Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: [Original edit by JohnHardin] fix "V" expansion

...

No Format
   loadplugin            ReplaceTags  /path/to/plugin/ReplaceTags.pm
  replace_rules         VIAGRA_OBFU CIALIS_OBFU # ... and so on
  replace_start         <
  replace_end           >

  # Example classes
  replace_class         A               [\@\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xe4\xe3\xe2\xe0\xe1\xe2\xe3\xe4\xe5\xe6]
  replace_class         G               [gk]
  replace_class         I               [il\|\!1y\?\xcc\xcd\xce\xcf\xec\xed\xee\xef]
  replace_class         R               [r3]
  replace_class         V               [v(?:[vu]|\\\/wu])
  replace_class         SP              [\s\d\_\-\*\$\%\(\)\,\.\:\;\?\!\}\{\[\]\|\/\?\^\#\~\xa1\Ž\`\'\+]

  # Small functional example
  body                  VIAGRA_OBFU     /(?!viagra)<V>+<SP>*<I>+<SP>*<A>+<SP>*<G>+<SP>*<R>+<SP>*<A>+/i
  describe              VIAGRA_OBFU     obfuscated match "viagra"
  score                 VIAGRA_OBFU     3

  body                  VIAGRA          /viagra/i
  describe              VIAGRA          match plain "viagra"
  score                 VIAGRA          1.5

...