Post Reply 
Remove Obfuscated Code [20081221b]
Dec. 20, 2008, 07:06 PM
Post: #15
RE: Remove Obfuscated Code [20081216]
That's not intentional; that simply translates to "foobar" (or so I'd hope so).
I'll be revising the filter today; I came across some false positives, and I'll implement z12's ideas into the filter to make it more readable.

Thanks!

EDIT: Updated. Got rid of the "foobar" replacement texts, updated the octal and hex matching expressions (thanks z12), and I also added $TYPE(vbs).

I should have fixed most/all false positives by simply ensuring there is a double/single quote at the beginning (I had to increase the byte size to 91 to accommodate for this additional byte).
Visit this user's website
Add Thank You Quote this message in a reply
Post Reply 


Messages In This Thread
Remove Obfuscated Code [20081221b] - Kye-U - Dec. 17, 2008, 03:30 AM
RE: Remove Obfuscated Code [20081216] - Kye-U - Dec. 17, 2008, 06:11 PM
RE: Remove Obfuscated Code [20081216] - z12 - Dec. 20, 2008, 12:53 PM
RE: Remove Obfuscated Code [20081216] - Kye-U - Dec. 20, 2008 07:06 PM
RE: Remove Obfuscated Code [20081220a] - Kye-U - Dec. 20, 2008, 10:34 PM
RE: Remove Obfuscated Code [20081220a] - Kye-U - Dec. 20, 2008, 11:05 PM
RE: Remove Obfuscated Code [20081220b] - z12 - Dec. 21, 2008, 12:50 AM
RE: Remove Obfuscated Code [20081220b] - Kye-U - Dec. 21, 2008, 03:28 AM
RE: Remove Obfuscated Code [20081221b] - Kye-U - Dec. 21, 2008, 08:32 PM
RE: Remove Obfuscated Code [20081221b] - Kye-U - Dec. 22, 2008, 03:39 AM
RE: Remove Obfuscated Code [20081221b] - z12 - Dec. 22, 2008, 10:58 AM

Forum Jump: