# ## ------------------------------------------------------------------ ## Signature for LZMA compressed data with valid properties byte 0x40 ## ------------------------------------------------------------------ #0 string \x40\x00\x00 LZMA compressed data, properties: 0x40, # ## These are all the valid dictionary sizes supported by LZMA utils. #>1 lelong !65536 #>>1 lelong !131072 #>>>1 lelong !262144 #>>>>1 lelong !524288 #>>>>>1 lelong !1048576 #>>>>>>1 lelong !2097152 #>>>>>>>1 lelong !4194304 #>>>>>>>>1 lelong !8388608 #>>>>>>>>>1 lelong !16777216 #>>>>>>>>>>1 lelong !33554432 invalid #>1 lelong x dictionary size: %d bytes, # ## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). ## This could technically be valid, but is unlikely. #>5 lequad !-1 #>>5 lequad <32 invalid #>>5 lequad >0x40000000 invalid # ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. #>1 lelong 65536 #>>5 lequad 65536 invalid #>1 lelong 131072 #>>5 lequad 131072 invalid #>1 lelong 262144 #>>5 lequad 262144 invalid #>1 lelong 524288 #>>5 lequad 524288 invalid #>1 lelong 1048576 #>>5 lequad 1048576 invalid #>1 lelong 2097152 #>>5 lequad 2097152 invalid #>1 lelong 4194304 #>>5 lequad 4194304 invalid #>1 lelong 8388608 #>>5 lequad 8388608 invalid #>1 lelong 16777216 #>>5 lequad 16777216 invalid #>1 lelong 33554432 #>>5 lequad 33554432 invalid #>5 lequad x uncompressed size: %lld bytes # # ## ------------------------------------------------------------------ ## Signature for LZMA compressed data with valid properties byte 0x41 ## ------------------------------------------------------------------ #0 string \x41\x00\x00 LZMA compressed data, properties: 0x41, # ## These are all the valid dictionary sizes supported by LZMA utils. #>1 lelong !65536 #>>1 lelong !131072 #>>>1 lelong !262144 #>>>>1 lelong !524288 #>>>>>1 lelong !1048576 #>>>>>>1 lelong !2097152 #>>>>>>>1 lelong !4194304 #>>>>>>>>1 lelong !8388608 #>>>>>>>>>1 lelong !16777216 #>>>>>>>>>>1 lelong !33554432 invalid #>1 lelong x dictionary size: %d bytes, # ## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). ## This could technically be valid, but is unlikely. #>5 lequad !-1 #>>5 lequad <32 invalid #>>5 lequad >0x40000000 invalid # ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. #>1 lelong 65536 #>>5 lequad 65536 invalid #>1 lelong 131072 #>>5 lequad 131072 invalid #>1 lelong 262144 #>>5 lequad 262144 invalid #>1 lelong 524288 #>>5 lequad 524288 invalid #>1 lelong 1048576 #>>5 lequad 1048576 invalid #>1 lelong 2097152 #>>5 lequad 2097152 invalid #>1 lelong 4194304 #>>5 lequad 4194304 invalid #>1 lelong 8388608 #>>5 lequad 8388608 invalid #>1 lelong 16777216 #>>5 lequad 16777216 invalid #>1 lelong 33554432 #>>5 lequad 33554432 invalid #>5 lequad x uncompressed size: %lld bytes # # ## ------------------------------------------------------------------ ## Signature for LZMA compressed data with valid properties byte 0x48 ## ------------------------------------------------------------------ #0 string \x48\x00\x00 LZMA compressed data, properties: 0x48, # ## These are all the valid dictionary sizes supported by LZMA utils. #>1 lelong !65536 #>>1 lelong !131072 #>>>1 lelong !262144 #>>>>1 lelong !524288 #>>>>>1 lelong !1048576 #>>>>>>1 lelong !2097152 #>>>>>>>1 lelong !4194304 #>>>>>>>>1 lelong !8388608 #>>>>>>>>>1 lelong !16777216 #>>>>>>>>>>1 lelong !33554432 invalid #>1 lelong x dictionary size: %d bytes, # ## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). ## This could technically be valid, but is unlikely. #>5 lequad !-1 #>>5 lequad <32 invalid #>>5 lequad >0x40000000 invalid # ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. #>1 lelong 65536 #>>5 lequad 65536 invalid #>1 lelong 131072 #>>5 lequad 131072 invalid #>1 lelong 262144 #>>5 lequad 262144 invalid #>1 lelong 524288 #>>5 lequad 524288 invalid #>1 lelong 1048576 #>>5 lequad 1048576 invalid #>1 lelong 2097152 #>>5 lequad 2097152 invalid #>1 lelong 4194304 #>>5 lequad 4194304 invalid #>1 lelong 8388608 #>>5 lequad 8388608 invalid #>1 lelong 16777216 #>>5 lequad 16777216 invalid #>1 lelong 33554432 #>>5 lequad 33554432 invalid #>5 lequad x uncompressed size: %lld bytes # # ## ------------------------------------------------------------------ ## Signature for LZMA compressed data with valid properties byte 0x49 ## ------------------------------------------------------------------ #0 string \x49\x00\x00 LZMA compressed data, properties: 0x49, # ## These are all the valid dictionary sizes supported by LZMA utils. #>1 lelong !65536 #>>1 lelong !131072 #>>>1 lelong !262144 #>>>>1 lelong !524288 #>>>>>1 lelong !1048576 #>>>>>>1 lelong !2097152 #>>>>>>>1 lelong !4194304 #>>>>>>>>1 lelong !8388608 #>>>>>>>>>1 lelong !16777216 #>>>>>>>>>>1 lelong !33554432 invalid #>1 lelong x dictionary size: %d bytes, # ## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). ## This could technically be valid, but is unlikely. #>5 lequad !