Skip to content

B
binwalk
Commit 4c4975b5 by Craig Heffner
Options

Removed excessive size field validation for LZMA signatures; their compression… 

Removed excessive size field validation for LZMA signatures; their compression is already validated, which is a better metric anyway.
parent a6c75f09
Showing with 50 additions and 50 deletions
src/binwalk/magic/lzma
...@@ -21,7 +21,7 @@ ...@@ -21,7 +21,7 @@
## This could technically be valid, but is unlikely. ## This could technically be valid, but is unlikely.
#>5 lequad !-1 #>5 lequad !-1
#>>5 lequad <32 {invalid} #>>5 lequad <32 {invalid}
#>>5 lequad >0x40000000 {invalid} ##>>5 lequad >0x40000000 {invalid}
# #
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -71,7 +71,7 @@ ...@@ -71,7 +71,7 @@
## This could technically be valid, but is unlikely. ## This could technically be valid, but is unlikely.
#>5 lequad !-1 #>5 lequad !-1
#>>5 lequad <32 {invalid} #>>5 lequad <32 {invalid}
#>>5 lequad >0x40000000 {invalid} ##>>5 lequad >0x40000000 {invalid}
# #
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -121,7 +121,7 @@ ...@@ -121,7 +121,7 @@
## This could technically be valid, but is unlikely. ## This could technically be valid, but is unlikely.
#>5 lequad !-1 #>5 lequad !-1
#>>5 lequad <32 {invalid} #>>5 lequad <32 {invalid}
#>>5 lequad >0x40000000 {invalid} ##>>5 lequad >0x40000000 {invalid}
# #
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -171,7 +171,7 @@ ...@@ -171,7 +171,7 @@
## This could technically be valid, but is unlikely. ## This could technically be valid, but is unlikely.
#>5 lequad !-1 #>5 lequad !-1
#>>5 lequad <32 {invalid} #>>5 lequad <32 {invalid}
#>>5 lequad >0x40000000 {invalid} ##>>5 lequad >0x40000000 {invalid}
# #
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. ## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions), ## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -221,7 +221,7 @@ ...@@ -221,7 +221,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -271,7 +271,7 @@ ...@@ -271,7 +271,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -321,7 +321,7 @@ ...@@ -321,7 +321,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -371,7 +371,7 @@ ...@@ -371,7 +371,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -421,7 +421,7 @@ ...@@ -421,7 +421,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -471,7 +471,7 @@ ...@@ -471,7 +471,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -521,7 +521,7 @@ ...@@ -521,7 +521,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -571,7 +571,7 @@ ...@@ -571,7 +571,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -621,7 +621,7 @@ ...@@ -621,7 +621,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -671,7 +671,7 @@ ...@@ -671,7 +671,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -721,7 +721,7 @@ ...@@ -721,7 +721,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -771,7 +771,7 @@ ...@@ -771,7 +771,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -821,7 +821,7 @@ ...@@ -821,7 +821,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -871,7 +871,7 @@ ...@@ -871,7 +871,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -921,7 +921,7 @@ ...@@ -921,7 +921,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -971,7 +971,7 @@ ...@@ -971,7 +971,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1021,7 +1021,7 @@ ...@@ -1021,7 +1021,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1071,7 +1071,7 @@ ...@@ -1071,7 +1071,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1121,7 +1121,7 @@ ...@@ -1121,7 +1121,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1171,7 +1171,7 @@ ...@@ -1171,7 +1171,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1221,7 +1221,7 @@ ...@@ -1221,7 +1221,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1271,7 +1271,7 @@ ...@@ -1271,7 +1271,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1321,7 +1321,7 @@ ...@@ -1321,7 +1321,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1371,7 +1371,7 @@ ...@@ -1371,7 +1371,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1421,7 +1421,7 @@ ...@@ -1421,7 +1421,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1471,7 +1471,7 @@ ...@@ -1471,7 +1471,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1521,7 +1521,7 @@ ...@@ -1521,7 +1521,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1571,7 +1571,7 @@ ...@@ -1571,7 +1571,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1621,7 +1621,7 @@ ...@@ -1621,7 +1621,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1671,7 +1671,7 @@ ...@@ -1671,7 +1671,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1721,7 +1721,7 @@ ...@@ -1721,7 +1721,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1771,7 +1771,7 @@ ...@@ -1771,7 +1771,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1821,7 +1821,7 @@ ...@@ -1821,7 +1821,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1871,7 +1871,7 @@ ...@@ -1871,7 +1871,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1921,7 +1921,7 @@ ...@@ -1921,7 +1921,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -1971,7 +1971,7 @@ ...@@ -1971,7 +1971,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2021,7 +2021,7 @@ ...@@ -2021,7 +2021,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2071,7 +2071,7 @@ ...@@ -2071,7 +2071,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2121,7 +2121,7 @@ ...@@ -2121,7 +2121,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2171,7 +2171,7 @@ ...@@ -2171,7 +2171,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2221,7 +2221,7 @@ ...@@ -2221,7 +2221,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2271,7 +2271,7 @@ ...@@ -2271,7 +2271,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2321,7 +2321,7 @@ ...@@ -2321,7 +2321,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2371,7 +2371,7 @@ ...@@ -2371,7 +2371,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2421,7 +2421,7 @@ ...@@ -2421,7 +2421,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
...@@ -2471,7 +2471,7 @@ ...@@ -2471,7 +2471,7 @@
# This could technically be valid, but is unlikely. # This could technically be valid, but is unlikely.
>5 lequad !-1 >5 lequad !-1
>>5 lequad <32 {invalid} >>5 lequad <32 {invalid}
>>5 lequad >0x40000000 {invalid} #>>5 lequad >0x40000000 {invalid}
# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely. # These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions), # Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment