YARA v4.3.0-rc1 --skip-larger
YARA release candidate 1 for version 4.3.0 brings a Windows fix for the --skip-larger option.
IIRC, the --skip-larger option was introduced about a year ago, and allows one to specify a filesize to skip files. Files larger than the given size would no be scanned during a directory scan.
Unfortunately, this feature was not implemented in the Windows version of YARA, but now it is.
Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com
×
Diary Archives
Comments