Hi everyone 👋 I was wondering if I could get others thoughts/opinions about adding Kaitai Struct ("Kaitai") as an external dependency to osquery? (https://kaitai.io/, open source) Small background/thought process, currently osquery parses several binary/artifact formats/structures in order provide data for certain tables (ex: shortcut files, prefetch, rpm, etc). In order to parse this data osquery either needs a dedicated external library or a parser implemented from scratch. Both have advantages/disadvantages, I personally try to avoid external libraries as I don't want to constantly add external libraries for each artifact (with some exceptions) and I also enjoy researching and trying to make parsers from scratch. There are also disadvantages to implementing a parser from scratch (more work for the contributor, bugs (though hopefully peer review catches them though 😄), etc) Kaitai is a framework that lets you create parsers for binary formats using a kaitai file (ksy/yaml file) and then compile the ksy file using Kaitai into a programming language of you choice (c++, python, c#, javascript, etc). Ive used it few times and think its pretty cool, but im not an expert on it. This compiled file can the be used as a utility/helper function to parse the binary data. Basically instead of coding parser, you write a yaml file that is then compiled into a parser for you. I think there could be several advantages to this approach: • Less manual coding, a contributor just needs to code the actual osquery table, they don't need to make a parser • Potentially less external libraries, instead of using an external library it could be possible to make a ksy file and use kaitai • Potentially easier to include additional data that osquery can collect, some binary formats are very complex and writing a kaitai ksy file is likely much less challenging than coding it c++ I think there could also be several disadvantages to this approach: • Another language to learn/learning curve, in order to contribute a binary parser to osquery a contributor will need to have some knowledge of c++ and some knowledge of the ksy language (its a yaml file) • Additional work for osquery reviewers, in addition to reviewing c++ files a reviewer may need/want to also review the ksy file • Use it or lose it, Kaitai doesn't provide anything on its own to osquery since its mainly a helper library that used to create parsers, if no one is adding parsers then it may not be heavily used. Kaitai does have a lot of pre-built parsers/ksy files (https://formats.kaitai.io) but I think most of them are out of scope for osquery (parsers for images, media, games, networking, etc). Though there are a few that could be beneficial. I think contributors would likely have to make their own. • Automated code generation, not sure auto code generation is allowed in osquery? • Not a silver bullet, I don't think kaitai would be replacement for some libraries, especially ones that parse a format and provide extra info. (Ex: LIEF)