mirror of https://github.com/Cisco-Talos/clamav
Merge f06e72ed02 into c73755d3fc
Val S.
1 month ago
committed by
GitHub
commit
cd4b957f54
@ -1,275 +0,0 @@ |
||||
/*
|
||||
* Copyright (C) 2020-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved. |
||||
* |
||||
* This program is free software; you can redistribute it and/or modify |
||||
* it under the terms of the GNU General Public License as published by |
||||
* the Free Software Foundation; either version 2 of the License, or |
||||
* (at your option) any later version. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU General Public License |
||||
* along with this program; if not, write to the Free Software |
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
||||
* MA 02110-1301, USA. |
||||
*/ |
||||
|
||||
/*
|
||||
* This example demonstrates using callbacks to record information about each |
||||
* file found during a recursive scan. |
||||
*/ |
||||
|
||||
#include <stdio.h> |
||||
#include <stdlib.h> |
||||
#include <stdbool.h> |
||||
#include <string.h> |
||||
#ifndef _WIN32 |
||||
#include <unistd.h> |
||||
#endif |
||||
#include <sys/types.h> |
||||
#include <sys/stat.h> |
||||
#include <fcntl.h> |
||||
|
||||
#include <clamav.h> |
||||
|
||||
#ifndef MIN |
||||
#define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
||||
#endif |
||||
#ifndef MAX |
||||
#define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
||||
#endif |
||||
|
||||
/** Max # of bytes to show for archive inspection preview */ |
||||
#define MAX_PREVIEW 10 |
||||
|
||||
cl_error_t inspection_callback( |
||||
int fd, |
||||
const char *type, |
||||
const char **ancestors, // array of null-terminated strings, array size == recursion_level
|
||||
size_t parent_file_size, |
||||
const char *file_name, |
||||
size_t file_size, |
||||
const char *file_buffer, |
||||
uint32_t recursion_level, |
||||
uint32_t attributes, // E.g.: was normalized, decrypted, etc. See LAYER_ATTRIBUTES_* flags in clamav.h
|
||||
void *context) // Could be used to retrieve / store contextual information for app
|
||||
{ |
||||
size_t i = 0; |
||||
|
||||
// printf("Message: %s\n", (char *)context.blah);
|
||||
UNUSEDPARAM(context); |
||||
|
||||
printf("ancestors: "); |
||||
for (i = 0; i < recursion_level; i++) { |
||||
printf("%s", ancestors[i]); |
||||
if (i + 1 < recursion_level) { |
||||
printf(" > "); |
||||
} |
||||
} |
||||
printf("\n"); |
||||
printf("parent size: %zu\n", parent_file_size); |
||||
printf("file name: %s\n", file_name); |
||||
printf("file desc: %d\n", fd); |
||||
printf("file size: %zu\n", file_size); |
||||
printf("file type: %s\n", type); |
||||
printf("recursion level: %u\n", recursion_level); |
||||
printf("decrypted: %s\n", attributes & LAYER_ATTRIBUTES_DECRYPTED ? "yes" : "no"); |
||||
printf("normalized: %s\n", attributes & LAYER_ATTRIBUTES_NORMALIZED ? "yes" : "no"); |
||||
printf("file preview: "); |
||||
for (i = 0; i < MIN(file_size, MAX_PREVIEW); i++) { |
||||
uint8_t byte = file_buffer[i]; |
||||
printf("%02x ", byte); |
||||
} |
||||
printf("\n\n"); |
||||
|
||||
return CL_CLEAN; /* keep scanning */ |
||||
} |
||||
|
||||
cl_error_t post_callback( |
||||
int fd, |
||||
int result, |
||||
const char *virname, |
||||
void *context) // Could be used to retrieve / store contextual information for app
|
||||
{ |
||||
(void)fd; |
||||
(void)context; |
||||
|
||||
printf("result: %d\n", result); |
||||
printf("virname: %s\n", virname); |
||||
printf("\n\n"); |
