#
## ------------------------------------------------------------------
## Signature for LZMA compressed data with valid properties byte 0x40
## ------------------------------------------------------------------
#0        string    \x40\x00\x00    LZMA compressed data, properties: 0x40,
#
## These are all the valid dictionary sizes supported by LZMA utils.
#>1        lelong    !65536    
#>>1        lelong    !131072    
#>>>1        lelong    !262144    
#>>>>1        lelong    !524288    
#>>>>>1        lelong    !1048576    
#>>>>>>1        lelong    !2097152    
#>>>>>>>1    lelong    !4194304    
#>>>>>>>>1    lelong    !8388608    
#>>>>>>>>>1    lelong    !16777216    
#>>>>>>>>>>1    lelong    !33554432    {invalid}
#>1        lelong    x        dictionary size: %d bytes,
#
## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
## This could technically be valid, but is unlikely.
#>5        lequad    !-1
#>>5        lequad    <32        {invalid}
#>>5        lequad    >0x40000000    {invalid}
#
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
## marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
#>1        lelong    65536
#>>5        lequad    65536        {invalid}
#>1        lelong    131072
#>>5        lequad    131072        {invalid}
#>1        lelong    262144
#>>5        lequad    262144        {invalid}
#>1        lelong    524288
#>>5        lequad    524288        {invalid}
#>1        lelong    1048576
#>>5        lequad    1048576        {invalid}
#>1        lelong    2097152
#>>5        lequad    2097152        {invalid}
#>1        lelong    4194304
#>>5        lequad    4194304        {invalid}
#>1        lelong    8388608
#>>5        lequad    8388608        {invalid}
#>1        lelong    16777216
#>>5        lequad    16777216    {invalid}
#>1        lelong    33554432
#>>5        lequad    33554432    {invalid}
#>5        lequad    x        uncompressed size: %lld bytes
#
#
## ------------------------------------------------------------------
## Signature for LZMA compressed data with valid properties byte 0x41
## ------------------------------------------------------------------
#0        string    \x41\x00\x00    LZMA compressed data, properties: 0x41,
#
## These are all the valid dictionary sizes supported by LZMA utils.
#>1        lelong    !65536    
#>>1        lelong    !131072    
#>>>1        lelong    !262144    
#>>>>1        lelong    !524288    
#>>>>>1        lelong    !1048576    
#>>>>>>1        lelong    !2097152    
#>>>>>>>1    lelong    !4194304    
#>>>>>>>>1    lelong    !8388608    
#>>>>>>>>>1    lelong    !16777216    
#>>>>>>>>>>1    lelong    !33554432    {invalid}
#>1        lelong    x        dictionary size: %d bytes,
#
## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
## This could technically be valid, but is unlikely.
#>5        lequad    !-1
#>>5        lequad    <32        {invalid}
#>>5        lequad    >0x40000000    {invalid}
#
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
## marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
#>1        lelong    65536
#>>5        lequad    65536        {invalid}
#>1        lelong    131072
#>>5        lequad    131072        {invalid}
#>1        lelong    262144
#>>5        lequad    262144        {invalid}
#>1        lelong    524288
#>>5        lequad    524288        {invalid}
#>1        lelong    1048576
#>>5        lequad    1048576        {invalid}
#>1        lelong    2097152
#>>5        lequad    2097152        {invalid}
#>1        lelong    4194304
#>>5        lequad    4194304        {invalid}
#>1        lelong    8388608
#>>5        lequad    8388608        {invalid}
#>1        lelong    16777216
#>>5        lequad    16777216    {invalid}
#>1        lelong    33554432
#>>5        lequad    33554432    {invalid}
#>5        lequad    x        uncompressed size: %lld bytes
#
#
## ------------------------------------------------------------------
## Signature for LZMA compressed data with valid properties byte 0x48
## ------------------------------------------------------------------
#0        string    \x48\x00\x00    LZMA compressed data, properties: 0x48,
#
## These are all the valid dictionary sizes supported by LZMA utils.
#>1        lelong    !65536    
#>>1        lelong    !131072    
#>>>1        lelong    !262144    
#>>>>1        lelong    !524288    
#>>>>>1        lelong    !1048576    
#>>>>>>1        lelong    !2097152    
#>>>>>>>1    lelong    !4194304    
#>>>>>>>>1    lelong    !8388608    
#>>>>>>>>>1    lelong    !16777216    
#>>>>>>>>>>1    lelong    !33554432    {invalid}
#>1        lelong    x        dictionary size: %d bytes,
#
## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
## This could technically be valid, but is unlikely.
#>5        lequad    !-1
#>>5        lequad    <32        {invalid}
#>>5        lequad    >0x40000000    {invalid}
#
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
## marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
#>1        lelong    65536
#>>5        lequad    65536        {invalid}
#>1        lelong    131072
#>>5        lequad    131072        {invalid}
#>1        lelong    262144
#>>5        lequad    262144        {invalid}
#>1        lelong    524288
#>>5        lequad    524288        {invalid}
#>1        lelong    1048576
#>>5        lequad    1048576        {invalid}
#>1        lelong    2097152
#>>5        lequad    2097152        {invalid}
#>1        lelong    4194304
#>>5        lequad    4194304        {invalid}
#>1        lelong    8388608
#>>5        lequad    8388608        {invalid}
#>1        lelong    16777216
#>>5        lequad    16777216    {invalid}
#>1        lelong    33554432
#>>5        lequad    33554432    {invalid}
#>5        lequad    x        uncompressed size: %lld bytes
#
#
## ------------------------------------------------------------------
## Signature for LZMA compressed data with valid properties byte 0x49
## ------------------------------------------------------------------
#0        string    \x49\x00\x00    LZMA compressed data, properties: 0x49,
#
## These are all the valid dictionary sizes supported by LZMA utils.
#>1        lelong    !65536    
#>>1        lelong    !131072    
#>>>1        lelong    !262144    
#>>>>1        lelong    !524288    
#>>>>>1        lelong    !1048576    
#>>>>>>1        lelong    !2097152    
#>>>>>>>1    lelong    !4194304    
#>>>>>>>>1    lelong    !8388608    
#>>>>>>>>>1    lelong    !16777216    
#>>>>>>>>>>1    lelong    !33554432    {invalid}
#>1        lelong    x        dictionary size: %d bytes,
#
## Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
## This could technically be valid, but is unlikely.
#>5        lequad    !-1
#>>5        lequad    <32        {invalid}
#>>5        lequad    >0x40000000    {invalid}
#
## These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
## Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
## marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
#>1        lelong    65536
#>>5        lequad    65536        {invalid}
#>1        lelong    131072
#>>5        lequad    131072        {invalid}
#>1        lelong    262144
#>>5        lequad    262144        {invalid}
#>1        lelong    524288
#>>5        lequad    524288        {invalid}
#>1        lelong    1048576
#>>5        lequad    1048576        {invalid}
#>1        lelong    2097152
#>>5        lequad    2097152        {invalid}
#>1        lelong    4194304
#>>5        lequad    4194304        {invalid}
#>1        lelong    8388608
#>>5        lequad    8388608        {invalid}
#>1        lelong    16777216
#>>5        lequad    16777216    {invalid}
#>1        lelong    33554432
#>>5        lequad    33554432    {invalid}
#>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x51
# ------------------------------------------------------------------
0        string    \x51\x00\x00    LZMA compressed data, properties: 0x51,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5A
# ------------------------------------------------------------------
0        string    \x5A\x00\x00    LZMA compressed data, properties: 0x5A,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5B
# ------------------------------------------------------------------
0        string    \x5B\x00\x00    LZMA compressed data, properties: 0x5B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5C
# ------------------------------------------------------------------
0        string    \x5C\x00\x00    LZMA compressed data, properties: 0x5C,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5D
# ------------------------------------------------------------------
0        string    \x5D\x00\x00    LZMA compressed data, properties: 0x5D,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5E
# ------------------------------------------------------------------
0        string    \x5E\x00\x00    LZMA compressed data, properties: 0x5E,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x63
# ------------------------------------------------------------------
0        string    \x63\x00\x00    LZMA compressed data, properties: 0x63,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x64
# ------------------------------------------------------------------
0        string    \x64\x00\x00    LZMA compressed data, properties: 0x64,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x65
# ------------------------------------------------------------------
0        string    \x65\x00\x00    LZMA compressed data, properties: 0x65,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x66
# ------------------------------------------------------------------
0        string    \x66\x00\x00    LZMA compressed data, properties: 0x66,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x6C
# ------------------------------------------------------------------
0        string    \x6C\x00\x00    LZMA compressed data, properties: 0x6C,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x6D
# ------------------------------------------------------------------
0        string    \x6D\x00\x00    LZMA compressed data, properties: 0x6D,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x6E
# ------------------------------------------------------------------
0        string    \x6E\x00\x00    LZMA compressed data, properties: 0x6E,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x75
# ------------------------------------------------------------------
0        string    \x75\x00\x00    LZMA compressed data, properties: 0x75,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x76
# ------------------------------------------------------------------
0        string    \x76\x00\x00    LZMA compressed data, properties: 0x76,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x7E
# ------------------------------------------------------------------
0        string    \x7E\x00\x00    LZMA compressed data, properties: 0x7E,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x87
# ------------------------------------------------------------------
0        string    \x87\x00\x00    LZMA compressed data, properties: 0x87,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x88
# ------------------------------------------------------------------
0        string    \x88\x00\x00    LZMA compressed data, properties: 0x88,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x89
# ------------------------------------------------------------------
0        string    \x89\x00\x00    LZMA compressed data, properties: 0x89,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x8A
# ------------------------------------------------------------------
0        string    \x8A\x00\x00    LZMA compressed data, properties: 0x8A,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x8B
# ------------------------------------------------------------------
0        string    \x8B\x00\x00    LZMA compressed data, properties: 0x8B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x90
# ------------------------------------------------------------------
0        string    \x90\x00\x00    LZMA compressed data, properties: 0x90,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x91
# ------------------------------------------------------------------
0        string    \x91\x00\x00    LZMA compressed data, properties: 0x91,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x92
# ------------------------------------------------------------------
0        string    \x92\x00\x00    LZMA compressed data, properties: 0x92,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x93
# ------------------------------------------------------------------
0        string    \x93\x00\x00    LZMA compressed data, properties: 0x93,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x99
# ------------------------------------------------------------------
0        string    \x99\x00\x00    LZMA compressed data, properties: 0x99,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x9A
# ------------------------------------------------------------------
0        string    \x9A\x00\x00    LZMA compressed data, properties: 0x9A,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x9B
# ------------------------------------------------------------------
0        string    \x9B\x00\x00    LZMA compressed data, properties: 0x9B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xA2
# ------------------------------------------------------------------
0        string    \xA2\x00\x00    LZMA compressed data, properties: 0xA2,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xA3
# ------------------------------------------------------------------
0        string    \xA3\x00\x00    LZMA compressed data, properties: 0xA3,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xAB
# ------------------------------------------------------------------
0        string    \xAB\x00\x00    LZMA compressed data, properties: 0xAB,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB4
# ------------------------------------------------------------------
0        string    \xB4\x00\x00    LZMA compressed data, properties: 0xB4,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB5
# ------------------------------------------------------------------
0        string    \xB5\x00\x00    LZMA compressed data, properties: 0xB5,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB6
# ------------------------------------------------------------------
0        string    \xB6\x00\x00    LZMA compressed data, properties: 0xB6,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB7
# ------------------------------------------------------------------
0        string    \xB7\x00\x00    LZMA compressed data, properties: 0xB7,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB8
# ------------------------------------------------------------------
0        string    \xB8\x00\x00    LZMA compressed data, properties: 0xB8,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xBD
# ------------------------------------------------------------------
0        string    \xBD\x00\x00    LZMA compressed data, properties: 0xBD,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xBE
# ------------------------------------------------------------------
0        string    \xBE\x00\x00    LZMA compressed data, properties: 0xBE,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xBF
# ------------------------------------------------------------------
0        string    \xBF\x00\x00    LZMA compressed data, properties: 0xBF,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC0
# ------------------------------------------------------------------
0        string    \xC0\x00\x00    LZMA compressed data, properties: 0xC0,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC6
# ------------------------------------------------------------------
0        string    \xC6\x00\x00    LZMA compressed data, properties: 0xC6,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC7
# ------------------------------------------------------------------
0        string    \xC7\x00\x00    LZMA compressed data, properties: 0xC7,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC8
# ------------------------------------------------------------------
0        string    \xC8\x00\x00    LZMA compressed data, properties: 0xC8,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xCF
# ------------------------------------------------------------------
0        string    \xCF\x00\x00    LZMA compressed data, properties: 0xCF,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xD0
# ------------------------------------------------------------------
0        string    \xD0\x00\x00    LZMA compressed data, properties: 0xD0,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xD8
# ------------------------------------------------------------------
0        string    \xD8\x00\x00    LZMA compressed data, properties: 0xD8,

# These are all the valid dictionary sizes supported by LZMA utils.
>1        lelong    !65536    
>>1        lelong    !131072    
>>>1        lelong    !262144    
>>>>1        lelong    !524288    
>>>>>1        lelong    !1048576    
>>>>>>1        lelong    !2097152    
>>>>>>>1    lelong    !4194304    
>>>>>>>>1    lelong    !8388608    
>>>>>>>>>1    lelong    !16777216    
>>>>>>>>>>1    lelong    !33554432    {invalid}
>1        lelong    x        dictionary size: %d bytes,

# Assume that a valid size will be greater than 32 bytes and less than 1GB (a value of -1 IS valid).
# This could technically be valid, but is unlikely.
>5        lequad    !-1
>>5        lequad    <32        {invalid}
>>5        lequad    >0x40000000    {invalid}

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as {invalid} eliminates much of these false positives.
>1        lelong    65536
>>5        lequad    65536        {invalid}
>1        lelong    131072
>>5        lequad    131072        {invalid}
>1        lelong    262144
>>5        lequad    262144        {invalid}
>1        lelong    524288
>>5        lequad    524288        {invalid}
>1        lelong    1048576
>>5        lequad    1048576        {invalid}
>1        lelong    2097152
>>5        lequad    2097152        {invalid}
>1        lelong    4194304
>>5        lequad    4194304        {invalid}
>1        lelong    8388608
>>5        lequad    8388608        {invalid}
>1        lelong    16777216
>>5        lequad    16777216    {invalid}
>1        lelong    33554432
>>5        lequad    33554432    {invalid}
>5        lequad    x        uncompressed size: %lld bytes

