hi,
i am studying snort rules and found some pcre expressions i can't
understand, like:
.... \s*\x3a\s*{?\s*B973393F-27C7-4781-877D-8626AAEDF119\s*}?\s*...
what does the {?s*....} part mean in this re? i can't find any docs
explaining this(what i know about {} is it can be used with quantifier
or Unicode option). would you guys kindly tell me? thanks a lot.
ps: the intact re is :
/(<object\s*[^>]*\s*id\s*=\s*(?P<m7>\x22|\x27|)(?P<id1>.+?)(?P=m7)(\s|
>)[^>]*\s*classid\s*=\s*(?P<q14>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*B973
393F-27C7-4781-877D-8626AAEDF119\s*}?\s*(?P=q14)(\s|>).*(?P=id1)\s*\.\
s*(SaveLastError)|<object\s*[^>]*\s*classid\s*=\s*(?P<q15>\x22|\x27|)\
s*clsid\s*\x3a\s*{?\s*B973393F-27C7-4781-877D-8626AAEDF119\s*}?\s*(?P=
q15)(\s|>)[^>]*\s*id\s*=\s*(?P<m8>\x22|\x27|)(?P<id2>.+?)(?P=m8)(\s|>)
.*(?P=id2)\.(SaveLastError))\s*\(/si
pretty big huh.
Zhang
--
## List details at http://lists.exim.org/mailman/listinfo/pcre-dev
