On Feb 25, 2019, at 10:44, G.W. Haywood via clamav-users <clamav-users@lists.clamav.net> wrote:
Hi there,On Mon, 25 Feb 2019, Al Varnell wrote:... the strings you provided appear to contain an extra digit. I
thought hex strings always contain an even number of digits?
Just as decimal strings are strings composed of decimal digits and canbe any length, hexadecimal strings are strings composed of hexadecimaldigits - and can also be any length. They usually present as an evennumber of digits only because they generally represent the even numbersof four-bit binary numbers found in machine registers: 8-bit bytes and16-bit words from decades ago, 32-bit, 64-bit and even 128-bit words(e.g. for IPv6 addresses) in more recent times. I'm sure I did onceuse 12-bit word lengths for some reason, but I can't now remember whatthe hardware was.
Yes, of course that's correct and I said it wrong. When I analyzed those strings, they all appear to translate into four ascii characters, so I jumped to the conclusion that they were meant to all represent ascii and therefore would have an even number of digits. Here's what I found:
connhkey6509Relec:\\Conv1971locaWait6376hkey5286sleec:\\connhkeyc:\\svch6006c:\\1955c:\\conngetmSetC1939hkeyc:\\22265576hkeyhkeyhkeyhkeyhkeyhkeyhkeyhkey5106delec:\\c:\\hkeySendkyuflocaIMAGhkeyhkeyhkeyiesqsvch127060356098hkeyhkeyc:\\hkey3191hkeyCreahkeyGetT5612c:\\hkeyIntehkeyhkeyhkeyhkey?setc:\\GetSRpcBhkeyhkeyVerQ5605hkeyOpen5184Lookc:\\GetT6199c:\\hkey5683getpole3Peek4205SetW\\??RegOc:\\hkeyhkey
-Al-
--
Al Varnell
Mountain View, CA