Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux.slackware > #26090

Re: Which files/S contain the virus?

Cross-posted to 3 groups.

Show key headers only | View raw

On Tue, 05 Jan 2016 14:40:05 +0000, Joe Beanfish wrote:

> On Tue, 05 Jan 2016 11:06:19 +0000, Rich wrote:
>> In alt.os.linux.slackware no.top.post@gmail.com wrote:\
> [annoying trolling snipped]
>>> My current problem is to find text-files which contain xE2 = d226.
>>> `sed` can clean them, but I want to see them first.
>> 
>>>   find ./ -type f -exec sed '/\d226/!d' {} \; find ./ -type f -exec
>>>   sed '/\xe2/!d' {} \;
>> 
>>> prints the lines containing a hex(E2) char, which I can then paste
>>> into `mc` or some grepper, to get the fileName.
>> 
>>> It's a pity that *nix is so ad hoc ?
>>> AFAICS the character-classes listed for `grep` and `sed` are very
>>> different. `sed` gives me the ability to specify any char/byte; but
>>> `grep` doesn't cater for all 256.
>> 
>>> What am I missing?
>> 
>> That Chris Glur is an idiot.
>> 
>>   $ echo -e "\xe2\x80" > magic-quote
>>   $ xxd magic-quote
>>   0000000: e280 0a
>>   $ cp magic-quote magic-quote2
>>   $ grep $'\xe2' magic-quote*
>>   magic-quote:â€
>>   magic-quote2:â€
>> 
>> Grep works just fine with any character you give it to search (other
>> than maybe an ASCII null).  But first, you have to type the characters
>> into the shell in such a way that Bash understands your meaning.  You
>> can not directly type a \xe2 character (well, not easily) from the
>> keyboard.  So you have to tell Bash "this next thing is a special
>> character".  That is what the $'\xe2' piece does.  It tells Bash "this
>> next thing is a special character that can't be directly typed on the
>> keyboard".
>> 
>> The problem, as always, was your failure to understand.
> 
> The real issue is that grep doesn't have it's own functional syntax for
> representing any character (not sure when gnu broke this). Your method
> requires a particular shell trick rather than standalone grep or when
> running from a shell that doesn't know that trick. If one resorts to
> perl regexp with -P there is some function but still not complete:
> 
> $ echo -e "abc\xe2\x80" > magic-quote $ echo -e "\xe2\x80" >
> magic-quote2
> $ xxd magic-quote
> 00000000: 6162 63e2 800a                           abc... $ xxd
> magic-quote2
> 00000000: e280 0a                                  ... $ grep -P '\x62'
> magic-quote*
> Binary file magic-quote matches
> $ grep -P '\142' magic-quote*
> Binary file magic-quote matches
> $ grep -P '\xe2' magic-quote*
>   [no match]
> $ grep -P '\342' magic-quote*
>   [no match]
> $ grep --version
> grep (GNU grep) 2.21
> Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU
> GPL version 3 or later <http://gnu.org/licenses/gpl.html>. This is free
> software: you are free to change and redistribute it. There is NO
> WARRANTY, to the extent permitted by law.
> 
> Written by Mike Haertel and others, see
> <http://git.sv.gnu.org/cgit/grep.git/tree/AUTHORS>.
=====
Yes, and my version seems to find more than yours,
eg. for the "[no match]"  :---

-> grep -P '\x62' magic-quote* == magic-quote:abc€€
-> grep -P '\142' magic-quote* == magic-quote:abc€€
-> grep -P '\xe2' magic-quote* == 
magic-quote:abc€€
magic-quote2:€€
-> grep -P '\342' magic-quote* ==
magic-quote:abc€€
magic-quote2:€€

-> man grep  == ...
 -P, --perl-regexp
  Interpret PATTERN as a Perl regular expression.This is highly
  experimental and grep -P may warn of unimplemented features.

No thank you !

=============== OK, I had a lie-down to relax with TTS, and
decided: so what if I object to 100 functions, each with
100 options = *nix ad-hokery and that I hate perl; I'll put it
in my library, as: FindQtVirusD
# Show files with apostrophe virus in DIR
find $1 -type f -exec grep -Pl '\xe2' {} \;
==== It's already put to work.

Thanks,
  take the rest of the day off. 
And ad-homenen: don't forget to take your meds.

Back to alt.os.linux.slackware | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Which files/S contain the virus? no.top.post@gmail.com - 2016-01-05 07:18 +0000
  Re: Which files/S contain the virus? Rich <rich@example.invalid> - 2016-01-05 11:06 +0000
    Re: Which files/S contain the virus? Joe Beanfish <joebeanfish@nospam.duh> - 2016-01-05 14:40 +0000
      Re: Which files/S contain the virus? Teemu Likonen <tlikonen@iki.fi> - 2016-01-05 17:48 +0200
      Re: Which files/S contain the virus? Unknown <dog@gmail.com> - 2016-01-11 17:03 +0000
  Re: Which files/S contain the virus? William Unruh <unruh@invalid.ca> - 2016-01-05 17:36 +0000
    Re: Which files/S contain the virus? Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2016-01-05 10:51 -0800
  Re: Which files/S contain the virus? Dan C <youmustbejoking@lan.invalid> - 2016-01-08 03:40 +0000
    Re: Which files/S contain the virus? "John K.  Herreshoff" <Nope@not.here> - 2016-01-08 08:44 -0500

csiph-web