On Fri, 06 Jun 2008 01:56:30 +0300
Giorgos Vasiliadis <[EMAIL PROTECTED]> wrote:
> In order to understand the pattern matching procedure of clamav, I
> created a new signature database that contain only one signature
> (test=72706e696674). The hex representation is equal to the string 'printf'.
[...]
> Is this behavior expected or I do something wrong?
your hex string decodes to "rpnift"
hex("printf")=7072696e7466
--
oo ..... Tomasz Kojm <[EMAIL PROTECTED]>
(\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg
\..........._ 0DCA5A08407D5288279DB43454822DC8985A444B
//\ /\ Fri Jun 6 01:03:48 CEST 2008
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
