Re: Binary Comparision

[ikegami]

if ($line eq @virus[$x])
should be
if (index($line, $virus[$x]) >= 0)
because the signature might not occupy the entire "line".

Furthermore, the virus could span more than one "line", so
if (index($line, $virus[$x]) >= 0)
should be
if (index($raw_data, $virus[$x]) >= 0)

If you start using read, be careful not to reintroduce the problem. The signature could span more than one block of data.

Next, you should optimize your algo to search for more than one virus at once. For example, if Virus.A has signature "asdfgjkl" and Virus.B has signature "asdfhjkl", it could be faster to search using /asdf[gh]jkl/.

[extremely]

When I've built these sorts of byte and bit scanners in the past I've tended to use two buffers to read into. I make one buffer the size of the largest search string and the other twice that size. Then I scan across the larger buffer to the halfway point, move the 2nd half of the data in the buffer up and stick a new chunk on it.

Later, I gave up on that and just used a 4 or 8k buffer that I loaded the second half of and worked in it. This strategy beats the file-size limit and the span issue at the same time.

Bit-wise scanning sucks, tho. That just isn't fun in Perl 5.

[ikegami]

Thanks, but I've already implemented that my other post. I even optimized it to limit the amount of bytes that are scanned twice.

$block = substr($block, -($longuest_sig_len-1)) .    $_;
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   ^^^^^^^^^
            Minimal portion of last block         New block