regexman
(reg)
October 10, 2021, 5:41pm
#1
well if the title didnt make sense, i want to make a script that detects the script source for a word WITH a string pattern like “require(%d+$)”
nothing really helped me
and if this was asked before, dont blame me i found nothing from the search bar.
anyway, not only that it would help me, it might help antiviruses on reducing false positives, too
D0RYU
(nici)
October 10, 2021, 5:44pm
#2
what string are you working with and what do you want it to turn into?
post confused me a bit
me_isidoit
(me_isidoit)
October 10, 2021, 5:45pm
#3
Can you elaborate on what do you mean? I don’t understand this post.
Script source is only accessible to plugin scripts.
regexman
(reg)
October 10, 2021, 5:46pm
#4
i think you didnt understand it, im working on an antivirus and im trying to reduce false positives by detecting a word with a string pattern
regexman
(reg)
October 10, 2021, 5:46pm
#5
yeah im working on an plugin antivirus
regexman
(reg)
October 10, 2021, 5:47pm
#6
im trying to detect a word with a string pattern at the same time
me_isidoit
(me_isidoit)
October 10, 2021, 5:47pm
#7
Elaborate on the “word with a string pattern” part and what did you mean by “require(%d+$)”? %d
is a pattern for integers, not words.
regexman
(reg)
October 10, 2021, 5:48pm
#8
ok, like for example theres a virus with a require
require(virusmodule)
and i want to detect if it has require with numbers
because require(mainmodule) is not malicious
me_isidoit
(me_isidoit)
October 10, 2021, 5:50pm
#9
local id = source:match("require%((%d+)%)")
This pattern should work (if that’s what you mean). It also returns the required module ID.
You didn’t escape the (
and )
characters properly, that’s why it doesn’t work.
This is the string pattern you are looking for that also accounts for whitespaces, variables and IDs:
require%s*%(%s*([%w_.]+)%s*%)%s*
regexman
(reg)
October 10, 2021, 5:51pm
#13
Thanks too, I will try both 300000 cha rss
regexman
(reg)
October 10, 2021, 5:52pm
#14
okay I will try that too 30 ch ars
regexman
(reg)
October 10, 2021, 5:55pm
#15
It worked, tysm now I can finally decrease false positives
1 Like
regexman
(reg)
October 10, 2021, 5:56pm
#16
yeah it works but not with string patterns, thanks anyway
regexman
(reg)
October 10, 2021, 5:58pm
#17
Always printed “malicious”, thanks anyway