Zentara wrote:
> 
> On Thu, 20 Jun 2002 17:43:29 -0700, [EMAIL PROTECTED] (John W. Krahn)
> wrote:
> >>Zentara wrote:
> >>I'm starting work on my own virus scanner.
> >> I'm especially looking for ways to convert to hex more
> >> efficiently,
> 
> >my $hexstring = '58354f2150254041505b345c505a';
> >my $hexlen = length( $hexstring ) / 2;
> >
> >my $hex = pack 'C*', unpack 'H' x $hexlen, $hexstring;
> 
> Wow, John, I can't figure what this does.  $hexstring already
> is hex.  I'm guessing that you meant

Sorry, it was late and I didn't test it.  :-(   The correct code should
be

my $bin = pack 'H*', $hextest;


> my $filestring;    # slurped binary file
> my $hexlen = length($filestring) / 2;
> my $hexfilestring = pack 'C*', unpack 'H' x $hexlen, $filestring
> 
> ????? You have me totally lost,  as usual. :-)  Are you toying with me?
> What does this do?
> Unless I'm confusing 'hex' with the 'hex representation' using
> 0-9, a-f and A-F.
> 
> >> rather than using  =~ m/ $hextest /i
> >
> >If you are going to use a regular expression you should quotemeta
> >$hextest and you don't want to use /i or it might not match correctly.
> >
> >/\Q$hextest\E/
> 
> Hmmmm,  my idea with   m/$hextest/i    was to make sure that
> the hex would match  either a-f  or A-F  ; since sometimes the
> hexstrings are  like  5e4d3a  or  5E4D3A  which I would want to
> be treated as equivalent.  Why might not this match properly.
> 
> I have to read up on Quotemeta, but since all the files and strings are
> converted to hex representation before the regex, there shouldn't
> be any non-alphanumeric characters to backslash.  ??? I know you have
> far superior perl skills, so why?

Sorry, my understanding is that the hex string is just an ASCII
representation of the binary data to search for.  Virus files don't have
actual "hex strings" in them but are compiled executables.



John
-- 
use Perl;
program
fulfillment

-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to