From 6e5feaed4b964ad9a326209506cda0df610a8e80 Mon Sep 17 00:00:00 2001 From: zhengchao Date: Wed, 8 Jun 2016 14:39:17 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0rulescan.h?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/entry/Maat_rule.cpp | 2 +- src/inc_internal/rulescan.h | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/entry/Maat_rule.cpp b/src/entry/Maat_rule.cpp index b8f913c..50814a9 100644 --- a/src/entry/Maat_rule.cpp +++ b/src/entry/Maat_rule.cpp @@ -885,7 +885,7 @@ struct _Maat_scanner_t* create_maat_scanner(unsigned int version,int scan_thread //1.Do NOT set this option,rulescan return no hit detail as default; //2.Set all STR rule to QUICK; //rulescan_set_param(scanner->region,RULESCAN_DETAIL_RESULT,); - rulescan_set_param(scanner->region,RULESCAN_QUICK_SUBTYPE,NULL,0); + rulescan_set_param(scanner->region,RULESCAN_QUICK_SCAN,NULL,0); scanner->tomb_ref=tomb; scanner->region_rslt_buff=(scan_result_t*)malloc(sizeof(scan_result_t)*MAX_SCANNER_HIT_NUM*scan_thread_num); diff --git a/src/inc_internal/rulescan.h b/src/inc_internal/rulescan.h index e68885f..a2644b8 100644 --- a/src/inc_internal/rulescan.h +++ b/src/inc_internal/rulescan.h @@ -26,9 +26,9 @@ extern "C" /* rulescan_set_param函数可设置的参数类型 */ enum RULESCAN_PARA_NAME { - RULESCAN_DETAIL_RESULT=1, /* 本标志位表示：返回详细命中位置等信息 */ - RULESCAN_REGEX_GROUP =2, /* 本标志位表示：返回正则表达式匹配的分组信息；开启本字段，需要先设置RULESCAN_DETAIL_RESULT标志位 */ - RULESCAN_QUICK_SUBTYPE /* 设置需要快速扫描的子类类型, 由用户自己定义，若设置了某个子类为快速扫描类型，则该子类不能再作为普通子类类型使用 */ + RULESCAN_DETAIL_RESULT=1, /* 本标志位表示：返回详细命中位置等信息, optval设为NULL，optlen设为0。默认不返回详细信息*/ + RULESCAN_REGEX_GROUP =2, /* 本标志位表示：返回正则表达式匹配的分组信息；开启本字段，需要先设置RULESCAN_DETAIL_RESULT标志位,optval设为NULL，optlen设为0。默认不返回分组信息 */ + RULESCAN_QUICK_SCAN /* 设置需要快速扫描模式, 由用户自己定义，optval设为NULL，optlen设为0。默认设置是普通扫描模式。*/ }; #define MAX_REGEX_GROUP_NUM 5 /* 对于正则表达式，所支持的最大分组的个数 */