||||
|
||||
return CL_CLEAN; // respect the original result
|
||||
} |
||||
|
||||
/*
|
||||
* Exit codes: |
||||
* 0: clean |
||||
* 1: infected |
||||
* 2: error |
||||
*/ |
||||
|
||||
int main(int argc, char **argv) |
||||
{ |
||||
int status = 2; |
||||
cl_error_t ret = CL_ERROR; |
||||
|
||||
int db_fd = -1; |
||||
int target_fd = -1; |
||||
|
||||
unsigned long int size = 0; |
||||
long double mb; |
||||
const char *virname; |
||||
const char *filename; |
||||
struct cl_engine *engine = NULL; |
||||
struct cl_scan_options options; |
||||
char database_filepath[256]; |
||||
bool created_database = false; |
||||
|
||||
STATBUF st; |
||||
char *mem = NULL; |
||||
ssize_t bytes_read; |
||||
cl_fmap_t *map = NULL; |
||||
|
||||
if (argc != 2) { |
||||
printf("Usage: %s file\n", argv[0]); |
||||
return 2; |
||||
} |
||||
|
||||
filename = argv[1]; |
||||
|
||||
if ((target_fd = open(argv[1], O_RDONLY)) == -1) { |
||||
printf("Can't open file %s\n", argv[1]); |
||||
goto done; |
||||
} |
||||
|
||||
if (FSTAT(target_fd, &st)) { |
||||
printf("fmap: fstat failed\n"); |
||||
goto done; |
||||
} |
||||
|
||||
if (NULL == (mem = malloc((size_t)st.st_size))) { |
||||
printf("malloc failed, buffer size: %zu\n", (size_t)st.st_size); |
||||
goto done; |
||||
} |
||||
|
||||
bytes_read = read(target_fd, mem, (size_t)st.st_size); |
||||
if (bytes_read != (ssize_t)st.st_size) { |
||||
printf("read failed, buffer size: %zu\n", (size_t)st.st_size); |
||||
goto done; |
||||
} |
||||
|
||||
map = cl_fmap_open_memory(mem, (size_t)st.st_size); |
||||
|
||||
if (CL_SUCCESS != (ret = cl_init(CL_INIT_DEFAULT))) { |
||||
printf("Can't initialize libclamav: %s\n", cl_strerror(ret)); |
||||
goto done; |
||||
} |
||||
|
||||
if (!(engine = cl_engine_new())) { |
||||
printf("Can't create new engine\n"); |
||||
goto done; |
||||
} |
||||
|
||||
/* Example version macro usage to determine if new feature is available */ |
||||
#if defined(LIBCLAMAV_VERSION_NUM) && (LIBCLAMAV_VERSION_NUM >= 0x090400) |
||||
/* Example feature usage lowering max scan time to 15 seconds. */ |
||||
cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, 15000); |
||||
#endif |
||||
cl_engine_set_num(engine, CL_ENGINE_MAX_SCANSIZE, 1024 /*MB*/ * 1024 /*KB*/ * 1024 /*bytes*/); |
||||
cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 1024 /*MB*/ * 1024 /*KB*/ * 1024 /*bytes*/); |
||||
|
||||
/* load a pwdb signature, to demonstrate the "was decrypted" feature */ |
||||
#define PWDB_FILENAME "./ex3.pwdb" |
||||
unsigned int signo = 0; |
||||
if (-1 == (db_fd = open(PWDB_FILENAME, O_CREAT | O_RDWR, 0600))) { |
||||
printf("Failed to create ex3.pwdb database\n"); |
||||
goto done; |
||||
} |
||||
|
||||
#define PWDB_SIGNATURE "SignatureName;Engine:80-1000;0;virus" |
||||
if (-1 == write(db_fd, PWDB_SIGNATURE, strlen(PWDB_SIGNATURE))) { |
||||
printf("Failed write to ex3.pwdb database\n"); |
||||
goto done; |
||||
} |
||||
|
||||
if (CL_SUCCESS != (ret = cl_load(PWDB_FILENAME, engine, &signo, CL_DB_STDOPT))) { |
||||
printf("Database load error: %s\n", cl_strerror(ret)); |
||||
goto done; |
||||
} |
||||
|
||||
close(db_fd); |
||||
|
||||
/* build engine */ |
||||
if (CL_SUCCESS != (ret = cl_engine_compile(engine))) { |
||||
printf("Database initialization error: %s\n", cl_strerror(ret)); |
||||
goto done; |
||||
} |
||||
|
||||
/* scan file descriptor */ |
||||
memset(&options, 0, sizeof(struct cl_scan_options)); |
||||
options.parse |= ~0; /* enable all parsers */ |