-1 #>>5 lequad <32 invalid #>>5 lequad >0x40000000 invalid # ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. #>1 lelong 65536 #>>5 lequad 65536 invalid #>1 lelong 131072 #>>5 lequad 131072 invalid #>1 lelong 262144 #>>5 lequad 262144 invalid #>1 lelong 524288 #>>5 lequad 524288 invalid #>1 lelong 1048576 #>>5 lequad 1048576 invalid #>1 lelong 2097152 #>>5 lequad 2097152 invalid #>1 lelong 4194304 #>>5 lequad 4194304 invalid #>1 lelong 8388608 #>>5 lequad 8388608 invalid #>1 lelong 16777216 #>>5 lequad 16777216 invalid #>1 lelong 33554432 #>>5 lequad 33554432 invalid #>5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x51 # ------------------------------------------------------------------ 0 string \x51\x00\x00 LZMA compressed data, properties: 0x51, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x5A # ------------------------------------------------------------------ 0 string \x5A\x00\x00 LZMA compressed data, properties: 0x5A, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x5B # ------------------------------------------------------------------ 0 string \x5B\x00\x00 LZMA compressed data, properties: 0x5B, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x5C # ------------------------------------------------------------------ 0 string \x5C\x00\x00 LZMA compressed data, properties: 0x5C, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x5D # ------------------------------------------------------------------ 0 string \x5D\x00\x00 LZMA compressed data, properties: 0x5D, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x5E # ------------------------------------------------------------------ 0 string \x5E\x00\x00 LZMA compressed data, properties: 0x5E, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x63 # ------------------------------------------------------------------ 0 string \x63\x00\x00 LZMA compressed data, properties: 0x63, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x64 # ------------------------------------------------------------------ 0 string \x64\x00\x00 LZMA compressed data, properties: 0x64, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x65 # ------------------------------------------------------------------ 0 string \x65\x00\x00 LZMA compressed data, properties: 0x65, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x66 # ------------------------------------------------------------------ 0 string \x66\x00\x00 LZMA compressed data, properties: 0x66, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x6C # ------------------------------------------------------------------ 0 string \x6C\x00\x00 LZMA compressed data, properties: 0x6C, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x6D # ------------------------------------------------------------------ 0 string \x6D\x00\x00 LZMA compressed data, properties: 0x6D, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x6E # ------------------------------------------------------------------ 0 string \x6E\x00\x00 LZMA compressed data, properties: 0x6E, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x75 # ------------------------------------------------------------------ 0 string \x75\x00\x00 LZMA compressed data, properties: 0x75, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x76 # ------------------------------------------------------------------ 0 string \x76\x00\x00 LZMA compressed data, properties: 0x76, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x7E # ------------------------------------------------------------------ 0 string \x7E\x00\x00 LZMA compressed data, properties: 0x7E, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x87 # ------------------------------------------------------------------ 0 string \x87\x00\x00 LZMA compressed data, properties: 0x87, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x88 # ------------------------------------------------------------------ 0 string \x88\x00\x00 LZMA compressed data, properties: 0x88, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x89 # ------------------------------------------------------------------ 0 string \x89\x00\x00 LZMA compressed data, properties: 0x89, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x8A # ------------------------------------------------------------------ 0 string \x8A\x00\x00 LZMA compressed data, properties: 0x8A, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x8B # ------------------------------------------------------------------ 0 string \x8B\x00\x00 LZMA compressed data, properties: 0x8B, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x90 # ------------------------------------------------------------------ 0 string \x90\x00\x00 LZMA compressed data, properties: 0x90, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x91 # ------------------------------------------------------------------ 0 string \x91\x00\x00 LZMA compressed data, properties: 0x91, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x92 # ------------------------------------------------------------------ 0 string \x92\x00\x00 LZMA compressed data, properties: 0x92, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x93 # ------------------------------------------------------------------ 0 string \x93\x00\x00 LZMA compressed data, properties: 0x93, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x99 # ------------------------------------------------------------------ 0 string \x99\x00\x00 LZMA compressed data, properties: 0x99, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x9A # ------------------------------------------------------------------ 0 string \x9A\x00\x00 LZMA compressed data, properties: 0x9A, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0x9B # ------------------------------------------------------------------ 0 string \x9B\x00\x00 LZMA compressed data, properties: 0x9B, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xA2 # ------------------------------------------------------------------ 0 string \xA2\x00\x00 LZMA compressed data, properties: 0xA2, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xA3 # ------------------------------------------------------------------ 0 string \xA3\x00\x00 LZMA compressed data, properties: 0xA3, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xAB # ------------------------------------------------------------------ 0 string \xAB\x00\x00 LZMA compressed data, properties: 0xAB, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xB4 # ------------------------------------------------------------------ 0 string \xB4\x00\x00 LZMA compressed data, properties: 0xB4, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xB5 # ------------------------------------------------------------------ 0 string \xB5\x00\x00 LZMA compressed data, properties: 0xB5, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xB6 # ------------------------------------------------------------------ 0 string \xB6\x00\x00 LZMA compressed data, properties: 0xB6, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xB7 # ------------------------------------------------------------------ 0 string \xB7\x00\x00 LZMA compressed data, properties: 0xB7, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xB8 # ------------------------------------------------------------------ 0 string \xB8\x00\x00 LZMA compressed data, properties: 0xB8, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xBD # ------------------------------------------------------------------ 0 string \xBD\x00\x00 LZMA compressed data, properties: 0xBD, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xBE # ------------------------------------------------------------------ 0 string \xBE\x00\x00 LZMA compressed data, properties: 0xBE, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xBF # ------------------------------------------------------------------ 0 string \xBF\x00\x00 LZMA compressed data, properties: 0xBF, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xC0 # ------------------------------------------------------------------ 0 string \xC0\x00\x00 LZMA compressed data, properties: 0xC0, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xC6 # ------------------------------------------------------------------ 0 string \xC6\x00\x00 LZMA compressed data, properties: 0xC6, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xC7 # ------------------------------------------------------------------ 0 string \xC7\x00\x00 LZMA compressed data, properties: 0xC7, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xC8 # ------------------------------------------------------------------ 0 string \xC8\x00\x00 LZMA compressed data, properties: 0xC8, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xCF # ------------------------------------------------------------------ 0 string \xCF\x00\x00 LZMA compressed data, properties: 0xCF, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xD0 # ------------------------------------------------------------------ 0 string \xD0\x00\x00 LZMA compressed data, properties: 0xD0, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes # ------------------------------------------------------------------ # Signature for LZMA compressed data with valid properties byte 0xD8 # ------------------------------------------------------------------ 0 string \xD8\x00\x00 LZMA compressed data, properties: 0xD8, # These are all the valid dictionary sizes supported by LZMA utils. >1 lelong !65536 >>1 lelong !131072 >>>1 lelong !262144 >>>>1 lelong !524288 >>>>>1 lelong !1048576 >>>>>>1 lelong !2097152 >>>>>>>1 lelong !4194304 >>>>>>>>1 lelong !8388608 >>>>>>>>>1 lelong !16777216 >>>>>>>>>>1 lelong !33554432 invalid >1 lelong x dictionary size: %d bytes, # Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid). # This could technically be valid, but is unlikely. >5 lequad !-1 >>5 lequad <32 invalid >>5 lequad >0x40000000 invalid # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives. >1 lelong 65536 >>5 lequad 65536 invalid >1 lelong 131072 >>5 lequad 131072 invalid >1 lelong 262144 >>5 lequad 262144 invalid >1 lelong 524288 >>5 lequad 524288 invalid >1 lelong 1048576 >>5 lequad 1048576 invalid >1 lelong 2097152 >>5 lequad 2097152 invalid >1 lelong 4194304 >>5 lequad 4194304 invalid >1 lelong 8388608 >>5 lequad 8388608 invalid >1 lelong 16777216 >>5 lequad 16777216 invalid >1 lelong 33554432 >>5 lequad 33554432 invalid >5 lequad x uncompressed size: %lld bytes