refactor: multiple changes in macho module

.github/workflows/tests.yaml

@@ -56,7 +56,7 @@ jobs:
           - build: no-default-features
             os: ubuntu-latest
             rust: stable
-            args: "--package yara-x --no-default-features --features=test_proto2-module,test_proto3-module,time-module,hash-module,macho-module,math-module,lnk-module,elf-module,pe-module,dotnet-module,console-module"
+            args: "--package yara-x --no-default-features --features=test_proto2-module,test_proto3-module,string-module,time-module,hash-module,macho-module,math-module,lnk-module,elf-module,pe-module,dotnet-module,console-module"
 
     steps:
       - name: Checkout sources

Cargo.toml

@@ -33,7 +33,6 @@ aho-corasick = "1.1.2"
 anyhow = "1.0.75"
 ariadne = "0.3.0"
 array-bytes = "6.2.0"
-arrayref = "0.3.7"
 ascii_tree = "0.1.1"
 authenticode-parser = "0.3.2"
 base64 = "0.21.0"

yara-x-cli/src/commands/dump.rs

@@ -127,7 +127,9 @@ pub fn exec_dump(args: &ArgMatches) -> anyhow::Result<()> {
         if !module_output.lnk.is_lnk() {
             module_output.lnk = MessageField::none()
         }
-        if !module_output.macho.has_magic() {
+        if !module_output.macho.has_magic()
+            && !module_output.macho.has_fat_magic()
+        {
             module_output.macho = MessageField::none()
         }
         if !module_output.pe.is_pe() {

yara-x/Cargo.toml

@@ -50,12 +50,14 @@ console-module = []
 
 # The `dotnet` module parsers .NET files.
 dotnet-module = [
-    "pe-module"
+    "pe-module",
+    "dep:nom",
 ]
 
 # The `elf` module parses ELF files.
 elf-module = [
-    "dep:tlsh-fixed"
+    "dep:tlsh-fixed",
+    "dep:nom",
 ]
 
 # The `hash` module provides functions for computing md5, sha1, sha-256,
@@ -70,13 +72,13 @@ hash-module = [
 # The `lnk` module parses LNK files.
 lnk-module = [
     "dep:uuid",
+    "dep:nom",
 ]
 
 # The `macho` module parses Mach-O files.
 macho-module = [
     "dep:byteorder",
     "dep:nom",
-    "dep:arrayref",
 ]
 
 # The `math` module.
@@ -85,6 +87,7 @@ math-module = []
 # The `pe` module parses PE files.
 pe-module = [
     "dep:authenticode-parser",
+    "dep:nom",
 ]
 
 # The `string` modules offer some functions for parsing strings as integers,
@@ -118,6 +121,7 @@ default = [
     "math-module",
     "hash-module",
     "pe-module",
+    "string-module",
     "time-module",
     "lnk-module",
     "test_proto2-module",
@@ -129,7 +133,6 @@ aho-corasick = { workspace = true, features=["logging"] }
 anyhow = { workspace = true }
 ariadne = { workspace = true }
 array-bytes = { workspace = true }
-arrayref = { workspace = true, optional = true }
 ascii_tree = { workspace = true}
 authenticode-parser = { workspace = true, optional = true }
 base64 = { workspace = true }