Skip to content

feat: Add -f flag for single file analysis#2

Merged
Neo23x0 merged 1 commit intoNeo23x0:mainfrom
RuneCode14:main
Feb 8, 2026
Merged

feat: Add -f flag for single file analysis#2
Neo23x0 merged 1 commit intoNeo23x0:mainfrom
RuneCode14:main

Conversation

@RuneCode14
Copy link

Summary

Adds a -f flag for analyzing single malware samples without manual temp directory setup.

Problem

Users often want to analyze a single file but -m expects a directory, forcing manual temp directory creation.

Solution

# Old way (manual temp dir)
mkdir -p /tmp/work && cp sample.exe /tmp/work/
./yargen -m /tmp/work -a "Author"

# New way (simple)  
./yargen -f sample.exe -a "Author"

The -f flag:

  • Creates a temp directory internally
  • Copies the file
  • Runs analysis
  • Cleans up automatically

Also prints a recommendation message about using server mode for multiple samples.

Changes

  • Added -f string flag for single file path
  • Added printSingleFileRecommendation() function
  • Updated validation to accept either -m OR -f
  • Added proper cleanup with defer os.RemoveAll(tempDir)

…ecommendation

- Add -f flag to analyze a single file without creating temp directories manually
- When using -f, automatically create temp dir, copy file, and clean up after
- Add recommendation message when using -f about server mode for multiple samples
- Update help text to show -m and -f as alternatives (not required together)
- Improve error messages to mention both -m and -f options

This addresses usability feedback where users struggled with:
1. Understanding that -m expects a directory, not a file
2. Knowing when to use CLI vs server mode for efficiency

Example usage:
  ./yargen -f malware.exe -a Author -o rule.yar

The recommendation message advises users to start the server when
analyzing multiple samples to avoid repeated database initialization.
@Neo23x0 Neo23x0 merged commit be93456 into Neo23x0:main Feb 8, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants