
# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5D
# ------------------------------------------------------------------
0		string	\x5D\x00\x00	LZMA compressed data, properties: 0x5D,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x01
# ------------------------------------------------------------------
0		string	\x01\x00\x00	LZMA compressed data, properties: 0x01,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x02
# ------------------------------------------------------------------
0		string	\x02\x00\x00	LZMA compressed data, properties: 0x02,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x03
# ------------------------------------------------------------------
0		string	\x03\x00\x00	LZMA compressed data, properties: 0x03,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x04
# ------------------------------------------------------------------
0		string	\x04\x00\x00	LZMA compressed data, properties: 0x04,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x09
# ------------------------------------------------------------------
0		string	\x09\x00\x00	LZMA compressed data, properties: 0x09,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x0A
# ------------------------------------------------------------------
0		string	\x0A\x00\x00	LZMA compressed data, properties: 0x0A,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x0B
# ------------------------------------------------------------------
0		string	\x0B\x00\x00	LZMA compressed data, properties: 0x0B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x0C
# ------------------------------------------------------------------
0		string	\x0C\x00\x00	LZMA compressed data, properties: 0x0C,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x12
# ------------------------------------------------------------------
0		string	\x12\x00\x00	LZMA compressed data, properties: 0x12,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x13
# ------------------------------------------------------------------
0		string	\x13\x00\x00	LZMA compressed data, properties: 0x13,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x14
# ------------------------------------------------------------------
0		string	\x14\x00\x00	LZMA compressed data, properties: 0x14,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x1B
# ------------------------------------------------------------------
0		string	\x1B\x00\x00	LZMA compressed data, properties: 0x1B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x1C
# ------------------------------------------------------------------
0		string	\x1C\x00\x00	LZMA compressed data, properties: 0x1C,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x24
# ------------------------------------------------------------------
0		string	\x24\x00\x00	LZMA compressed data, properties: 0x24,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x2D
# ------------------------------------------------------------------
0		string	\x2D\x00\x00	LZMA compressed data, properties: 0x2D,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x2E
# ------------------------------------------------------------------
0		string	\x2E\x00\x00	LZMA compressed data, properties: 0x2E,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x2F
# ------------------------------------------------------------------
0		string	\x2F\x00\x00	LZMA compressed data, properties: 0x2F,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x30
# ------------------------------------------------------------------
0		string	\x30\x00\x00	LZMA compressed data, properties: 0x30,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x31
# ------------------------------------------------------------------
0		string	\x31\x00\x00	LZMA compressed data, properties: 0x31,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x36
# ------------------------------------------------------------------
0		string	\x36\x00\x00	LZMA compressed data, properties: 0x36,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x37
# ------------------------------------------------------------------
0		string	\x37\x00\x00	LZMA compressed data, properties: 0x37,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x38
# ------------------------------------------------------------------
0		string	\x38\x00\x00	LZMA compressed data, properties: 0x38,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x39
# ------------------------------------------------------------------
0		string	\x39\x00\x00	LZMA compressed data, properties: 0x39,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x3F
# ------------------------------------------------------------------
0		string	\x3F\x00\x00	LZMA compressed data, properties: 0x3F,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x40
# ------------------------------------------------------------------
0		string	\x40\x00\x00	LZMA compressed data, properties: 0x40,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x41
# ------------------------------------------------------------------
0		string	\x41\x00\x00	LZMA compressed data, properties: 0x41,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x48
# ------------------------------------------------------------------
0		string	\x48\x00\x00	LZMA compressed data, properties: 0x48,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x49
# ------------------------------------------------------------------
0		string	\x49\x00\x00	LZMA compressed data, properties: 0x49,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x51
# ------------------------------------------------------------------
0		string	\x51\x00\x00	LZMA compressed data, properties: 0x51,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5A
# ------------------------------------------------------------------
0		string	\x5A\x00\x00	LZMA compressed data, properties: 0x5A,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5B
# ------------------------------------------------------------------
0		string	\x5B\x00\x00	LZMA compressed data, properties: 0x5B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5C
# ------------------------------------------------------------------
0		string	\x5C\x00\x00	LZMA compressed data, properties: 0x5C,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x5E
# ------------------------------------------------------------------
0		string	\x5E\x00\x00	LZMA compressed data, properties: 0x5E,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x63
# ------------------------------------------------------------------
0		string	\x63\x00\x00	LZMA compressed data, properties: 0x63,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x64
# ------------------------------------------------------------------
0		string	\x64\x00\x00	LZMA compressed data, properties: 0x64,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x65
# ------------------------------------------------------------------
0		string	\x65\x00\x00	LZMA compressed data, properties: 0x65,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x66
# ------------------------------------------------------------------
0		string	\x66\x00\x00	LZMA compressed data, properties: 0x66,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x6C
# ------------------------------------------------------------------
0		string	\x6C\x00\x00	LZMA compressed data, properties: 0x6C,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x6D
# ------------------------------------------------------------------
0		string	\x6D\x00\x00	LZMA compressed data, properties: 0x6D,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x6E
# ------------------------------------------------------------------
0		string	\x6E\x00\x00	LZMA compressed data, properties: 0x6E,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x75
# ------------------------------------------------------------------
0		string	\x75\x00\x00	LZMA compressed data, properties: 0x75,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x76
# ------------------------------------------------------------------
0		string	\x76\x00\x00	LZMA compressed data, properties: 0x76,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x7E
# ------------------------------------------------------------------
0		string	\x7E\x00\x00	LZMA compressed data, properties: 0x7E,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x87
# ------------------------------------------------------------------
0		string	\x87\x00\x00	LZMA compressed data, properties: 0x87,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x88
# ------------------------------------------------------------------
0		string	\x88\x00\x00	LZMA compressed data, properties: 0x88,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x89
# ------------------------------------------------------------------
0		string	\x89\x00\x00	LZMA compressed data, properties: 0x89,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x8A
# ------------------------------------------------------------------
0		string	\x8A\x00\x00	LZMA compressed data, properties: 0x8A,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x8B
# ------------------------------------------------------------------
0		string	\x8B\x00\x00	LZMA compressed data, properties: 0x8B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x90
# ------------------------------------------------------------------
0		string	\x90\x00\x00	LZMA compressed data, properties: 0x90,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x91
# ------------------------------------------------------------------
0		string	\x91\x00\x00	LZMA compressed data, properties: 0x91,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x92
# ------------------------------------------------------------------
0		string	\x92\x00\x00	LZMA compressed data, properties: 0x92,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x93
# ------------------------------------------------------------------
0		string	\x93\x00\x00	LZMA compressed data, properties: 0x93,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x99
# ------------------------------------------------------------------
0		string	\x99\x00\x00	LZMA compressed data, properties: 0x99,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x9A
# ------------------------------------------------------------------
0		string	\x9A\x00\x00	LZMA compressed data, properties: 0x9A,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0x9B
# ------------------------------------------------------------------
0		string	\x9B\x00\x00	LZMA compressed data, properties: 0x9B,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xA2
# ------------------------------------------------------------------
0		string	\xA2\x00\x00	LZMA compressed data, properties: 0xA2,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xA3
# ------------------------------------------------------------------
0		string	\xA3\x00\x00	LZMA compressed data, properties: 0xA3,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xAB
# ------------------------------------------------------------------
0		string	\xAB\x00\x00	LZMA compressed data, properties: 0xAB,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB4
# ------------------------------------------------------------------
0		string	\xB4\x00\x00	LZMA compressed data, properties: 0xB4,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB5
# ------------------------------------------------------------------
0		string	\xB5\x00\x00	LZMA compressed data, properties: 0xB5,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB6
# ------------------------------------------------------------------
0		string	\xB6\x00\x00	LZMA compressed data, properties: 0xB6,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB7
# ------------------------------------------------------------------
0		string	\xB7\x00\x00	LZMA compressed data, properties: 0xB7,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xB8
# ------------------------------------------------------------------
0		string	\xB8\x00\x00	LZMA compressed data, properties: 0xB8,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xBD
# ------------------------------------------------------------------
0		string	\xBD\x00\x00	LZMA compressed data, properties: 0xBD,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xBE
# ------------------------------------------------------------------
0		string	\xBE\x00\x00	LZMA compressed data, properties: 0xBE,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xBF
# ------------------------------------------------------------------
0		string	\xBF\x00\x00	LZMA compressed data, properties: 0xBF,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC0
# ------------------------------------------------------------------
0		string	\xC0\x00\x00	LZMA compressed data, properties: 0xC0,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC6
# ------------------------------------------------------------------
0		string	\xC6\x00\x00	LZMA compressed data, properties: 0xC6,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC7
# ------------------------------------------------------------------
0		string	\xC7\x00\x00	LZMA compressed data, properties: 0xC7,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xC8
# ------------------------------------------------------------------
0		string	\xC8\x00\x00	LZMA compressed data, properties: 0xC8,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xCF
# ------------------------------------------------------------------
0		string	\xCF\x00\x00	LZMA compressed data, properties: 0xCF,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xD0
# ------------------------------------------------------------------
0		string	\xD0\x00\x00	LZMA compressed data, properties: 0xD0,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes


