Difference between revisions of "ProtocolFilter"
| Line 2: | Line 2: | ||
==Usage== | ==Usage== | ||
| − | ProtocolFilter: | + | ProtocolFilter:<protocl name>,<class guid>[,advanced file parameters] |
===Examples=== | ===Examples=== | ||
| − | + | ProtocolFilter:"SBI Test Entry 1","{CAFFEE60-1234-1234-1234-581735711111}","filesize>=1" | |
===Description=== | ===Description=== | ||
# Specify name of filter first. Use an [[AlgoPrefix|Algo-Prefix]] if you want. {{AlgoPrefix}} | # Specify name of filter first. Use an [[AlgoPrefix|Algo-Prefix]] if you want. {{AlgoPrefix}} | ||
| − | # Continue | + | # Continue by the associated class ID, which also needs to be matched. Use an [[AlgoPrefix|Algo-Prefix]] if you want. {{AlgoPrefix}} |
# To further limit the detection, you can specify [[Advanced file parameters|advanced file parameters]] for the file associated with the protocol filter. | # To further limit the detection, you can specify [[Advanced file parameters|advanced file parameters]] for the file associated with the protocol filter. | ||
| + | |||
| + | ===Scan Results=== | ||
| + | * The protocol filter registry key. | ||
| + | * The associated CLSID, if found. | ||
| + | * The file (usually a library) used by the protocol filter, but only if [[Advanced file parameters|advanced file parameters]] were specified. | ||
==See also== | ==See also== | ||
| Line 17: | Line 22: | ||
===Similar commands=== | ===Similar commands=== | ||
| + | * [[RegyKey]] | ||
[[Category:SBI Commands]] | [[Category:SBI Commands]] | ||
| − | |||
Revision as of 12:30, 18 February 2008
Detects protocol filters.
Usage
ProtocolFilter:<protocl name>,<class guid>[,advanced file parameters]
Examples
ProtocolFilter:"SBI Test Entry 1","{CAFFEE60-1234-1234-1234-581735711111}","filesize>=1"
Description
- Specify name of filter first. Use an Algo-Prefix if you want. AP
- Continue by the associated class ID, which also needs to be matched. Use an Algo-Prefix if you want. AP
- To further limit the detection, you can specify advanced file parameters for the file associated with the protocol filter.
Scan Results
- The protocol filter registry key.
- The associated CLSID, if found.
- The file (usually a library) used by the protocol filter, but only if advanced file parameters were specified.