||||
options.general |= CL_SCAN_GENERAL_HEURISTICS; /* enable heuristic alert options */ |
||||
options.general |= CL_SCAN_GENERAL_ALLMATCHES; /* run in all-match mode, so it keeps looking for alerts after the first one */ |
||||
|
||||
options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE; |
||||
options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED_DOC; |
||||
|
||||
/*
|
||||
* Set our callbacks for inspecting embedded files during the scan. |
||||
*/ |
||||
cl_engine_set_clcb_file_inspection(engine, &inspection_callback); |
||||
/*
|
||||
* Set our callbacks for inspecting embedded files during the scan. |
||||
*/ |
||||
cl_engine_set_clcb_post_scan(engine, &post_callback); |
||||
|
||||
printf("Testing file inspection on FD %d - %s\n", target_fd, filename); |
||||
|
||||
if (CL_VIRUS == (ret = cl_scanmap_callback( |
||||
map, |
||||
filename, |
||||
&virname, |
||||
&size, |
||||
engine, |
||||
&options, |
||||
(void *)"Hello, World!"))) { |
||||
printf("Virus detected: %s\n", virname); |
||||
} else { |
||||
if (ret != CL_CLEAN) { |
||||
printf("Error: %s\n", cl_strerror(ret)); |
||||
goto done; |
||||
} |
||||
} |
||||
/* calculate size of scanned data */ |
||||
mb = size * (CL_COUNT_PRECISION / 1024) / 1024.0; |
||||
printf("Data scanned: %2.2Lf MB\n", mb); |
||||
|
||||
status = ret == CL_VIRUS ? 1 : 0; |
||||
|
||||
done: |
||||
|
||||
if (NULL != map) { |
||||
cl_fmap_close(map); |
||||
} |
||||
if (NULL != mem) { |
||||
free(mem); |
||||
} |
||||
unlink(PWDB_FILENAME); |
||||
if (-1 != db_fd) { |
||||
close(db_fd); |
||||
} |
||||
if (-1 != target_fd) { |
||||
close(target_fd); |
||||
} |
||||
if (NULL != engine) { |
||||
cl_engine_free(engine); |
||||
} |
||||
if (true == created_database) { |
||||
unlink(database_filepath); |
||||
} |
||||
|
||||
return status; |
||||
} |
||||
@ -1,162 +0,0 @@ |
||||
/*
|
||||
* Copyright (C) 2020-2025 Cisco Systems, Inc. and/or its affiliates. All rights reserved. |
||||
* |
||||
* This program is free software; you can redistribute it and/or modify |
||||
* it under the terms of the GNU General Public License as published by |
||||
* the Free Software Foundation; either version 2 of the License, or |
||||
* (at your option) any later version. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU General Public License |
||||
* along with this program; if not, write to the Free Software |
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
||||
* MA 02110-1301, USA. |
||||
*/ |
||||
|
||||
/*
|
||||
* This example demonstrates using callbacks to record information about each |
||||
* file found during a recursive scan. |
||||
*/ |
||||
|
||||
#include <stdio.h> |
||||
#include <stdlib.h> |
||||
#include <string.h> |
||||
#ifndef _WIN32 |
||||
#include <unistd.h> |
||||
#endif |
||||
#include <sys/types.h> |
||||
#include <sys/stat.h> |
||||
#include <fcntl.h> |
||||
|
||||
#include <clamav.h> |
||||
|
||||
#ifdef _WIN32 |
||||
typedef int ssize_t; |
||||
#endif |
||||
|
||||
cl_error_t scan_callback(int fd, const char *type, void *context) |
||||
{ |
||||
char buf[10]; |
||||
ssize_t bytes_read = 0; |
||||
(void)context; /* Could be used to retrieve/store info */ |
||||
|
||||
printf("fd: %u, type: %s, initial bytes: ", fd, type); |
||||
if (-1 != (bytes_read = read(fd, &buf, sizeof(buf)))) { |
||||
/* Was able to read a few bytes */ |
||||
ssize_t i = 0; |
||||
for (i = 0; i < bytes_read; i++) { |
||||
printf("%02x", (unsigned int)buf[i]); |
||||
} |
||||
printf("\n"); |
||||
} |
||||
return CL_CLEAN; /* keep scanning */ |
||||
} |
||||
|
||||
/*
|
||||
* Exit codes: |
||||
* 0: clean |
||||
* 1: infected |
||||
* 2: error |
||||
*/ |
||||
|
||||
int main(int argc, char **argv) |
||||
{ |
||||
int status = 2; |
||||
cl_error_t ret = CL_ERROR; |
||||
|
||||
char *db_filepath = NULL; |
||||
int db_fd = -1; |
||||
int target_fd = -1; |
||||
|
||||
unsigned long int size = 0; |
||||
long double mb; |
||||
const char *virname; |
||||
const char *filename; |
||||
struct cl_engine *engine = NULL; |
||||
struct cl_scan_options options; |
||||
|
||||
if (argc != 2) { |
||||
printf("Usage: %s file\n", argv[0]); |
||||
return 2; |
||||
} |
||||
|
||||
filename = argv[1]; |
||||
|
||||
if ((target_fd = open(argv[1], O_RDONLY)) == -1) { |
||||
printf("Can't open file %s\n", argv[1]); |
||||
goto done; |
||||
} |
||||
|
||||
if (CL_SUCCESS != (ret = cl_init(CL_INIT_DEFAULT))) { |
||||
printf("Can't initialize libclamav: %s\n", cl_strerror(ret)); |
||||
goto done; |
||||
} |
||||
|
||||
if (!(engine = cl_engine_new())) { |
||||
printf("Can't create new engine\n"); |
||||
goto done; |
||||
} |
||||
|
||||
/* Example version macro usage to determine if new feature is available */ |
||||
#if defined(LIBCLAMAV_VERSION_NUM) && (LIBCLAMAV_VERSION_NUM >= 0x090400) |
||||
/* Example feature usage lowering max scan time to 15 seconds. */ |
||||
cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, 15000); |
||||
#endif |
||||
cl_engine_set_num(engine, CL_ENGINE_MAX_SCANSIZE, 1024 /*MB*/ * 1024 /*KB*/ * 1024 /*bytes*/); |
||||
cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 1024 /*MB*/ * 1024 /*KB*/ * 1024 /*bytes*/); |
||||
|
||||
/* build engine */ |
||||
if (CL_SUCCESS != (ret = cl_engine_compile(engine))) { |
||||
printf("Database initialization error: %s\n", cl_strerror(ret)); |
||||
goto done; |
||||
} |
||||
|
||||
/* scan file descriptor */ |
||||
memset(&options, 0, sizeof(struct cl_scan_options)); |
||||
options.parse |= ~0; /* enable all parsers */ |
||||
options.general |= CL_SCAN_GENERAL_HEURISTICS; /* enable heuristic alert options */ |
||||
options.general |= CL_SCAN_GENERAL_ALLMATCHES; /* run in all-match mode, so it keeps looking for alerts after the first one */ |
||||
options.general |= CL_SCAN_GENERAL_COLLECT_METADATA; /* collect metadata may enable collecting additional filenames (like in zip) */ |
||||
|
||||
/*
|
||||
* Set our callbacks for inspecting embedded files during the scan. |
||||
*/ |
||||
cl_engine_set_clcb_pre_scan(engine, &scan_callback); |
||||
|
||||
printf("Testing prescan on FD %d - %s\n", target_fd, filename); |
||||
|
||||
if (CL_VIRUS == (ret = cl_scandesc(target_fd, filename, &virname, &size, engine, &options))) { |
||||
printf("Virus detected: %s\n", virname); |
||||
} else { |
||||
if (ret != CL_CLEAN) { |
||||
printf("Error: %s\n", cl_strerror(ret)); |
||||
goto done; |
||||
} |
||||
} |
||||
/* calculate size of scanned data */ |
||||
mb = size * (CL_COUNT_PRECISION / 1024) / 1024.0; |
||||
printf("Data scanned: %2.2Lf MB\n", mb); |
||||
|
||||
status = ret == CL_VIRUS ? 1 : 0; |
||||
|
||||
done: |
||||
|
||||
if (-1 != db_fd) { |
||||
close(db_fd); |
||||
} |
||||
if (-1 != target_fd) { |
||||
close(target_fd); |
||||
} |
||||
if (NULL != engine) { |
||||
cl_engine_free(engine); |
||||
} |
||||
if (NULL != db_filepath) { |
||||
free(db_filepath); |
||||
} |
||||
|
||||
return status; |
||||
} |
||||
Loading…
Reference in new issue