mirror of https://github.com/Cisco-Talos/clamav
David Raynor
12 years ago
parent
7afc0a61cf
commit
ca019d6d94
@ -0,0 +1,76 @@ |
||||
/*
|
||||
* Copyright (C) 2013 Sourcefire, Inc. |
||||
* |
||||
* Authors: David Raynor <draynor@sourcefire.com> |
||||
* |
||||
* This program is free software; you can redistribute it and/or modify |
||||
* it under the terms of the GNU General Public License version 2 as |
||||
* published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU General Public License |
||||
* along with this program; if not, write to the Free Software |
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
||||
* MA 02110-1301, USA. |
||||
*/ |
||||
|
||||
#if HAVE_CONFIG_H |
||||
#include "clamav-config.h" |
||||
#endif |
||||
|
||||
#include <stdio.h> |
||||
#include <ctype.h> |
||||
|
||||
#include "cltypes.h" |
||||
#include "others.h" |
||||
#include "dmg.h" |
||||
#include "scanners.h" |
||||
|
||||
int cli_scandmg(cli_ctx *ctx) |
||||
{ |
||||
struct dmg_koly_block hdr; |
||||
int ret, conv; |
||||
size_t maplen; |
||||
|
||||
char name[513]; |
||||
unsigned int file = 0, trailer = 0; |
||||
uint32_t filesize, namesize, hdr_namesize; |
||||
off_t pos = 0; |
||||
|
||||
if (!ctx || !ctx->fmap) { |
||||
cli_errmsg("cli_scandmg: Invalid context\n"); |
||||
return CL_ENULLARG; |
||||
} |
||||
|
||||
maplen = (*ctx->fmap)->real_len; |
||||
pos = maplen - 512; |
||||
if (pos <= 0) { |
||||
cli_dbgmsg("cli_scandmg: Sizing problem for DMG archive.\n"); |
||||
return CL_CLEAN; |
||||
} |
||||
|
||||
/* Grab koly block */ |
||||
if (fmap_readn(*ctx->fmap, &hdr, pos, sizeof(hdr)) != sizeof(hdr)) { |
||||
cli_dbgmsg("cli_scandmg: Invalid DMG trailer block\n"); |
||||
return CL_EFORMAT; |
||||
} |
||||
|
||||
/* Check magic */ |
||||
hdr.magic = be32_to_host(hdr.magic); |
||||
if (hdr.magic == 0x6b6f6c79) { |
||||
cli_dbgmsg("cli_scandmg: Found koly block @ %ld\n", (long) pos); |
||||
} |
||||
else { |
||||
cli_dbgmsg("cli_scandmg: No koly magic, %8x\n", hdr.magic); |
||||
return CL_EFORMAT; |
||||
} |
||||
|
||||
/* TODO: the rest of the unpacking */ |
||||
|
||||
return CL_CLEAN; |
||||
} |
||||
|
||||
@ -0,0 +1,100 @@ |
||||
/*
|
||||
* Copyright (C) 2013 Sourcefire, Inc. |
||||
* |
||||
* Authors: David Raynor <draynor@sourcefire.com> |
||||
* |
||||
* This program is free software; you can redistribute it and/or modify |
||||
* it under the terms of the GNU General Public License version 2 as |
||||
* published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU General Public License |
||||
* along with this program; if not, write to the Free Software |
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
||||
* MA 02110-1301, USA. |
||||
*/ |
||||
|
||||
#ifndef __DMG_H |
||||
#define __DMG_H |
||||
|
||||
#if HAVE_CONFIG_H |
||||
#include "clamav-config.h" |
||||
#endif |
||||
|
||||
#include "cltypes.h" |
||||
#include "others.h" |
||||
|
||||
#ifndef HAVE_ATTRIB_PACKED |
||||
#define __attribute__(x) |
||||
#endif |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK |
||||
#pragma pack(1) |
||||
#endif |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK_HPPA |
||||
#pragma pack 1 |
||||
#endif |
||||
|
||||
/* 512-byte block, remember these are big-endian! */ |
||||
struct dmg_koly_block { |
||||
uint32_t magic __attribute__ ((packed)); |
||||
uint32_t version __attribute__ ((packed)); |
||||
uint32_t headerLength __attribute__ ((packed)); |
||||
uint32_t flags __attribute__ ((packed)); |
||||
uint64_t runningOffset __attribute__ ((packed)); |
||||
uint64_t dataForkOffset __attribute__ ((packed)); |
||||
uint64_t dataForkLength __attribute__ ((packed)); |
||||
uint64_t resourceForkOffset __attribute__ ((packed)); |
||||
uint64_t resourceForkLength __attribute__ ((packed)); |
||||
uint32_t segment __attribute__ ((packed)); |
||||
uint32_t segmentCount __attribute__ ((packed)); |
||||
/* technically uuid */ |
||||
uint8_t segmentID[16]; |
||||
|
||||
uint32_t dataChecksumFields[34] __attribute__ ((packed)); |
||||
|
||||
uint64_t xmlOffset __attribute__ ((packed)); |
||||
uint64_t xmlLength __attribute__ ((packed)); |
