Previous Next
Character classes or lists

Character classes -- enclosed in square brackets -- [...]
A character class is a list of characters, any of which can be matched. The list can also be excluded from matches. Ranges of ASCII characters can also be specified.

Expression Matches Does not match
[gs]et get, set (only)
(anything else)

Choosing from a range of alphanumeric characters
A minus sign (-) within square brackets indicates a range of consecutive ASCII characters. For example, [0-9] is the same as [0123456789].

Expression Matches Does not match
Do[A-Za-z]*Command DoCommand
DoMenuCommand
DomouseCommand...
Do-Command
Do88Command
abc...

Excluding a character list
If the first character in the square brackets is a caret (^), any character except those in the square brackets will match.

Expression Matches Does not match
Do[^\s(Cc] DoMenuCommand
DomouseCommand
Domino
Do (followed by space)
Do(
DoCommand
abc ...

Metacharacters inside square brackets
To include the minus sign itself in a range, it must be the first character (after an initial ^, if any -- see Excluding a character list), e.g., Do[-A-Za-z]*Command would also match
Do-Command .
If a right square bracket (]) immediately follows a left square bracket, it does not terminate the set but is considered to be one of the characters to match.
The caret (^) in first position negates the rest of the character class.
All other metacharacters, such as backslash (\), asterisk (*), or plus sign (+) etc., are also matched literally if they are inside square brackets.
Special character classes in SNiFF+
Special character classes can be used in SNiFF+ as a kind of shorthand to make writing (and reading) regular expressions easier.

Example
  1. The following example tries to match "any call of 'foo' that takes at least one parameter". The first expression tries to achieve this by excluding ')', but neglects the possibility of nonprinting characters, compound words and nested parentheses. The second expression covers these eventualities and matches the entire call upt, and including, the final closing parentheses.

    Expression Matches Does not match
    foo([^)]+) foo(a)
    foo( )
    my foo(int a, int b, c)...
    foo (a)
    foo()
    ...
    <foo\s*(\s*[^)\s][.\n]*]) any foo with at
    least 1 parameter
    (anything else)

  • In the second expression above, recall:

  • < -- beginning of word
    foo -- three ordinary literal characters that match themselves
    \s -- any nonprinting character
    * -- zero or more occurrences of preceding, here \s
    ( -- an ordinary literal character that matches itself
    [^)\s] -- anything except ')' and nonprinting characters
    [.\n]*] -- any character and newline, zero or more occurrences
    ) -- an ordinary literal character that matches itself