/*

  *  Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
  *  Copyright (C) 2007-2013 Sourcefire, Inc.
  *  Copyright (C) 2002-2007 Tomasz Kojm <tkojm@clamav.net>
  *

  *  CDIFF code (C) 2006 Sensory Networks, Inc.

  *

  *  Author: Tomasz Kojm <tkojm@clamav.net>

  *
  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.

  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.

  */
 

 #if HAVE_CONFIG_H
 #include "clamav-config.h"
 #endif
 

 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>

 #ifdef HAVE_UNISTD_H

 #include <unistd.h>

 #endif

 #include <zlib.h>
 #include <time.h>
 #include <locale.h>

 #include <sys/types.h>

 #include <sys/stat.h>
 #include <fcntl.h>

 #ifndef _WIN32

 #include <sys/socket.h>
 #include <sys/un.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>

 #include <sys/wait.h>

 #else
 #include "w32_stat.h"

 #endif

 #include <dirent.h>

 #include <ctype.h>

 #include <libgen.h>

 #ifdef HAVE_TERMIOS_H
 #include <termios.h>
 #endif
 

 #include "vba.h"

 #include "shared/output.h"

 #include "shared/optparser.h"

 #include "shared/misc.h"

 #include "shared/cdiff.h"

 #include "shared/tar.h"

 #include "libclamav/clamav.h"

 #include "libclamav/matcher.h"

 #include "libclamav/cvd.h"
 #include "libclamav/str.h"
 #include "libclamav/ole2_extract.h"
 #include "libclamav/htmlnorm.h"

 #include "libclamav/textnorm.h"

 #include "libclamav/default.h"

 #include "libclamav/fmap.h"

 #include "libclamav/readdb.h"

 #include "libclamav/others.h"

 #include "libclamav/pe.h"

 #define MAX_DEL_LOOKAHEAD 5000

 //struct s_info info;
 short recursion = 0, bell = 0;
 short printinfected = 0, printclean = 1;
 

 static const struct dblist_s {

     const char *ext;

     unsigned int count;
 } dblist[] = {
 
     /* special files */

     {"info", 0},
     {"cfg", 0},
     {"ign", 0},
     {"ign2", 0},
     {"ftm", 0},

 
     /* databases */

     {"db", 1},
     {"hdb", 1},
     {"hdu", 1},
     {"hsb", 1},
     {"hsu", 1},
     {"mdb", 1},
     {"mdu", 1},
     {"msb", 1},
     {"msu", 1},
     {"ndb", 1},
     {"ndu", 1},
     {"ldb", 1},
     {"ldu", 1},
     {"sdb", 1},
     {"zmd", 1},
     {"rmd", 1},
     {"idb", 0},

     {"fp", 1}, // TODO Should count be 0 here?  We don't count others like this

     {"sfp", 0},
     {"gdb", 1},
     {"pdb", 1},
     {"wdb", 0},
     {"crb", 1},
     {"cdb", 1},
     {"imp", 1},

     // TODO Should we add .ioc, .yar, .yara, and .pwdb so that sigtool will
     // include these sigs in a build (just in case we need this functionality
     // in the future?)

 
     {NULL, 0}};

 static char *getdbname(const char *str, char *dst, int dstlen)

 {

     int len = strlen(str);

     if (cli_strbcasestr(str, ".cvd") || cli_strbcasestr(str, ".cld") || cli_strbcasestr(str, ".cud"))
         len -= 4;

     if (dst) {
         strncpy(dst, str, MIN(dstlen - 1, len));
         dst[MIN(dstlen - 1, len)] = 0;

     } else {

         dst = (char *)malloc(len + 1);
         if (!dst)
             return NULL;
         strncpy(dst, str, len - 4);
         dst[MIN(dstlen - 1, len - 4)] = 0;

     }

     return dst;

 }
 

 static int hexdump(void)
 {

     char buffer[FILEBUFF], *pt;
     int bytes;
 
     while ((bytes = read(0, buffer, FILEBUFF)) > 0) {
         pt = cli_str2hex(buffer, bytes);
         if (write(1, pt, 2 * bytes) == -1) {
             mprintf("!hexdump: Can't write to stdout\n");
             free(pt);
             return -1;
         }
         free(pt);

     }
 

     if (bytes == -1)
         return -1;

     return 0;
 }

 static int hashpe(const char *filename, unsigned int class, int type)
 {
     STATBUF sb;
     const char *fmptr;
     struct cl_engine *engine;
     cli_ctx ctx;

     struct cl_scan_options options;

     int fd, ret;
 
     /* build engine */

     if (!(engine = cl_engine_new())) {
         mprintf("!hashpe: Can't create new engine\n");
         return -1;

     }
     cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1);
 

     if (cli_initroots(engine, 0) != CL_SUCCESS) {
         mprintf("!hashpe: cli_initroots() failed\n");
         cl_engine_free(engine);
         return -1;

     }
 

     if (cli_parse_add(engine->root[0], "test", "deadbeef", 0, 0, 0, "*", 0, NULL, 0) != CL_SUCCESS) {
         mprintf("!hashpe: Can't parse signature\n");
         cl_engine_free(engine);
         return -1;