||||
uint8_t padding[120]; |
||||
|
||||
uint32_t masterChecksumFields[34] __attribute__ ((packed)); |
||||
|
||||
uint32_t imageVariant __attribute__ ((packed)); |
||||
uint64_t sectorCount __attribute__ ((packed)); |
||||
|
||||
uint32_t reserved[3] __attribute__ ((packed)); |
||||
}; |
||||
|
||||
/* 204-byte block, still big-endian */ |
||||
struct dmg_mish_block { |
||||
uint32_t magic; |
||||
uint32_t version; |
||||
|
||||
uint64_t startSector; |
||||
uint64_t sectorCount; |
||||
uint64_t dataOffset; |
||||
uint32_t bufferCount; |
||||
uint32_t descriptorBlocks; |
||||
|
||||
uint8_t reserved[24]; |
||||
|
||||
uint32_t checksum[34]; |
||||
uint64_t blockDescriptorCount; |
||||
}; |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK |
||||
#pragma pack() |
||||
#endif |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK_HPPA |
||||
#pragma pack |
||||
#endif |
||||
|
||||
int cli_scandmg(cli_ctx *ctx); |
||||
|
||||
#endif |
||||
@ -0,0 +1,57 @@ |
||||
/*
|
||||
* Copyright (C) 2013 Sourcefire, Inc. |
||||
* |
||||
* Authors: David Raynor <draynor@sourcefire.com> |
||||
* |
||||
* This program is free software; you can redistribute it and/or modify |
||||
* it under the terms of the GNU General Public License version 2 as |
||||
* published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU General Public License |
||||
* along with this program; if not, write to the Free Software |
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
||||
* MA 02110-1301, USA. |
||||
*/ |
||||
|
||||
#if HAVE_CONFIG_H |
||||
#include "clamav-config.h" |
||||
#endif |
||||
|
||||
#include "cltypes.h" |
||||
#include "others.h" |
||||
#include "xar.h" |
||||
#include "fmap.h" |
||||
#include "scanners.h" |
||||
|
||||
int cli_scanxar(cli_ctx *ctx) |
||||
{ |
||||
struct xar_header hdr; |
||||
char name[513]; |
||||
unsigned int file = 0, trailer = 0; |
||||
uint32_t filesize, namesize, hdr_namesize; |
||||
int ret, conv; |
||||
off_t pos = 0; |
||||
|
||||
if (fmap_readn(*ctx->fmap, &hdr, pos, sizeof(hdr)) != sizeof(hdr)) { |
||||
cli_dbgmsg("cli_scanxar: Invalid header, too short.\n"); |
||||
return CL_EFORMAT; |
||||
} |
||||
hdr.magic = be32_to_host(hdr.magic); |
||||
if (hdr.magic == 0x78617221) { |
||||
cli_dbgmsg("cli_scanxar: Matched magic\n"); |
||||
} |
||||
else { |
||||
cli_dbgmsg("cli_scanxar: Invalid magic\n"); |
||||
return CL_EFORMAT; |
||||
} |
||||
|
||||
/* TODO: First grab the TOC, parse that, and then unpack the rest. */ |
||||
|
||||
return CL_CLEAN; |
||||
} |
||||
|
||||
@ -0,0 +1,62 @@ |
||||
/*
|
||||
* Copyright (C) 2013 Sourcefire, Inc. |
||||
* |
||||
* Authors: David Raynor <draynor@sourcefire.com> |
||||
* |
||||
* This program is free software; you can redistribute it and/or modify |
||||
* it under the terms of the GNU General Public License version 2 as |
||||
* published by the Free Software Foundation. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU General Public License |
||||
* along with this program; if not, write to the Free Software |
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
||||
* MA 02110-1301, USA. |
||||
*/ |
||||
|
||||
#ifndef __XAR_H |
||||
#define __XAR_H |
||||
|
||||
#if HAVE_CONFIG_H |
||||
#include "clamav-config.h" |
||||
#endif |
||||
|
||||
#include "cltypes.h" |
||||
#include "others.h" |
||||
|
||||
#ifndef HAVE_ATTRIB_PACKED |
||||
#define __attribute__(x) |
||||
#endif |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK |
||||
#pragma pack(1) |
||||
#endif |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK_HPPA |
||||
#pragma pack 1 |
||||
#endif |
||||
|
||||
struct xar_header { |
||||
uint32_t magic; |
||||
uint16_t size; |
||||
uint16_t version; |
||||
uint64_t toc_length_compressed; |
||||
uint64_t toc_length_decompressed; |
||||
uint32_t chksum_alg; /* 0 = none */ |
||||
}; |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK |
||||
#pragma pack() |
||||
#endif |
||||
|
||||
#ifdef HAVE_PRAGMA_PACK_HPPA |
||||
#pragma pack |
||||
#endif |
||||
|
||||
int cli_scanxar(cli_ctx *ctx); |
||||
|
||||
#endif |
||||
Loading…
Reference in new issue