-
Notifications
You must be signed in to change notification settings - Fork 47
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bogus escape: '\\x' on word documents identification (container-signature updated : container-signature-20140923.xml) #56
Comments
I've fixed the regex generation in #59, however this doesn't fix the misidentification (which I am also seeing in some Office files). I can identify the same files using Siegfried correctly, so I believe the problem is in FIDO and not the signature files. |
DROID also returns a correct match using up-to-date container signatures. |
Deleted my previous comment, which was incorrect. In my case, I believe the matching signature is this one: <ContainerSignature Id="2030" ContainerType="ZIP">
<Description>Microsoft Excel OOXML</Description>
<Files>
<File>
<Path>[Content_Types].xml</Path>
<BinarySignatures>
<InternalSignatureCollection>
<InternalSignature ID="317">
<ByteSequence Reference="BOFoffset">
<SubSequence Position="1" SubSeqMinOffset="0" SubSeqMaxOffset="32768">
<Sequence>'ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"'</Sequence>
</SubSequence>
</ByteSequence>
</InternalSignature>
</InternalSignatureCollection>
</BinarySignatures>
</File>
</Files>
</ContainerSignature> FIDO produces the following regex from that signature:
Which is a valid regex which should match the file in question. |
Oh, I think I see what's going on. FIDO doesn't appear to do special handling of ZIP containers, e.g. it doesn't decompress them before attempting to read their contents, which means it can't match the plaintext sequences in the container signatures. |
I've added support for ZIP containers; there's a pull request open, #60. |
@florianajir Misty's PR #60 was merged and is part of 1.3.4 - are you still seeing this issue? |
All right I close the issue, thanks |
I tried to update conf/container-signature file (container-signature-20140923.xml) to see the difference on word document identification and the result is bad : docx files are no more recognized (identify as a zip), see :
with container-signature-20140923.xml :
with container-signature-20130501.xml :
I think the bug come from "bogus escape: '\x'"
The text was updated successfully, but these errors were encountered: