Pre-processing modules system

VirusTotal / yara-x

A rewrite of YARA in Rust.

https://virustotal.github.io/yara-x/

BSD 3-Clause "New" or "Revised" License

655 stars 49 forks source link

Pre-processing modules system #71

Open nikolay-n opened 10 months ago

nikolay-n commented 10 months ago

It will be great to have the additional pre-processing modules subsystem that can transform original data, e.g extracting, unpacking, decrypting or other kinds of tasks before the scan, without need to use custom yara modules functions and full potential of yara search engine.

Example modules can be:

detect/unpack and upx, pyinstaller, asar, dmg, msi, zip ...

I'm sure with the right SDK for such functionality community will produce a lot of useful stuff.

plusvic commented 10 months ago

Sure, that feature is my long-term plan for YARA-X.