VirusTotal / yara-x

A rewrite of YARA in Rust.
https://virustotal.github.io/yara-x/
BSD 3-Clause "New" or "Revised" License
565 stars 46 forks source link

feat: implement array entitlement parsing for complete entitlements on mach-o #116

Closed latonis closed 1 month ago

latonis commented 1 month ago

previously we were only parsing the parent level entitlement names requested, we now parse the array descendants as well if present. This sets us up to do entitlement hashing as well for detection opportunities.