NTFile - Revision history

CCRDude: typo in syntax in box

2008-02-23T13:59:01Z

typo in syntax in box

← Older revision		Revision as of 13:59, 23 February 2008
Line 1:		Line 1:
	{{SbiCmdInfo		{{SbiCmdInfo
	\|SYNTAX = ~~NRFile~~		\|SYNTAX = NTFile
	\|PENAME = Plugins		\|PENAME = Plugins
	\|PEVERSION = 1.4		\|PEVERSION = 1.4

CCRDude: /* Usage */ added var types

2008-02-22T16:27:28Z

Usage: added var types

← Older revision		Revision as of 16:27, 22 February 2008
Line 12:		Line 12:

	==Usage==		==Usage==
	NTFile:<description>,<filename>[,advanced file parameters]		NTFile:<description(string)>,<filename(string)>[,advanced file parameters]

	===Examples===		===Examples===

CCRDude: /* Examples */ added some from File

2008-02-22T16:27:09Z

Examples: added some from File

← Older revision		Revision as of 16:27, 22 February 2008
Line 15:		Line 15:

	===Examples===		===Examples===
	~~See~~ [[File]].		Identical to [[File]]:
			NTFile:"<$FILE_DATA>","<$WINDIR>\Malware.txt","filesize=182,md5=83C36C493D7A254F9DE2ED63B3F92548"
			NTFile:"<$FILE_DATA>","<wc>C:\Temp\Malware.*","filesize>=180,md5=83C36C493D7A254F9DE2ED63B3F92548"
			NTFile:"<$FILE_DATA>","<regexpr>C:\Temp\Mal[a-z]{4}.*","filesize<=190,md5=83C36C493D7A254F9DE2ED63B3F92548"

	===Description===		===Description===

CCRDude: fixed info box syntax

2008-02-22T13:11:18Z

fixed info box syntax

← Older revision		Revision as of 13:11, 22 February 2008
Line 1:		Line 1:
	{{SbiCmdInfo		{{SbiCmdInfo
	\|SYNTAX = ~~File~~		\|SYNTAX = NRFile
	\|PENAME = Plugins		\|PENAME = Plugins
	\|PEVERSION = 1.4		\|PEVERSION = 1.4

CCRDude: added info box

2008-02-22T13:09:06Z

added info box

← Older revision		Revision as of 13:09, 22 February 2008
Line 1:		Line 1:
	Identifies files, using the Windows NT native mode, to avoid rootkit hiding in Windows 32 mode.		{{SbiCmdInfo
			\|SYNTAX = File
			\|PENAME = Plugins
			\|PEVERSION = 1.4
			\|GROUP = Files
			\|MINUPDATE = 2008-03-05 (Plugins)
			\|ADVFILEPARAMS = yes (third)
			\|ADVREGPARAMS = no
			\|ADVBUILDPARAMS = yes (third)
			\|ADVSPECIALPARAMS = no
			}}Identifies files, using the Windows NT native mode, to avoid rootkit hiding in Windows 32 mode.

	==Usage==		==Usage==

CCRDude: /* See also */

2008-02-21T16:37:34Z

See also

New page

Identifies files, using the Windows NT native mode, to avoid rootkit hiding in Windows 32 mode.

==Usage==
NTFile:<description>,<filename>[,advanced file parameters]

===Examples===
See [[File]].

===Description===
This command defines where to look for files. It accepts three parameters:

# The first parameter is a simple description, used for the GUI to display to the user only. Instead of using plain text, it is recommended to use [[Description templates|description templates]], which are displayed in a localized version by the scanner GUI.
# The second parameter defines the file name and path. In the standard form, it supports wildcards and [[Path templates|path templates]], but you can also use [[AlgoPrefix|Algo-Prefixes]] to vary the filename matching algorithm, e.g. to use regular expressions. Please note that any pattern apply to the file name only! The file path cannot be varied, but if you specify advanced parameters, the On-Access scanner will simply ignore the path. {{AlgoPrefix}} {{PathTemplates}}
# The third parameter allows you to define more criteria to look for in a file, since the file name itself is rarely unique (just think about all those misleading malware files that attempt to use standard Windows filenames). There is a huge range of [[Advanced file parameters|advanced file parameters]], with different costs, some cached, some not. Using less costly parameters like [[filesize]] first is quite recommended to filter the amount of files that are left for the later parameters.

===Scan Results===
* The file identified by the parameters.

==See also==
* [[Advanced file parameters]]; especially [[exists(file)]]

===Similar commands===
* [[File]]
* [[HandleFile]]

[[Category:SBI Commands]]

CCRDude: New page: Identifies files, using the Windows NT native mode, to avoid rootkit hiding in Windows 32 mode. ==Usage== NTFile:,[,advanced file parameters] ===Examples=== See [...

2008-02-18T13:57:07Z

New page: Identifies files, using the Windows NT native mode, to avoid rootkit hiding in Windows 32 mode. ==Usage== NTFile:<description>,<filename>[,advanced file parameters] ===Examples=== See [...

New page

Identifies files, using the Windows NT native mode, to avoid rootkit hiding in Windows 32 mode.

==Usage==
NTFile:<description>,<filename>[,advanced file parameters]

===Examples===
See [[File]].

===Description===
This command defines where to look for files. It accepts three parameters:

# The first parameter is a simple description, used for the GUI to display to the user only. Instead of using plain text, it is recommended to use [[Description templates|description templates]], which are displayed in a localized version by the scanner GUI.
# The second parameter defines the file name and path. In the standard form, it supports wildcards and [[Path templates|path templates]], but you can also use [[AlgoPrefix|Algo-Prefixes]] to vary the filename matching algorithm, e.g. to use regular expressions. Please note that any pattern apply to the file name only! The file path cannot be varied, but if you specify advanced parameters, the On-Access scanner will simply ignore the path. {{AlgoPrefix}} {{PathTemplates}}
# The third parameter allows you to define more criteria to look for in a file, since the file name itself is rarely unique (just think about all those misleading malware files that attempt to use standard Windows filenames). There is a huge range of [[Advanced file parameters|advanced file parameters]], with different costs, some cached, some not. Using less costly parameters like [[filesize]] first is quite recommended to filter the amount of files that are left for the later parameters.

===Scan Results===
* The file identified by the parameters.

==See also==
* [[Advanced file parameters]]

===Similar commands===
* [[File]]
* [[HandleFile]]

[[Category:SBI Commands]]