RE: sophie not detecting some viruses

it's still unclear to me.

SOPHOS_TYPE_U16 is unsigned short int and should accomodate 0..65535.

I enabled some printing in sophie_init.c and got even something like that:

NOTICE           : Option 'GrpArchiveUnpack' set to '3'

so SOPHOS_FAILED(hr) was false, i.e. SAVI didn't fail and accepted '3' as
option value.

but still, sophie -c reports value of 1 .

more explanation?

Maciek

> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]]On Behalf Of Renato
> Sent: Wednesday, January 21, 2004 11:30 PM
> To: Discussion about Virge/Sophie/Trophie/...
> Subject: RE: [vtools] sophie not detecting some viruses
>
>
> It looks like every parameter of SAVIlib is either
> SOPHOS_TYPE_U16 or SOPHOS_TYPE_U32 type. If you take a
> look at sophie_init.c, you will see that the only one
> that is SOPHOS_TYPE_U32, is "MaxRecursionDepth".
>
> I did an experiment and tried to pass '2' to
> GrpArchiveUnpack using SOPHOS_TYPE_U32 type (
> hardcoded ). Sophie complained about this parameter
> and didn't let me do this, using, therefore the
> default value, which is 2... then I concluded that '2'
> should be equal to '0', since the only two possible
> values you could set programatically is either 0 or
> 1... ( I don't understand how '2' could be a default
> if it doesn't accept SOPHOS_TYPE_U32... )
>
> I hope I could make myself clear...
>
> --- Maciej Uhlig <[email protected]> wrote:
> > Vanja:
> >
> > > Now that you tried it, it looks so obvious :)
> > >
> > > It is enough to remove/rename /etc/sophie.savi
> > file in order for Sophie to
> > > use Sophos defaults (forgot that I've added that
> > 'fallback' long time
> > > ago). Detects the virus now.
> > >
> > > "sophie -c" will list the default options, but
> > guessing the combinations
> > > of options (to see which one screws up) will take
> > some time.
> >
> > do you happen to know the meaning of all possible
> > option values for Sophos
> > options?
> >
> > this question is based on the fact Markus in his
> > mail "more problems" used 0
> > and 1 only,
> > while Sophos default seems to be 2 (at least for
> > group options), for
> > instance:
> >
> > | GrpArchiveUnpack                  |    9 |   2 |
> >
> > is 0 equal to 2, as Renato suggested, or more, 3 is
> > possible too (pure
> > speculation :-))
> >
> > is anybody able to clarify this?