Comment by Sirened

this might be dumb, but why do we even use scanning in this day and age? Why not use kernel callbacks which notify when executables and files load for, say, the first time after being modified? Surely that'd be less race-y and waste less battery?