[Snort-users] byte_test/byte_jump negative offsets

Praveen D praveend.hac at ...11827...
Thu Dec 18 03:11:14 EST 2014


Hi,

Below is the data which I am trying to detect
1c 0c 00 00 *74 45 58 74* 41 41 41 41 41 41 41 41   ....*tEXt*AAAAAAAA

content:"tEXt"; byte_test:4,>,0x3000,*-4*,relative;
Extract 0x1c0c0000 and compare with 0x3000

After matching tEXt, where does the pointer pointed to? Should I use
offset:-4 or offset:-8?

Best Regards,
Praveen Darshanam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20141218/11ad1b80/attachment.html>


More information about the Snort-users mailing list