Browse code

bb9042 - signature manual update.

Steven Morgan authored on 2016/03/24 05:39:52
Showing 2 changed files
1 1
Binary files a/docs/signatures.pdf and b/docs/signatures.pdf differ
... ...
@@ -331,7 +331,12 @@ How do I look in hex?
331 331
     as two sub-signatures \verb+aabbcc+ and \verb+bbaacc+ with any number
332 332
     of bytes between them. It's a requirement that each sub-signature
333 333
     includes a block of two static characters somewhere in its body.
334
-    
334
+    Note that there is one exception to this restriction; that is when
335
+    the range wildcard is of the form \verb+{n}+ with \verb+n<128+. In this
336
+    case, ClamAV uses an optimization and translates \verb+{n}+ to the string
337
+    consisting of \verb+n ??+ character wildcards. Character wildcards do not
338
+    divide hex signatures into two parts and so the two static character
339
+    requirement does not apply.
335 340
 
336 341
     \subsubsection{Character classes}
337 342
     ClamAV supports the following character classes for hex-signatures: