On Fri, 9 Oct 2015 14:47:53 +0200 Reindl Harald wrote:
> > In the provided message the actual endianness is LE, and > > BOM is missing, so decoding as UTF-16BE fails and the > > rule does not hit. Garbage-in, garbage-out. > > > > If you manually edit the sample and replace UTF-16 > > with UTF-16LE (and normalize is enabled), your rule should > > hit - at least it does so in the current trunk code. > > yes, but since thunderbird shows the message and it don#t contain > special chars.... I suspect that it's falling back to native x86 little-endianness. Personally, I don't get any UTF-16 mail, so I'd be happy to score it.
