In the LDB there is (one or more) special subsignature ${min-max}MACROID$,
which means:
must match any signature from group MACROID (for current filetype),
and the match must occur at a distance of min-max from the start(!) of the
previous logical subsignature match.
It also has the sideeffect of making the previous subsignature considered a
match only if both that and the macro matches. The offset of first match for
the previous logical subsig will be the offset where the {min-max} distance is
satisfied.
The macro logical subsignature will have a count of 0 (if it didn't match
together with the previous subsig), or a count of 1 if it did.
The matches can occur anywhere (even in
different ac scan buffers), since I don't call cli_ac_scanbuff I just use the
offset of first match (which we have for the bytecode anyway).
There can be at most 32 macro groups, signatures are added to a macro group by
using $MACROID$ as offset.
For example pdb entries could be converted to PDB:3:$0:<hexsig of domainname>
if we assign macro id 0 to PDB (and we can assign 31 more macro ids to
whatever).
Example:
test.ldb:
TestMacro;Target:0;0&1;616161;${3-4}12$
test.ndb:
D:0:$12:6262
D:0:$12:6363
D:0:$11:6262
test.dat:
aaaaxccdd
test-nomatch.dat:
aaaaxxxccdd
and relative offsets into BM matcher (load other ones into AC) and
use per-file computed offset table to pick up best shifts (not
enabled by default, bb#1300)
New API calls:
int cl_init(unsigned int options);
struct cl_engine *cl_engine_new(unsigned int options);
int cl_engine_compile(struct cl_engine *engine);
struct cl_engine *cl_engine_dup(struct cl_engine *engine);
int cl_engine_free(struct cl_engine *engine);
more to come..
WARNING: THE BRANCH IS CURRENTLY BROKEN AND SHOULD NOT BE USED
git-svn-id: file:///var/lib/svn/clamav-devel/branches/newapi@4370 77e5149b-7576-45b1-b177-96237e5ba77b
to #ifndef CL_DEBUG #define NDEBUG #endif in each .c file that uses assert.
If you want assertions enabled you'll need to use --enable-debug to configure,
as until now, no change there.
git-svn: trunk@4343