[clamav-users] Issue with clamav logical signature generation

[Al Varnell]

On Feb 25, 2019, at 10:44, G.W. Haywood via clamav-users <clamav-users at lists.clamav.net> wrote:
> 
> Hi there,
> 
> On Mon, 25 Feb 2019, Al Varnell wrote:
> 
>> ... the strings you provided appear to contain an extra digit. I
>> thought hex strings always contain an even number of digits?
> 
> Just as decimal strings are strings composed of decimal digits and can
> be any length, hexadecimal strings are strings composed of hexadecimal
> digits - and can also be any length.  They usually present as an even
> number of digits only because they generally represent the even numbers
> of four-bit binary numbers found in machine registers: 8-bit bytes and
> 16-bit words from decades ago, 32-bit, 64-bit and even 128-bit words
> (e.g. for IPv6 addresses) in more recent times.  I'm sure I did once
> use 12-bit word lengths for some reason, but I can't now remember what
> the hardware was.

Yes, of course that's correct and I said it wrong. When I analyzed those strings, they all appear to translate into four ascii characters, so I jumped to the conclusion that they were meant to all represent ascii and therefore would have an even number of digits. Here's what I found:

> connhkey6509Relec:\\Conv1971locaWait6376hkey5286sleec:\\connhkeyc:\\svch6006c:\\1955c:\\conngetmSetC1939hkeyc:\\22265576hkeyhkeyhkeyhkeyhkeyhkeyhkeyhkey5106delec:\\c:\\hkeySendkyuflocaIMAGhkeyhkeyhkeyiesqsvch127060356098hkeyhkeyc:\\hkey3191hkeyCreahkeyGetT5612c:\\hkeyIntehkeyhkeyhkeyhkey?setc:\\GetSRpcBhkeyhkeyVerQ5605hkeyOpen5184Lookc:\\GetT6199c:\\hkey5683getpole3Peek4205SetW\\??RegOc:\\hkeyhkey

-Al-
-- 
Al Varnell
Mountain View, CA




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190225/9ad0ba20/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3880 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190225/9ad0ba20/attachment.bin>