Hello Keith,

Tuesday, April 12, 2005, 6:10:38 PM, you wrote:

KI> Robert Menschel wrote:

>> The question is how intelligent do you want to make the rule(s).  If
>> you want something like 
>> 
>> body  L_PIPE  m'\w\w\|\w\w'
>> body  L_ZER0  m'\w\w0\w\w'
>> body  L_VEEE  m'\\/\w'
>> body  L_AAAA  m'\w/\\\w'
>> body  L_LONE  m'\w\w1\w\w'
>> meta  L_OBFU2  L_PIPE + L_ZERO + L_VEEE + L_AAAA + L_LONE > 1

KI> Remember that \w matches letters, numbers, and underscores, so 
KI> you'll probably want to use something like [a-z] or [A-Za-z] (or 
KI> [a-z] with a /i modifier at the end of the regex) instead. 
KI> Otherwise you'll wind up triggering on perfect ordinary numbers. 
KI>   Even with [a-z], I'd expect a fair number of false positives.

Definitely.  I considered that with L_PIPE, and figured that was OK.
Then since I wasn't doing real rules anyway, but just an example, I
got lazy and used the \w for the other rules as well, even though
\w\w0\w\w would match 10000.

Bob Menschel



Reply via email to