Hello,
Is it possible to make a single signature that checks for both \n and \r\n? I tried using the pattern (0a|0d0a) but this "alternate" construction only seems to work for single bytes, not strings. ClamAV ignores the 0d0a part in the parentheses. Of course I could fix this particular sig by using the pattern {-1}0a but I'm looking for a more generic solution. For example, I'd also like to search for "version (0.9|1.0)". Is that currently possible with ClamAV signature definitions?
Thanks, Willem
Sorry for possible dupe post
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
