HOME LINKS SAL PUBLIC SOFTWARE SEARCH MADE UP

SAGATOR


string_scan()
  Primitive string pattern scanner.
  
  There can be more patterns for one virus. All patterns
  must match to assign an buffer as virus.
  There can also be more virnames in one dictionary.
  
  Usage: string_scan([['VirName', 'Pattern1...', ...], ...], size=0)
  
  Where: 'VirName' is a string, which identifies defined virus
         'Pattern...' is a string pattern
         size is a number, which defines, how many bytes may be checked.
           If it is 0 or not defined, whole buffer is scanned.
           If it is -1, email header is scanned.
    
  Example: string_scan([
             # Scan for a part of EICAR virus test file pattern
             ['EICAR', 'X5O!P%@AP[4', 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE'],
             # Scan for a an EXE file pattern endoded as base64.
             ['UnknownEXE', 'TVqQ']
           ])