# ------------------------------------------------------------------
# Signature for LZMA compressed data with valid properties byte 0xD8
# ------------------------------------------------------------------
0		string	\xD8\x00\x00	LZMA compressed data, properties: 0xD8,

# These are all the valid dictionary sizes supported by LZMA utils.
>1		lelong	!65536	
>>1		lelong	!131072	
>>>1		lelong	!262144	
>>>>1		lelong	!524288	
>>>>>1		lelong	!1048576	
>>>>>>1		lelong	!2097152	
>>>>>>>1	lelong	!4194304	
>>>>>>>>1	lelong	!8388608	
>>>>>>>>>1	lelong	!16777216	
>>>>>>>>>>1	lelong	!33554432	invalid
>1		lelong	x		dictionary size: %d bytes,

# Assume that a valid size will be less than 1GB. This could technically be valid, but is unlikely.
>5		lequad	<1		invalid
>5		lequad	>0x40000000	invalid

# These are not 100%. The uncompressed size could be exactly the same as the dicionary size, but it is unlikely.
# Since most false positives are the result of repeating sequences of bytes (such as executable instructions),
# marking matches with the same uncompressed and dictionary sizes as invalid eliminates much of these false positives.
>1		lelong	65536
>>5		lequad	65536		invalid
>1		lelong	131072
>>5		lequad	131072		invalid
>1		lelong	262144
>>5		lequad	262144		invalid
>1		lelong	524288
>>5		lequad	524288		invalid
>1		lelong	1048576
>>5		lequad	1048576		invalid
>1		lelong	2097152
>>5		lequad	2097152		invalid
>1		lelong	4194304
>>5		lequad	4194304		invalid
>1		lelong	8388608
>>5		lequad	8388608		invalid
>1		lelong	16777216
>>5		lequad	16777216	invalid
>1		lelong	33554432
>>5		lequad	33554432	invalid
>5		lequad	x		uncompressed size: %lld bytes

