| Main Archive Page > Month Archives > clamav-devel archives |
[Clamav-devel] Question about wildcards ?? and {n} in signatures
From: Alexandre Dias <lexx.pt_at_nospam>Date: Wed Mar 07 2012 - 00:21:25 GMT
To: clamav-devel@lists.clamav.net
Hello,
I am doing my Msc thesis work in pattern matching, and I am using
ClamAV's signature database.
I've got a question about two specific wildcards that are stated in
the signatures.pdf file (titled "Creating Signatures for ClamAV").
According to the document, the wildcard "{n}" states that n bytes can
be matched. Also, the wildcard "??" states that any one byte can be
matched. I have found some "{1}" wildcards in the database. I assume
that by saying "match n bytes", the meaning is that we can match any n
bytes. If that is the case, what is the difference between "??" and
"{1}" ? Or am I wrong, and {n} means "match the previous byte, n
times"?
Thank you for your time.
Best regards,
-Alexandre Dias
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net