fix: add support for FAT Mach-O files in yr dump auto module selection

VirusTotal · Jan 31, 2024 · 9a345c2 · 9a345c2
1 parent fc17b62
commit 9a345c2
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/yara-x-cli/src/commands/dump.rs b/yara-x-cli/src/commands/dump.rs
@@ -127,7 +127,9 @@ pub fn exec_dump(args: &ArgMatches) -> anyhow::Result<()> {
         if !module_output.lnk.is_lnk() {
             module_output.lnk = MessageField::none()
         }
-        if !module_output.macho.has_magic() {
+        if !module_output.macho.has_magic()
+            && !module_output.macho.has_fat_magic()
+        {
             module_output.macho = MessageField::none()
         }
         if !module_output.pe.is_pe() {