Strings encoding

[Steve Grubb]

Hello,

On Tuesday, March 22, 2016 09:44:19 AM Lev Stipakov wrote:
> The string values can be either enclosed in quotation marks or
> hex-encoded. Is it safe to assume that sequence of bytes after hex
> decoding is always utf-8 encoded string?

There are no guarantees what they are. This is used whenever the user could 
have controlled the input in a way to trick the audit parser. And in one case 
the hex encoding is an actual socket address structure.

-Steve