.py` -- signatures are data, editable without touching code. A user
override at `~/.acidcat/provenance_signatures.json` is merged on top (its
`canon` rules win first-match, its `chunk_signatures` are appended), so
signatures can be added with no code change or re-release.

Added

- New WAV writer signatures, validated against a 807,394-file corpus census:
`strc`/`str2`/`SyLp` (Sony/Magix ACID / Sound Forge), `SNDM` (Soundminer),
`LGBM` (Logic, folded in with LGWV/ResU), `DIGI` (Digidesign, with DGDA),
`RLND` (Roland), `Cr8r` (GoPro CineForm / Adobe). `_PMX` (Adobe XMP) is
recorded as a deliberately-shared, corroborate-only tell, not a standalone
attribution.
- ffmpeg RF64_AUTO structural fingerprint: a 28-byte `JUNK` chunk immediately
after `fmt ` (the ds64 placeholder) is detected positionally and attributed to
FFmpeg/libav at "likely" confidence.

0.55.1

Fixed

- `acidcat info` (and bare-path `acidcat file.ext`) no longer mis-parses a
non-WAV structural format as a headerless WAV (the misleading "Chunks (none)"
output). Any format the walkers decode but `info` has no dedicated builder for
-- Kurzweil `.KRZ`, E-mu, Akai, ReCycle, VST FXP, trackers, SF2, the MPC
family, synth presets, RF64, ... -- now gets a walker-backed summary (format
label, top-level summary, region count) and a pointer to `acidcat inspect` for
the full decode. Previously only a hardcoded preset list was handled.

Changed

- Package description aligned with the project's direction: "Binary analysis and
reverse-engineering for audio file formats and music-production hardware".

Page 1 of 13

© 2026 Safety CLI Cybersecurity Inc. All Rights Reserved.