File tree 2 files changed +4
-8
lines changed
2 files changed +4
-8
lines changed Original file line number Diff line number Diff line change @@ -117,7 +117,6 @@ int yr_atoms_heuristic_quality(
117
117
118
118
int quality = 0 ;
119
119
int unique_bytes = 0 ;
120
- int masked_nibbles = 0 ;
121
120
int i ;
122
121
123
122
assert (atom -> length <= YR_MAX_ATOM_LENGTH );
@@ -129,15 +128,13 @@ int yr_atoms_heuristic_quality(
129
128
switch (atom -> mask [i ])
130
129
{
131
130
case 0x00 :
132
- masked_nibbles += 2 ;
131
+ quality -= 6 ;
133
132
break ;
134
133
case 0x0F :
135
- masked_nibbles += 1 ;
136
- quality += 4 ;
134
+ quality += 1 ;
137
135
break ;
138
136
case 0xF0 :
139
- masked_nibbles += 1 ;
140
- quality += 4 ;
137
+ quality += 1 ;
141
138
break ;
142
139
case 0xFF :
143
140
switch (atom -> bytes [i ])
@@ -180,8 +177,6 @@ int yr_atoms_heuristic_quality(
180
177
quality -= 10 * atom -> length ;
181
178
}
182
179
183
- quality -= masked_nibbles * 3 ;
184
-
185
180
return YR_MAX_ATOM_QUALITY - 20 * YR_MAX_ATOM_LENGTH + quality ;
186
181
}
187
182
Original file line number Diff line number Diff line change @@ -189,6 +189,7 @@ void test_heuristic_quality()
189
189
assert_true_expr (q000102 > q000001 );
190
190
assert_true_expr (q00010203 > q010203 );
191
191
assert_true_expr (q010203 > q0102 );
192
+ assert_true_expr (q010203 > q00000000 );
192
193
assert_true_expr (q0102 > q01 );
193
194
assert_true_expr (q01X203 > q0102 );
194
195
assert_true_expr (q01X203 > q0001 );
You can’t perform that action at this time.
0 commit comments