Mark, > On Aug 15, 2017, at 12:34 PM, Mark Allan <markjal...@gmail.com > <mailto:markjal...@gmail.com>> wrote: > > 2) It specifies a length of 1 byte, but also has :73 at the end which means > "file size unknown".
This is not quite correct, the 1 here should be interpreted as a file size of 1 byte. The trailing :73 is a engine version restriction based on engine functional level, restrictions can have a minimum and maximum version and for HSB sigs are optional trailing fields in the form :F-Min:F-Max. The 73 here refers to an internal test engine release that included this functionality for wildcard size that first appeared in ClamAV 0.98 (which has functional level 74). Tom _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net http://www.clamav.net/contact.html#ml
