Path: csiph.com!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Unknown Newsgroups: alt.os.linux.slackware,comp.os.linux.misc,alt.os.linux.debian Subject: Re: Which files/S contain the virus? Date: Mon, 11 Jan 2016 17:03:05 -0000 (UTC) Organization: A noiseless patient Spider Lines: 106 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Injection-Date: Mon, 11 Jan 2016 17:03:05 -0000 (UTC) Injection-Info: mx02.eternal-september.org; posting-host="158ccd28a846bcd75d5573f7f6090e3e"; logging-data="7991"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/J28F+AxQunh0iFYXhayVEVKc2NZTeYKY=" User-Agent: Pan/0.133 (House of Butterflies) Cancel-Lock: sha1:BCmUMYpE6J8vN5kt+O/jri9BqnY= Xref: csiph.com alt.os.linux.slackware:26090 comp.os.linux.misc:16716 alt.os.linux.debian:7751 On Tue, 05 Jan 2016 14:40:05 +0000, Joe Beanfish wrote: > On Tue, 05 Jan 2016 11:06:19 +0000, Rich wrote: >> In alt.os.linux.slackware no.top.post@gmail.com wrote:\ > [annoying trolling snipped] >>> My current problem is to find text-files which contain xE2 = d226. >>> `sed` can clean them, but I want to see them first. >> >>> find ./ -type f -exec sed '/\d226/!d' {} \; find ./ -type f -exec >>> sed '/\xe2/!d' {} \; >> >>> prints the lines containing a hex(E2) char, which I can then paste >>> into `mc` or some grepper, to get the fileName. >> >>> It's a pity that *nix is so ad hoc ? >>> AFAICS the character-classes listed for `grep` and `sed` are very >>> different. `sed` gives me the ability to specify any char/byte; but >>> `grep` doesn't cater for all 256. >> >>> What am I missing? >> >> That Chris Glur is an idiot. >> >> $ echo -e "\xe2\x80" > magic-quote >> $ xxd magic-quote >> 0000000: e280 0a >> $ cp magic-quote magic-quote2 >> $ grep $'\xe2' magic-quote* >> magic-quote:†>> magic-quote2:†>> >> Grep works just fine with any character you give it to search (other >> than maybe an ASCII null). But first, you have to type the characters >> into the shell in such a way that Bash understands your meaning. You >> can not directly type a \xe2 character (well, not easily) from the >> keyboard. So you have to tell Bash "this next thing is a special >> character". That is what the $'\xe2' piece does. It tells Bash "this >> next thing is a special character that can't be directly typed on the >> keyboard". >> >> The problem, as always, was your failure to understand. > > The real issue is that grep doesn't have it's own functional syntax for > representing any character (not sure when gnu broke this). Your method > requires a particular shell trick rather than standalone grep or when > running from a shell that doesn't know that trick. If one resorts to > perl regexp with -P there is some function but still not complete: > > $ echo -e "abc\xe2\x80" > magic-quote $ echo -e "\xe2\x80" > > magic-quote2 > $ xxd magic-quote > 00000000: 6162 63e2 800a abc... $ xxd > magic-quote2 > 00000000: e280 0a ... $ grep -P '\x62' > magic-quote* > Binary file magic-quote matches > $ grep -P '\142' magic-quote* > Binary file magic-quote matches > $ grep -P '\xe2' magic-quote* > [no match] > $ grep -P '\342' magic-quote* > [no match] > $ grep --version > grep (GNU grep) 2.21 > Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU > GPL version 3 or later . This is free > software: you are free to change and redistribute it. There is NO > WARRANTY, to the extent permitted by law. > > Written by Mike Haertel and others, see > . ===== Yes, and my version seems to find more than yours, eg. for the "[no match]" :--- -> grep -P '\x62' magic-quote* == magic-quote:abc€€ -> grep -P '\142' magic-quote* == magic-quote:abc€€ -> grep -P '\xe2' magic-quote* == magic-quote:abc€€ magic-quote2:€€ -> grep -P '\342' magic-quote* == magic-quote:abc€€ magic-quote2:€€ -> man grep == ... -P, --perl-regexp Interpret PATTERN as a Perl regular expression.This is highly experimental and grep -P may warn of unimplemented features. No thank you ! =============== OK, I had a lie-down to relax with TTS, and decided: so what if I object to 100 functions, each with 100 options = *nix ad-hokery and that I hate perl; I'll put it in my library, as: FindQtVirusD # Show files with apostrophe virus in DIR find $1 -type f -exec grep -Pl '\xe2' {} \; ==== It's already put to work. Thanks, take the rest of the day off. And ad-homenen: don't forget to take your meds.