On Wed Mar 07 2012 01:21:25 GMT+0100 (CET)
Alexandre Dias <lexx...@gmail.com> wrote:
> Hello,
>
> I am doing my Msc thesis work in pattern matching, and I am using
> ClamAV's signature database.
>
> I've got a question about two specific wildcards that are stated in
> the signatures.pdf file (titled "Creating Signatures for ClamAV").
>
> According to the document, the wildcard "{n}" states that n bytes can
> be matched. Also, the wildcard "??" states that any one byte can be
> matched. I have found some "{1}" wildcards in the database. I assume
> that by saying "match n bytes", the meaning is that we can match any n
> bytes. If that is the case, what is the difference between "??" and
> "{1}" ?
There's no difference, ClamAV translates "{1}" into "??".
-TK
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
