It's a different approach:

  Traditional detection approaches like YARA rules, IOC matching, and signature-based systems fall apart when:

   • You don’t have the actual malicious samples to create signatures from
   • The attackers use polymorphic techniques that change file hashes
   • The exploit leverages legitimate file format features in unexpected ways
   • You need to detect future variants of the same technique

  The Philosophy: Structure Over Signatures

  ELEGANTBOUNCER takes a fundamentally different approach to threat detection. Instead of looking for specific byte patterns or known-bad indicators, it analyzes the structural properties of files that make exploits possible.

I'm just thinking, I'd always prefer to run one tool to verify if a phone has been compromised. If mvt used ELEGANTBOUNCER as a plugin/extension/backend that'd be superb. But, not a big deal, I'm glad I found about this tool, thank you.

I am interested in finding out more on why Yara can't be used to find structural patterns? it is supposed to do a lot more than simple string and byte-pattern matching. Maybe ELEGANTBOUNCER requires keeping/maintaining a complex state machine to evaluate/analyze content?