Hi Ross,
Nice article!
I like the idea of returning how many bytes were scanned to make an identification. That would certainly help with tuning DROID for particular use cases to get the best performance/identification trade off. It would also help to probe the behaviour of new signatures being developed.
The only way of doing this now would be to run multiple profiles on the same files with different max byte settings and then carefully compare their output to see what fails to match as you decrease the max bytes. We did actually do this once when the feature of limiting the bytes to scan was originally introduced, and is how the default of 64k was agreed, but it was a lot of work and not very efficient.
cheers,
Matt.