Robert Menschel wrote:

The question is how intelligent do you want to make the rule(s). If
you want something like


body  L_PIPE  m'\w\w\|\w\w'
body  L_ZER0  m'\w\w0\w\w'
body  L_VEEE  m'\\/\w'
body  L_AAAA  m'\w/\\\w'
body  L_LONE  m'\w\w1\w\w'
meta  L_OBFU2  L_PIPE + L_ZERO + L_VEEE + L_AAAA + L_LONE > 1

Remember that \w matches letters, numbers, and underscores, so you'll probably want to use something like [a-z] or [A-Za-z] (or [a-z] with a /i modifier at the end of the regex) instead. Otherwise you'll wind up triggering on perfect ordinary numbers. Even with [a-z], I'd expect a fair number of false positives.


--
Keith C. Ivey <[EMAIL PROTECTED]>
Washington, DC

Reply via email to