15 Commits (2e55c901b1b0571a340602ee2681255876f63f1a)

Author	SHA1	Message	Date
Micah Snyder	2e55c901b1	Fix byte-compare subsignature premature alert ... The byte compare feature in logical signatures will cause the rule to alert if it successfully matches regardless of the rest of the logical signature. An easy way to test this is with a logical signature that has two bcomp subsignatures and requires both to match for the rule to alert. In the following example, we have 4 signatures where - the first will match both bcomp subsigs. - the second will match neither. - the last two match just one bcomp subsig. In an --allmatch test, you'll find that the 3 of these match, with the first one matching *twice*, once for each bcomp subsig. test.ldb: ``` bcomp.both;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=123);4242;2(>>5#hb2#=255) bcomp.neither;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=124);4242;2(>>5#hb2#=254) bcomp.second;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=124);4242;2(>>5#hb2#=255) bcomp.first;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=123);4242;2(>>5#hb2#=254) ``` test.sample: ``` AA = 7B; BB = FF ``` You can also try a similar test to compare the behavior with regular ac-pattern-match subsigs with this lsig-test.ldb: ``` pattern.both;Engine:51-255,Target:0;0&1;4141;4242 pattern.neither;Engine:51-255,Target:0;0&1;4140;4241 pattern.second;Engine:51-255,Target:0;0&1;4140;4242 pattern.first;Engine:51-255,Target:0;0&1;4141;4241 ``` This commit fixes the issue by incrementing the logical subsignature count for each bcomp subsig match instead of appending an alert for each bcomp match. Also removed call to `lsig_sub_matched()` that didn't do anything.	4 years ago
micasnyd	140c88aa4e	Bump copyright for 2022 ... Includes minor format corrections.	4 years ago
Micah Snyder (micasnyd)	b9ca6ea103	Update copyright dates for 2021 ... Also fixes up clang-format.	5 years ago
Micah Snyder	206dbaefe8	Update copyright dates for 2020	6 years ago
Micah Snyder	52cddcbcfd	Updating and cleaning up copyright notices.	6 years ago
Micah Snyder	b3e82e5e61	Replacing libclamav/cltypes.h with clamav-types.h.in, which generates a header clamav-types.h that we install alongside clamav.h.	6 years ago
Micah Snyder	72fd33c8b2	clang-format'd using new .clang-format rules.	6 years ago
Mickey Sola	371d43083d	bcomp - fixing issue with whitespacing padding, fixing issue with little endian extraction of odd nibbled hex sequences, refactoring hex/decimal auto checking and hex buffer normalization code, fixing issue with normalization where it was possible to evaluate unwanted hex bytes, fixing issue with big endian conversion of decimal extracted sequence values after use of cli_strntoul	7 years ago
Mickey Sola	85f528e8aa	bcomp - adding option for automatic detection and extraction of decimal or hex values from the buffer	7 years ago
Mickey Sola	d7d58a5847	bcomp - changing map to use original scan buffer to account for normalization offset discrepancies--patch based on suggested solution by Micah	7 years ago
Mickey Sola	dc3b273fbc	bcomp - adding comma seperated comparison statement evaluations for single subsigs	7 years ago
Mickey Sola	178d030380	bcomp - updating and fixing binary extraction based on Micah's suggested solution; adding ability to compare and extract negative values	7 years ago
Mickey Sola	b7001d680e	bcomp - revamping option parsing; adding binary byte extraction; adding exact byte length matching option	7 years ago
Mickey Sola	2b6c456a1b	bcomp - updates and fixes following code review	7 years ago
Mickey Sola	18ff502920	refactoring byte compare functionality as a subsig; adding loader and matchers for bytecompare subsig	7 years ago