v2.0.0

Breaking changes:

• malduck.hex was renamed to malduck.enhex due to collision with built-in hex
• Removed malduck cuckoomem.list command from CLI tool

New features:

• Yara-based engine for static configuration extractors (malduck.extractor, currently should be considered "beta" - more information will be published soon)
• Wrapper for yara-python (malduck.yara) + support for Yara search in ProcessMemory objects (procmem.yarav)
• Basic support for ELF format (malduck.procmemelf)
• Removed closed source native modules (originated from roach)
• Added pure-Python aplib module
• Many small improvements

Fixes:

• Fix for "aplib decompress with empty buffer hangs forever"
• More robust procmempe._load_image and procmempe.store implementation
• Restructured and improved documentation readability