...
|
...
|
@@ -331,7 +331,12 @@ How do I look in hex?
|
331
|
331
|
as two sub-signatures \verb+aabbcc+ and \verb+bbaacc+ with any number
|
332
|
332
|
of bytes between them. It's a requirement that each sub-signature
|
333
|
333
|
includes a block of two static characters somewhere in its body.
|
334
|
|
-
|
|
334
|
+ Note that there is one exception to this restriction; that is when
|
|
335
|
+ the range wildcard is of the form \verb+{n}+ with \verb+n<128+. In this
|
|
336
|
+ case, ClamAV uses an optimization and translates \verb+{n}+ to the string
|
|
337
|
+ consisting of \verb+n ??+ character wildcards. Character wildcards do not
|
|
338
|
+ divide hex signatures into two parts and so the two static character
|
|
339
|
+ requirement does not apply.
|
335
|
340
|
|
336
|
341
|
\subsubsection{Character classes}
|
337
|
342
|
ClamAV supports the following character classes for hex-signatures:
|