bogus escape: '\\x' on word documents identification (container-signature updated : container-signature-20140923.xml) about fido HOT 7 CLOSED

I've fixed the regex generation in #59, however this doesn't fix the misidentification (which I am also seeing in some Office files). I can identify the same files using Siegfried correctly, so I believe the problem is in FIDO and not the signature files.

from fido.

DROID also returns a correct match using up-to-date container signatures.

from fido.

Deleted my previous comment, which was incorrect.

In my case, I believe the matching signature is this one:

        <ContainerSignature Id="2030" ContainerType="ZIP">
            <Description>Microsoft Excel OOXML</Description>
            <Files>
                <File>
                    <Path>[Content_Types].xml</Path>
                    <BinarySignatures>
                        <InternalSignatureCollection>
                            <InternalSignature ID="317">
                                <ByteSequence Reference="BOFoffset">
                                    <SubSequence Position="1" SubSeqMinOffset="0" SubSeqMaxOffset="32768">
                                        <Sequence>'ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"'</Sequence>
                                    </SubSequence>
                                </ByteSequence>
                            </InternalSignature>
                        </InternalSignatureCollection>
                    </BinarySignatures>
                </File>
            </Files>
        </ContainerSignature> 

FIDO produces the following regex from that signature:

(?s)ContentType="application/vnd\.openxmlformats-officedocument\.spreadsheetml\.sheet\.main\+xml"

Which is a valid regex which should match the file in question.

from fido.

Oh, I think I see what's going on. FIDO doesn't appear to do special handling of ZIP containers, e.g. it doesn't decompress them before attempting to read their contents, which means it can't match the plaintext sequences in the container signatures.

from fido.

I've added support for ZIP containers; there's a pull request open, #60.

from fido.

@florianajir Misty's PR #60 was merged and is part of 1.3.4 - are you still seeing this issue?

from fido.

All right I close the issue, thanks

from fido.