Regular expressions

During software audit, information fetched from each executable file is compared with application patterns which are saved in an application patterns base. While defining patterns, you can use the so called regular expressions to set detailed criteria which have to be fulfilled to identify the analysed file accurately.

Regular expressions are used to check whether an analysed text matches to a specified pattern. Regular expressions may include the following elements:

• Signs. All signs can be used in a pattern excluding special signs such as . * ? + ( ) { } [ ] ^ $ | . If a pattern includes any of them, it has to be preceded by the \ sign. Signs in an analysed text have to match with pattern signs.
   
• Filters.  . replaces any single sign. For example, if you specify Copyright 200. as a pattern, texts such as Copyright 2000, Copyright 2001, and so on, match. A filter for a number version is used the most frequently. For example 1\.0\..* means that the first section of a number is 1, followed by a dotand a 0, dot, and subsequent signs are unessential.
   
• Repetitions. Defining a filter, you can specify repetitions for a selected sign or signs sequences.
  A pattern section ending with *  may appear or be repeated any number of times. For example, for Alfa* pattern texts Alf, Alfa, Alfaa and so on, are correct.
  A pattern section ending with + has to be repeated at least once. For example, for a pattern Alfa+b texts such as Alfab, Alfaab etc. are correct.
  A pattern section ending with ?  can appear or be repeated only once. For example, for a pattern Alfa? texts such as Alf and Alfa are correct. Any other text does not match to the pattern.
  If it is essential to determine a number of repetitions precisely, you should use { } as operators. For example, a{2} means a letter repeated twice, and a{2,4} means a letter, which can be repeated at least twice and at most four times whereas, a{2,} means a letter, which has to repeated at least twice. A repetition definition does not apply to space characters, but there are no limitations for the minimum and maximum numbers of signs.
  If you want to define a repetition for a group of signs, you have to put brackets ( ) For example, for a pattern (ab)* texts such as ab, abab, ababab, and so on are correct. 
   
• Alternatives. An alternative in regular expressions corresponds to an “OR” logical operator (or) and it enables to define one of two possibilities. Alternative sections of a pattern are separated by the | . sign. For example, for the (b|c) pattern texts such as ab or ac are correct, whereas for a abc|def pattern - texts such as abc or def.
   
• Repertoires. These are character repertoires specified in patterns, which replace a single sign in the analysed text if it is included in a repertoire. Repertoires are put in brackets: [ ]. You can define single signs and whole ranges and then use predefined repertoires.
   
  Examples:
   
  [abc] replaces a, b or c signs.
  [^abc] replaces each sign excluding a, b or c.
  [a-z] replaces signs included in a range a to z.
  [^A-Z] replaces all signs excluding signs A to Z.
  
  Predefined repertoires are specified in a pattern according to a scheme [[:name_repertoire:]]. Repertoires names have been described in the following table.
   

  Name	Description
  alnum	Any alphanumeric sign (a letter or a digit).
  alpha	Any letter from a to z or from A to Z. And any other letter depending on system language settings e.g. Polish characters.
  blank	Space or tabulation.
  digit	Any digit from 0 to 9.
  lower	Any lower case from a to z or any other lower case depending on system language settings.
  cntrl	A check character (a character with ASCII code lower than 32).
  punct	Any sing which is not a check or alphanumeric sign.
  space	Any “white” sign e.g. a space character or tabulation.
  upper	Any upper case from A to Z or any other upper case depending on system language settings.
  xdigit	Any sign used to write numbers as hexadecimals (0-9, A-F).
  word	Any alphanumeric sign (a letter or digit), hyphen or apostrophe.

  Repertoires names in a [[:name:]] format described above can be replaced with shortcuts listed in the table below.

  Shortcut	Description
  \w	corresponds to [[:word:]]
  \W	corresponds to [^[:word:]]
  \s	corresponds to [[:space:]]
  \S	corresponds to [^[:space:]]
  \d	corresponds to [[:digit:]]
  \D	corresponds to [^[:digit:]]
  \l	corresponds to [[:lower:]]
  \L	corresponds to [^[:lower:]]
  \u	corresponds to [[:upper:]]
  \U	corresponds to [^[:upper:]]