NoProfileMode STDERR Output: Maximum Bytes

[ross-spencer]

When NoProfileMode starts up it begins with these messages:

  2016-07-21 11:31:40,576  WARN Signature [id:1060] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,578  WARN Signature [id:1070] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,579  WARN Signature [id:1080] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,589  WARN Signature [id:318] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,591  WARN Signature [id:318] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,592  WARN Signature [id:318] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,594  WARN Signature [id:3040] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,595  WARN Signature [id:3050] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,596  WARN Signature [id:3060] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,598  WARN Signature [id:3070] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,599  WARN Signature [id:3080] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,600  WARN Signature [id:3090] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,602  WARN Signature [id:3100] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,605  WARN Signature [id:3110] will always scan up to maximum bytes.  Matches formats:
  2016-07-21 11:31:40,606  WARN Signature [id:18010] will always scan up to maximum bytes.  Matches formats:

Copied verbatim.

It looks like the output following the colon isn't working as expected.

[Brian-O-TNA]

This is a known issue. The maximum bytes message occurs when you have a signature where none of the constituent byte sequences are defined relative to BOF or EOF (i.e. the "Reference" attribute is either missing or set to "NOoffset"). The output following the colon is simply a list of the file formats in the signature file which utilise that signature - it will be blank if there are no formats directly defined in the signature file for that signature file. There are no such such signatures defined in the current signature file (v.86). Nonetheless it's on the "TODO" list...

[Dclipsham]

This is related to container signature patterns where ByteSequence is lacking a ' Reference="BOFoffset"' - since all container signatures are currently assumed to be from BOF, I will make this explicit in the next container signature release, which will mean these messages will go away.