If others are curious/interested in adding it, I can try opening a PR for it, I can also try converting one of my existing PRs (fseventsd, jumplist, or raw registry parsing) to use Kaitai if others are curious what kaitai would provide when parsing a binary format? Kaitai already has ksy files for registry and partially for jumplist (it as a CFB/OLE CF ksy file), i would need to make a ksy file for fseventds I can also open a Blueprint issue if others would like to move the discussion to GitHub. Again just curious about others thoughts about it, if no one thinks its a good fit thats fine. Just wanted to mention it. Thanks Links: * https://kaitai.io/#what-is-it * Actual kaitai c++ library (this would be the external library) https://github.com/kaitai-io/kaitai_struct_cpp_stl_runtime * Example ksy file: https://formats.kaitai.io/zip/ I also tested it out and made a quick very simple table using the zip ksy file above and compiling it into a cpp/h file just to see how much work it would take to add as a external library

osquery> select * from zip_contents;
            path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/
     zip_sections = 27
size_uncompressed = 0
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/.gitignore
     zip_sections = 27
size_uncompressed = 109
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/CMakeLists.txt
     zip_sections = 27
size_uncompressed = 1691
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/LICENSE
     zip_sections = 27
size_uncompressed = 1076
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/README.md
     zip_sections = 27
size_uncompressed = 461
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/build/
     zip_sections = 27
size_uncompressed = 0
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/build/.gitignore
     zip_sections = 27
size_uncompressed = 14
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/kaitai/
     zip_sections = 27
size_uncompressed = 0
    modified_time = 2021-7-1 6:10:16

             path = /Users/puffycid/Downloads/kaitai_struct_cpp_stl_runtime-master.zip
             file = kaitai_struct_cpp_stl_runtime-master/kaitai/custom_decoder.h
     zip_sections = 27
size_uncompressed = 236
...