Regular expression problem

[Willem]

I would like to make a tool that assists in generating ClamAV signatures
[1]. However, I'm stuck with the regular expression required to
transform some, but not all of the signature to hex.

Suppose this signature:

xxxxversion(1|3|5.7)xxxxxxxx

I would like to encode anything _but_ the control characters (,|,) to
hex. However, I only want to protect these control characters that are
included in the following expression: m#\([\d\.|]\)#. In words: the (, )
and | that are used to mark alternatives for version numbers need to
remain unaltered.

Could anyone give me a clue on the regex?

Thanks!
Willem


[1] http://www.clamav.net/doc/0.80rc/signatures.pdf

 

[Anno Siegel]

I would like to make a tool that assists in generating ClamAV signatures
[1]. However, I'm stuck with the regular expression required to
transform some, but not all of the signature to hex.

Suppose this signature:

xxxxversion(1|3|5.7)xxxxxxxx

I would like to encode anything _but_ the control characters (,|,) to

Technically these are not control characters.

hex. However, I only want to protect these control characters that are
included in the following expression: m#\([\d\.|]\)#. In words: the (, )
and | that are used to mark alternatives for version numbers need to
remain unaltered.

Your (less than clear) verbal descriptions don't match up with the one
given as a regex. Do you want to transform digits or don't you? Make
up your mind.

You don't say what you mean by "transform to hex". Start with this:

s/([^(|)])/sprintf "%2x", ord $1/eg;

Anno

 

[Willem]

Your (less than clear) verbal descriptions don't match up with the one
given as a regex. Do you want to transform digits or don't you? Make
up your mind.
You don't say what you mean by "transform to hex". Start with this:

s/([^(|)])/sprintf "%2x", ord $1/eg;

Thanks! This would transform "a(1|2)b" to "61(31|32)62", which is indeed
what I want. However, I want to exclude the case where parentheses do
surround other characters than [\d\.\|]. To illustrate

a(1|2)b should yield 61(31|32)62
a(12)b should yield 612831322962

I don't know how to put this condition in a regular expression (if it is
possible at all?). Maybe it is also possible to transform everything to
hex, and then work the other way around by matching

(28)(.+?)(7c)(.+?)(29) => ($1|$2)

hex 28 = (
hex 7c = |
hex 29 = )

But this way I cannot limit my (.+?) match to (ascii) digits and dots so
this is a suboptimal solution.

Thanks again for any help.
Willem

 

[Gunnar Hjalmarsson]

s/([^(|)])/sprintf "%2x", ord $1/eg;

Thanks! This would transform "a(1|2)b" to "61(31|32)62", which is indeed
what I want. However, I want to exclude the case where parentheses do
surround other characters than [\d\.\|]. To illustrate

a(1|2)b should yield 61(31|32)62
a(12)b should yield 612831322962

In the last example, parentheses surround digits, which does not match
your verbal description. Please be exact when describing your problem!
We are not mind readers.

Would this possibly do it?

s{(\([^|)]+(?:\|[^|)]+)+\))|(.)}{
my $hexenc = sub { sprintf '%2x', ord $_[0] };
if ($2) { $hexenc->($2) }
else { local $_ = $1; s/([^(|)])/$hexenc->($1)/eg; $_ }
}eg;

 

[Willem]

Would this possibly do it?

s{(\([^|)]+(?:\|[^|)]+)+\))|(.)}{
my $hexenc = sub { sprintf '%2x', ord $_[0] };
if ($2) { $hexenc->($2) }
else { local $_ = $1; s/([^(|)])/$hexenc->($1)/eg; $_ }
}eg;

Yes, exactly! Thank you very much!
Willem