Scan archives without opening them
When operating on compressed archives like .tar.gz and .zip files (and any extension that _is_ a zip file...), it is more convenient to point yara-x at the archive itself, and performa. recursive scan.
This could simplify some of the compression-handling operations a caller must make, such as extracting files and then passing them to the scanner.
The `crx` module's parser appears to implement something along these lines already:
https://github.com/VirusTotal/yara-x/blob/4d7939759f2fed095aae7c4f704e4e36c3a6df84/lib/src/modules/crx/parser.rs#L265-L267
Is that generalizable, useful to others?
4 条评论