Micah Snyder
d0cba11ea7
adding back changes to eliminate warnings from mspack, matcher, others, and readdb.
8 years ago
Micah Snyder
169af0fc67
Revert "eliminating warnings. mostly correcting variable types. also correcting struct initialization in a couple instances (var = {0} does not zero the memory on all platforms). Also some minor formatting corrections in areas I was already working. eliminated some unused variables."
...
This reverts commit 84a7f40288
.
8 years ago
Micah Snyder
84a7f40288
eliminating warnings. mostly correcting variable types. also correcting struct initialization in a couple instances (var = {0} does not zero the memory on all platforms). Also some minor formatting corrections in areas I was already working. eliminated some unused variables.
8 years ago
Mickey Sola
46a35abe56
mass update of copyright headers
10 years ago
Kevin Lin
6953341f8e
matcher-ac: added calc and storage for min/max lengths
10 years ago
Kevin Lin
f210254408
matcher-ac: converted length fields to arrays
10 years ago
Kevin Lin
b7d0b832f5
ac_special: tracks both the min and max lengths
10 years ago
Steven Morgan
7665e02d5b
Add support for YARA private rules and referencing other rules in a YARA condition.
10 years ago
Kevin Lin
4ffcf308bc
alternative code clean-up (cli_altnmsg)
10 years ago
Kevin Lin
590d402320
altstr: vstr duplicate trimming and uniqueness optimization
10 years ago
Kevin Lin
dda6b05765
matcher-ac: wildcard support for variable alternates (needs optimization)
10 years ago
Kevin Lin
59506ff519
matcher-ac: expansion of nested alternates within alternate expr
...
matcher-ac: three types of alternates: byte, fixed, and generic (variable)
10 years ago
Steven Morgan
b7999b89c9
YARA: capture offsets in matcher and use for processing YARA condition 'at' clauses.
10 years ago
Kevin Lin
8ea346810c
moved sigopts handler to separate function
...
reason: sigopts weren't handled for yara sigs
10 years ago
Kevin Lin
dc70379a09
converted sigopts from char string to uint8_t
10 years ago
Kevin Lin
6b725bb7c3
added '(W)' special character to match fullword (non-alnum)
10 years ago
Kevin Lin
3e265c461c
added direct memory freeing of cli_ac_list
...
cli_ac_pattlist renamed to cli_ac_list
10 years ago
Kevin Lin
51ca644c6b
implemented second nocase AC matcher using full enumerations
10 years ago
Kevin Lin
23d7c6e6f4
removed nocase changes to ac tree operation
10 years ago
Kevin Lin
7fc5eab81a
finished support for AC trie nocase variant
...
added check to prevent adding nocase signatures to case-sensitive AC tries
10 years ago
Kevin Lin
a02acd50b6
[WIP] added nocase support to clamav ac algorithm
10 years ago
Kevin Lin
ea3d1e7254
made lsig_sub_matched available to libclamav
...
comment clean-up
11 years ago
Steven Morgan
d2092491da
Revert "Support wildcard alternate strings of identical length in Aho-Corasick pattern matcher."
...
This reverts commit 1c2b8bd6a4
.
11 years ago
Steven Morgan
1c2b8bd6a4
Support wildcard alternate strings of identical length in Aho-Corasick pattern matcher.
12 years ago
Steve Morgan
6ad45a2931
add initial allscan/allmatch mode to libclamav, clamd, clamdscan, and clamscan with unit tests
13 years ago
Tomasz Kojm
0d71068897
libclamav: pass array with initial matches to bytecode (bb#2397)
15 years ago
Tomasz Kojm
b87fe3858e
libclamav/matcher-ac.c: optimize handling of multi-part signatures (bb#2322)
15 years ago
Tomasz Kojm
2db3514c4c
fix warning
15 years ago
Tomasz Kojm
04ec2e1977
libclamav: versioninfo hashset was not properly cached (bb#2065)
15 years ago
Tomasz Kojm
294558a535
libclamav: minimize header parsing (bb#2065)
15 years ago
Török Edvin
2545f9767c
Rearrange some fields in structs to avoid holes.
