Hi Do the FileSize field in a HDB signature serve any purpose during pattern matching, or pattern matching relies only on the MD5 checksum?
Similarly for the MDB signature whats the role of PESectionSize in pattern matching? Does PESectionSize get used while filtering and/or preprocessing during the pattern matching? I have read through the signatures document and could not figure this out? Do you have to step through the code to understand this? Is there notes/document which specifies the different types of filtering(AC, Wu-Manber, Bloom Filters) and preprocessing ClamAV does on the input file before proceeding to the exact match? If not any suggestions on how I could figure this out quickly from the source code? If this question is not suitable for this list, where should I post this question? Thank you! _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
