View source

[Page] [Discussion] [View source] [History]

You do not have permission to do that, for the following reason:

The action you have requested is limited to users in the group vbeditor.

You can view and copy the source of this page:

==Description==
''Advanced file parameters'' are parameters used in certain file-related [[SBI Commands|commands]] to scan file contents. You usually specify a comma separated list of parameters which then gets combined in an optimized AND operation, from left to right, stopping when a condition does not match. This leads to a few useful things:

# Put easy tests in front, to avoid heavy cost tests executed when not necessary.
#* Parameters to check the environment (regarding [[:Category:Advanced file parameters for Flow Control|flow control]]) belong to the very beginning since they're cheapest.
#* [[:Category:Advanced file parameters for Basic Attributes|Basic attributes]] and cached operations (like [[:Category:Advanced file parameters for File Hashes|file hashes]]) are usually quite cheap.
# Add heavy cost and active [[:Category:Advanced file parameters for Flow Control|flow control]] parameters to the end.
#* Add parameters to set the environment to the '''very''' end to have them set only when the file was identified by all previous parameters.
#* Parameters for [[:Category:Advanced file parameters for Binary Anywhere Matching|Binary anywhere matching]] are probably the most costly operations.

The field used for ''advanced file parameters'' can often also be used for [[Advanced build parameters|advanced build parameters]], check the actual [[SBI Commands|command]] for details.

==Comparators==
Standard operations usually consist of the form ''parametername=value'', comparing whether a property ''equals'' (=) a value. Each parameters details page also lists variants that sometimes do allow other comparisons, e.g. to check whether sometimes does ''not equal'' (!=), as well as ''greater or equal'' (>=) and ''lesser or equal'' (<=) comparisons.

While versions of [[advcheck.dll]] up to 1.5.2 did have these additional comparators available only where intentionally hardcoded, 1.6 brings a more flexible advanced parameters handling system that allows the ''not equal'' comparison for all parameters, and ''greater or equal'' and ''lesser or equal'' for all numeric parameters, even those prefixed by e.g. resource names as seen [[size(res)]].

==Examples==
 filesize=10,md5=1234567890ABCDEFFEDCBA0987654321

As soon as spaces appear, you need to put quotes around that parameter:

 filesize=10,"field[ver]=CompanyName|Malware Inc."

Keep in mind that in the bigger context of the parameter list of the actual [[SBI Commands|command]], you need to escape quotes by doubling them:

 File:"Example","<$WINDIR>\Malware.exe","filesize=10,""field[ver]=CompanyName|Malware Inc."""

Return to Advanced file parameters.

Retrieved from "http://wiki.spybot.info/index.php/Advanced_file_parameters"