15 years ago
Török Edvin
5b74e89a35
enable prefiltering, and add to dconf.
...
Also downgrade some warnings to debug messages.
16 years ago
Török Edvin
ab89360583
Support for macros in logical subsignatures (bb #164 ).
...
In the LDB there is (one or more) special subsignature ${min-max}MACROID$,
which means:
must match any signature from group MACROID (for current filetype),
and the match must occur at a distance of min-max from the start(!) of the
previous logical subsignature match.
It also has the sideeffect of making the previous subsignature considered a
match only if both that and the macro matches. The offset of first match for
the previous logical subsig will be the offset where the {min-max} distance is
satisfied.
The macro logical subsignature will have a count of 0 (if it didn't match
together with the previous subsig), or a count of 1 if it did.
The matches can occur anywhere (even in
different ac scan buffers), since I don't call cli_ac_scanbuff I just use the
offset of first match (which we have for the bytecode anyway).
There can be at most 32 macro groups, signatures are added to a macro group by
using $MACROID$ as offset.
For example pdb entries could be converted to PDB:3:$0:<hexsig of domainname>
if we assign macro id 0 to PDB (and we can assign 31 more macro ids to
whatever).
Example:
test.ldb:
TestMacro;Target:0;0&1;616161;${3-4}12$
test.ndb:
D:0:$12:6262
D:0:$12:6363
D:0:$11:6262
test.dat:
aaaaxccdd
test-nomatch.dat:
aaaaxxxccdd
16 years ago
Tomasz Kojm
baf2e702e2
libclamav: provide information about lsig matches to bytecode (bb#1799)
16 years ago
Tomasz Kojm
2e4fd44f4f
libclamav: provide offset in cli_ac_result (bb#1799)
16 years ago
aCaB
d2ba6f98bb
matching complete
16 years ago
aCaB
49cc1e3c35
s/struct F_MAP/fmap_t/
16 years ago
Tomasz Kojm
8c3c77b49c
libclamav/matcher-ac.c: implement word delimiter (B) as requested in bb#1631
16 years ago
Tomasz Kojm
a6d4c62ee5
libclamav/matcher-ac.c: initial limited support for word boundary (bb#1631)
16 years ago
Tomasz Kojm
95ac9effe4
libclamav/matcher-ac.c: alternatives can now be negated: !(aa|bb|cc)
16 years ago
aCaB
048d76777f
scanners to fmap - hackish
...
peheader to fmap
lacks review + elf + macho
16 years ago
Tomasz Kojm
aca9ea82df
libclamav: handle relative offsets with cli_ac_data; fix offset logic
16 years ago
Tomasz Kojm
33872a43de
libclamav: improve handling of signature offsets
16 years ago
Tomasz Kojm
589d8d8e99
libclamav: add default.h
...
git-svn: trunk@4578
17 years ago
Tomasz Kojm
ab0d2f054d
libclamav, clamd, clamscan: use cl_engine_set() to control AC settings
...
git-svn: trunk@4404
17 years ago
Török Edvin
fc0493d2ca
reduce memory usage of AC nodes
...
git-svn: trunk@4363
17 years ago
Tomasz Kojm
341faf6051
libclamav: drop obsolete code in matcher-ac
...
git-svn: trunk@4140
17 years ago
Tomasz Kojm
710a22f179
libclamav/matcher-ac.c: add support for returning multiple matches in cli_ac_scanbuff()
...
git-svn: trunk@4017
17 years ago
Tomasz Kojm
ee8bd2fb14
libclamav: lsigs: handle extended block modifiers (bb#896)
...
git-svn: trunk@3998
17 years ago
Török Edvin
10290ba3eb
allow custom data to be associated with patterns (such as a regex) via a void*
...
field.
Fix memory leaks, and valgrind problems in regex_list_done.
git-svn: trunk@3994
17 years ago