Renef v0.3.6

New: AI-Powered Script Generation (`ai` command)

Integrated LLM-based script generation with multi-provider support and agentic tool calling.

Providers: Ollama (local, default), OpenAI (gpt-4o), Anthropic (claude-sonnet-4-20250514)
Auto-detection: Set OPENAI_API_KEY or ANTHROPIC_API_KEY env var and provider is selected automatically
Tool calling: AI can execute Renef commands on the target (Module.list(), Module.exports(), etc.) to gather context before generating scripts
File references: Use @path in prompts to inline file contents (e.g. ai hook encrypt in @CryptoManager.java)
System prompt: Loaded from RENEF_AI_PROMPT.md — full Renef Lua API reference with 7 working examples, editable without rebuild
HTTPS: OpenAI/Anthropic via curl, Ollama via raw socket

# Ollama (local, free)
renef> ai bypass root detection

# OpenAI
OPENAI_API_KEY=sk-... renef> ai hook findLibrary in @Loader.java

# Anthropic
ANTHROPIC_API_KEY=sk-ant-... renef> ai trace all crypto calls

Configuration (env vars):

Variable	Description	Default
`RENEF_AI_PROVIDER`	Force provider (`ollama`, `openai`, `anthropic`)	Auto-detect
`OLLAMA_HOST`	Ollama server address	`127.0.0.1`
`OLLAMA_PORT`	Ollama server port	`11434`
`OLLAMA_MODEL`	Model name	`llama3.1` / `gpt-4o` / `claude-sonnet-4-20250514`
`OPENAI_API_KEY`	OpenAI API key	-
`ANTHROPIC_API_KEY`	Anthropic API key	-
`RENEF_AI_PROMPT`	Custom system prompt file path	`RENEF_AI_PROMPT.md`

New: Spawn Gate (`--pause`)

New --pause flag for spawn mode that freezes the target process after injection, ensuring hooks are installed before any application code (such as root detection in onCreate) executes.

renef -s com.example.app -l bypass.lua --pause

Process is SIGSTOP‘d immediately after agent connection is established
Script data is written to the kernel socket buffer while the process is frozen
SIGCONT is sent after the script is buffered — agent installs hooks (microseconds) before the main thread reaches onCreate (milliseconds)
Without -l, the process stays paused until the user types resume or loads a script with l <file>
No ptrace, no /proc trace, no SELinux audit — undetectable
New resume command for manual control

New: OS API

New OS global API providing basic operating system utilities from Lua scripts.

OS.getpid() — Returns the current process ID
OS.kill(pid, sig) — Sends a signal to a process
OS.tgkill(tgid, tid, sig) — Sends a signal to a specific thread via syscall
OS.listdir(path) — Lists directory contents as a table

Improved: Stealth Hooking via `/proc/self/mem`

Native hook engine (both GOT/PLT and trampoline) now writes to memory via pwrite() on /proc/self/mem instead of using mprotect.

SELinux/seccomp bypass: Hooks work even when mprotect(..., PROT_WRITE|PROT_EXEC) is blocked
W^X compliance: Memory is written without changing page permissions
Anti-tamper stealth: No permission changes visible in /proc/self/maps
Falls back to mprotect automatically if /proc/self/mem is unavailable

Improved: Connection Liveness Probe

ServerConnection::is_connected() now performs a real liveness check using recv(MSG_PEEK | MSG_DONTWAIT) instead of just checking whether the file descriptor is valid. Correctly detects when the peer has closed the connection.

Improved: Auto-Reconnect on Send Failure

SocketHelper::send_data() now automatically recovers from broken connections. On send failure it:

Closes and re-establishes the connection to the same PID
Re-authenticates the session (con <key>)
Retries the send once

Updated: Python Binding (v0.3.6)

New wrappers: OS, File, Syscall, KCov APIs added as convenience classes over session.eval()
New: watch_start(callback) / watch_stop() for real-time hook output streaming
Fix: basic.py example used non-existent session.module_find() — corrected to session.Module.find()
Exports: Memory, Module, Thread, OS, File, Syscall, KCov now exported from __init__.py
Tests: 54 unit tests added (bindings/python/tests/test_api.py)