Re: A simple rule

2014-09-03 Thread Bowie Bailey
On 8/28/2014 10:12 AM, Kevin A. McGrail wrote: On 8/28/2014 10:05 AM, Axb wrote: On 08/28/2014 03:45 PM, Rejaine Monteiro wrote: body MYRULE /deputado|presidente/i body MYRULE /(?:deputado|presidente)/i Technically, Alex's rule is faster but not technically different. The ?: tells th

Re: A simple rule

2014-08-28 Thread Kevin A. McGrail
On 8/28/2014 10:05 AM, Axb wrote: On 08/28/2014 03:45 PM, Rejaine Monteiro wrote: body MYRULE /deputado|presidente/i body MYRULE /(?:deputado|presidente)/i Technically, Alex's rule is faster but not technically different. The ?: tells the regexp not to store any matches in $1, $2, et

Re: A simple rule

2014-08-28 Thread Axb
On 08/28/2014 03:45 PM, Rejaine Monteiro wrote: body MYRULE /deputado|presidente/i body MYRULE /(?:deputado|presidente)/i

Re: a simple rule for detecting Microsoft executables

2004-11-07 Thread Theo Van Dinter
On Sun, Nov 07, 2004 at 10:04:58AM +0100, Francesco Potorti` wrote: > >ewww! $name="foo.com"; > > > >congrats, you just FPed. :) > > No, I didn't :-) > > You missed the meta rule: > meta ms_executable (__h_exename_q && !__b_exename_q) Ok, that one didn't FP, fine. :P I just don'

Re: a simple rule for detecting Microsoft executables

2004-11-07 Thread Francesco Potorti`
>> full __h_exename_q >> /\bname=("?).+?\.(?:bas|bat|cmd|com|cpl|exe|js|jse|msi|mst|pcd|pif|reg|scr|sct|vb|vbe|vbs|wsc|wsf|wsh|xsl)\1[[:blank:]]*(?:;|$)/mi >> rawbody __b_exename_q >> /\bname=("?).+?\.(?:bas|bat|cmd|com|cpl|exe|js|jse|msi|mst|pcd|pif|reg|scr|sct|vb|vbe|vbs|

Re: a simple rule for detecting Microsoft executables

2004-11-07 Thread Theo Van Dinter
On Sun, Nov 07, 2004 at 01:45:51AM +0100, Francesco Potorti` wrote: > full __h_exename_q > /\bname=("?).+?\.(?:bas|bat|cmd|com|cpl|exe|js|jse|msi|mst|pcd|pif|reg|scr|sct|vb|vbe|vbs|wsc|wsf|wsh|xsl)\1[[:blank:]]*(?:;|$)/mi > rawbody __b_exename_q > /\bname=("?).+?\.(?:bas|ba