125 Commits (61f01c9574967347d2a8b2c9b5cde4cbbf430cac)

Author	SHA1	Message	Date
Török Edvin	02eabc6d1e	Add the rest of the prefiltering glue code. ... This is still disabled for now (see the & 0).	16 years ago
Török Edvin	2a94c08e19	move matching code to matcher_run. ... No functionality change.	16 years ago
Török Edvin	ab89360583	Support for macros in logical subsignatures (bb #164). ... In the LDB there is (one or more) special subsignature ${min-max}MACROID$, which means: must match any signature from group MACROID (for current filetype), and the match must occur at a distance of min-max from the start(!) of the previous logical subsignature match. It also has the sideeffect of making the previous subsignature considered a match only if both that and the macro matches. The offset of first match for the previous logical subsig will be the offset where the {min-max} distance is satisfied. The macro logical subsignature will have a count of 0 (if it didn't match together with the previous subsig), or a count of 1 if it did. The matches can occur anywhere (even in different ac scan buffers), since I don't call cli_ac_scanbuff I just use the offset of first match (which we have for the bytecode anyway). There can be at most 32 macro groups, signatures are added to a macro group by using $MACROID$ as offset. For example pdb entries could be converted to PDB:3:$0:<hexsig of domainname> if we assign macro id 0 to PDB (and we can assign 31 more macro ids to whatever). Example: test.ldb: TestMacro;Target:0;0&1;616161;${3-4}12$ test.ndb: D:0:$12:6262 D:0:$12:6363 D:0:$11:6262 test.dat: aaaaxccdd test-nomatch.dat: aaaaxxxccdd	16 years ago
Török Edvin	57f14280a7	Fix use-after-free on bytecode load/execution. ... lsig->bc was referring to the bytecode directly (via a pointer), but the bytecode struct changes place in memory (it is realloced on each .cbc load). So use an index instead of the direct pointer.	16 years ago
Tomasz Kojm	baf2e702e2	libclamav: provide information about lsig matches to bytecode (bb#1799)	16 years ago
Török Edvin	f4e3421592	Support PE hook bytecodes triggered by logical signature.	16 years ago
Tomasz Kojm	570b1d0050	libclamav: cdb: drop FileType; cover ARJ, CAB, TAR, CPIO and 7Z	16 years ago
Tomasz Kojm	4168b01087	libclamav: allow lsigs be anchored to specific containers (bb#1293), eg. Container:CL_TYPE_ZIP	16 years ago
Tomasz Kojm	15f413d157	libclamav: handle zmd/rmd with cdb (bb#1579)	16 years ago
Tomasz Kojm	55094a9c76	libclamav: base code for unified container metadata matcher (bb#1579)	16 years ago
aCaB	d2ba6f98bb	matching complete	16 years ago
Tomasz Kojm	17cfd76f5b	libclamav: add support for FileSize, EntryPoint and NumberOfSections in lsig's tdb	16 years ago
Tomasz Kojm	0f7ba61742	libclamav: integrate ldb sigs with icon matcher	16 years ago
Török Edvin	74b0023374	Fix after merge: update to fmap API.	16 years ago
aCaB	b183aa786b	s/need/unneed/ in unzip, remove debug spam and comments in matcher.c	16 years ago
aCaB	13f6bc5846	is maxpatlen too short ??	16 years ago
Tomasz Kojm	e6f5ac5157	libclamav/matcher-bm.c: don't use mpool (bb#1710, #1715)	16 years ago
Tomasz Kojm	fbc33106bc	cli_caloff: offset_max was not set in some cases	16 years ago
Tomasz Kojm	6c26e99c59	libclamav: check file sizes for MD5 sigs in all cases	16 years ago
aCaB	49cc1e3c35	s/struct F_MAP/fmap_t/	16 years ago
