Search code examples
regexperlsnort

Perl regex to find specific hex character on snort

I'm pretty new to the Perl Regex and wanted to know, how I can write a Regex that would match a specific hex character, for example 0x90. I have tried: "[\x90]","\x90" but these seem not to work.. I using snort and need to make a rule that will find the 0x90 char in the text:

Alert TCP any any -> any any (msg: "Possible exploit"; pcre:"\x90"; sid:15444552;)

This is what I have tried but snort gives me an error:

ERROR: newRules.conf Line 9 => unable to parse pcre regex "\x90"

Any thoughts? Thanks!

Solution

  • You forgot to start and end with an slash /. In your case, pcre:"\x90" Should be pcre:"/\x90/"

    For further information take a look here