RegEx - Pattern Match

[mrsold]

Hey everyone,

I'm attempting to build a pattern match for a custom vulnerability.  Here are the criteria:

• File is always a random 24 character file with a '.exe' extension
• First three characters are always 'e54'

I had the following regex built, but the PA doesn't like it for some reason.

(e54([a-zA-Z0-9]{21})\.exe)

It gives me some invalid character internal error.  Any thoughts?

[HULK]

Hello mrsold,

A Pattern must be at least 7 bytes. In the entire pattern there must exist at least one 7 byte string that has fixed values.

Regular expression syntax for patterns in custom app signatures

Thanks

[mrsold]

HULK wrote:

Hello mrsold,

A Pattern must be at least 7 bytes. In the entire pattern there must exist at least one 7 byte string that has fixed values.

Regular expression syntax for patterns in custom app signatures

Thanks

Thanks Hulk. 

Am I counting wrong?  I thought that string I posted is at least 7 bytes.

[HULK · Accepted solution]

Hello mrsold,

There should be a continuous 7 byte string.

Examples

-> pattern -> a -> regex 'abc[abc]{3}abc.*abc' is invalid.

->  'abc.{3}abcdefg.*abc' ----is valid >>>>>>>> 7 byte

        -> foo.*bar.*foobarfoo   (invalid)

        ->  foo.*fooba       (valid)

Hope this helps.

Thanks

[mrsold]

HULK wrote:

Hello mrsold,

There should be a continuous 7 byte string.
Examples
-> pattern -> a -> regex 'abc[abc]{3}abc.*abc' is invalid.
->  'abc.{3}abcdefg.*abc' ----is valid >>>>>>>> 7 byte
        -> foo.*bar.*foobarfoo   (invalid)
        ->  foo.*fooba       (valid)

Hope this helps.

Thanks

Ah yes, the continuous is a very important part.

Thanks!