Tomasz Kojm	6416cdef15	libclamav: unify fp checking; output fp signatures in debug mode	16 years ago
Török Edvin	d38d6dadef	Logical signature hook for bytecode.	16 years ago
Tomasz Kojm	0c190b52f7	libclamav/matcher-bm.c: use mpool in BM's offset mode	16 years ago
Tomasz Kojm	6d3c5bec1d	libclamav: use BM matcher in offset mode for PE files larger than 256kB ... (10% speedup on average; 30-40% for large executables)	16 years ago
aCaB	2236c938fe	fix cli_scandesc to cli_fmap_scandesc wrappage	16 years ago
aCaB	49ee0318fc	fix scanbuff callers	16 years ago
aCaB	048d76777f	scanners to fmap - hackish ... peheader to fmap lacks review + elf + macho	16 years ago
Tomasz Kojm	006f5fe642	libclamav: in bm_offmode only load sigs with non-floating absolute ... and relative offsets into BM matcher (load other ones into AC) and use per-file computed offset table to pick up best shifts (not enabled by default, bb#1300)	16 years ago
aCaB	084d19aa8c	(some) html to fmap	16 years ago
aCaB	2d5dbc3730	binhex, pdf, unzip_single to fmap	16 years ago
aCaB	cceea45822	cli_fmap_scandesc	16 years ago
Tomasz Kojm	aca9ea82df	libclamav: handle relative offsets with cli_ac_data; fix offset logic	16 years ago
Tomasz Kojm	33872a43de	libclamav: improve handling of signature offsets	16 years ago
aCaB	511c2e792c	cache ... cache over 256 trees	16 years ago
Tomasz Kojm	8af7ccd0af	libclamav: handle Mach-O files with type-9 signatures; ... all special offsets are supported for PPC32/64 and x86 executables; for ARM and other archs only section based extensions (Sx[+-]n, SL[+-]n) are supported atm	16 years ago
Tomasz Kojm	e41019807c	libclamav: call cli_checkfp() whenever possible/makes sense (bb#1558) ... git-svn: trunk@5053	16 years ago
Tomasz Kojm	e06afe8e8e	libclamav: fix handling of signature offsets in cli_scanbuff() (bb#1546) ... git-svn: trunk@5026	16 years ago
Tomasz Kojm	0138619577	libclamav/matcher.c: cli_scanbuff: add support for external acdata ... git-svn: trunk@4781	17 years ago
Tomasz Kojm	589d8d8e99	libclamav: add default.h ... git-svn: trunk@4578	17 years ago
Tomasz Kojm	710a22f179	libclamav/matcher-ac.c: add support for returning multiple matches in cli_ac_scanbuff() ... git-svn: trunk@4017	17 years ago
Tomasz Kojm	a32b99b9c4	fix typo ... git-svn: trunk@4000	17 years ago
Tomasz Kojm	6b273dfd7e	check lsigs for FPs ... git-svn: trunk@3999	17 years ago
Tomasz Kojm	ee8bd2fb14	libclamav: lsigs: handle extended block modifiers (bb#896) ... git-svn: trunk@3998	17 years ago
Tomasz Kojm	c7aeeb46ef	evaluate lsigs in cli_scandesc ... git-svn: trunk@3997	17 years ago
Török Edvin	10290ba3eb	allow custom data to be associated with patterns (such as a regex) via a void* ... field. Fix memory leaks, and valgrind problems in regex_list_done. git-svn: trunk@3994	17 years ago
Tomasz Kojm	677fc4ba3b	libclamav: add initial support for logical signatures (bb#896) ... git-svn: trunk@3993	17 years ago
Tomasz Kojm	2023340a41	update copyrights and stick more files to GPLv2; move and add more credits to the AUTHORS file; add COPYING.BSD ... git-svn: trunk@3749	17 years ago
Tomasz Kojm	5025967e6d	use limits->maxfiles instead of MAX_EMBEDDED_OBJ for ZIP-SFX ... git-svn: trunk@3668	18 years ago
Tomasz Kojm	6038397ea6	filetype detection improvements ... git-svn: trunk@3662	18 years ago
aCaB	561b5297bd	blob limits ... git-svn: trunk@3633	18 years ago