     }
 

     if (cl_engine_compile(engine) != CL_SUCCESS) {
         mprintf("!hashpe: Can't compile engine\n");
         cl_engine_free(engine);
         return -1;

     }
 
     /* prepare context */
     memset(&ctx, '\0', sizeof(cli_ctx));

     memset(&options, 0, sizeof(struct cl_scan_options));

     ctx.engine         = engine;
     ctx.options        = &options;

     ctx.options->parse = ~0;

     ctx.containers     = cli_calloc(sizeof(cli_ctx_container), engine->maxreclevel + 2);
     if (!ctx.containers) {
         cl_engine_free(engine);
         return -1;

     }
     ctx.containers[0].type = CL_TYPE_ANY;

     ctx.dconf              = (struct cli_dconf *)engine->dconf;
     ctx.fmap               = calloc(sizeof(fmap_t *), 1);
     if (!ctx.fmap) {

         free(ctx.containers);

         cl_engine_free(engine);
         return -1;

     }
 
     /* Prepare file */
     fd = open(filename, O_RDONLY);

     if (fd < 0) {
         mprintf("!hashpe: Can't open file %s!\n", filename);

         free(ctx.containers);

         free(ctx.fmap);

         cl_engine_free(engine);
         return -1;
     }
 
     lseek(fd, 0, SEEK_SET);
     FSTAT(fd, &sb);

     if (!(*ctx.fmap = fmap(fd, 0, sb.st_size))) {

         free(ctx.containers);

         free(ctx.fmap);
         close(fd);
         cl_engine_free(engine);
         return -1;

     }
 
     fmptr = fmap_need_off_once(*ctx.fmap, 0, sb.st_size);

     if (!fmptr) {

         mprintf("!hashpe: fmap_need_off_once failed!\n");

         free(ctx.containers);

         funmap(*ctx.fmap);

         free(ctx.fmap);
         close(fd);
         cl_engine_free(engine);

         return -1;

     }
 
     cl_debug();
 
     /* Send to PE-specific hasher */

     switch (class) {

         case 1:

             ret = cli_genhash_pe(&ctx, CL_GENHASH_PE_CLASS_SECTION, type, NULL);

             break;

         case 2:

             ret = cli_genhash_pe(&ctx, CL_GENHASH_PE_CLASS_IMPTBL, type, NULL);

             break;

         default:

             mprintf("!hashpe: unknown classification(%u) for pe hash!\n", class);

             free(ctx.containers);
             funmap(*ctx.fmap);
             free(ctx.fmap);
             close(fd);

             cl_engine_free(engine);
             return -1;

     }
 
     /* THIS MAY BE UNNECESSARY */

     switch (ret) {

         case CL_CLEAN:
             break;
         case CL_VIRUS:
             mprintf("*hashpe: CL_VIRUS after cli_genhash_pe()!\n");
             break;
         case CL_BREAK:
             mprintf("*hashpe: CL_BREAK after cli_genhash_pe()!\n");
             break;
         case CL_EFORMAT:
             mprintf("!hashpe: Not a valid PE file!\n");
             break;
         default:
             mprintf("!hashpe: Other error %d inside cli_genhash_pe.\n", ret);
             break;
     }
 
     /* Cleanup */

     free(ctx.containers);

     funmap(*ctx.fmap);

     free(ctx.fmap);
     close(fd);
     cl_engine_free(engine);
     return 0;
 }
 
 static int hashsig(const struct optstruct *opts, unsigned int class, int type)

 {

     char *hash;
     unsigned int i;
     STATBUF sb;
 
     if (opts->filename) {
         for (i = 0; opts->filename[i]; i++) {
             if (CLAMSTAT(opts->filename[i], &sb) == -1) {
                 perror("hashsig");
                 mprintf("!hashsig: Can't access file %s\n", opts->filename[i]);
                 return -1;
             } else {
                 if ((sb.st_mode & S_IFMT) == S_IFREG) {
                     if ((class == 0) && (hash = cli_hashfile(opts->filename[i], type))) {
                         mprintf("%s:%u:%s\n", hash, (unsigned int)sb.st_size, basename(opts->filename[i]));
                         free(hash);
                     } else if ((class > 0) && (hashpe(opts->filename[i], class, type) == 0)) {
                         /* intentionally empty - printed in cli_genhash_pe() */
                     } else {
                         mprintf("!hashsig: Can't generate hash for %s\n", opts->filename[i]);
                         return -1;
                     }
                 }
             }
         }

     } else { /* stream */

         if (class > 0) {
             mprintf("!hashsig: Can't generate requested hash for input stream\n");
             return -1;
         }
         hash = cli_hashstream(stdin, NULL, type);
         if (!hash) {
             mprintf("!hashsig: Can't generate hash for input stream\n");
             return -1;
         }
         mprintf("%s\n", hash);
         free(hash);

     }

     return 0;
 }

 static int htmlnorm(const struct optstruct *opts)

 {

     int fd;
     fmap_t *map;

     if ((fd = open(optget(opts, "html-normalise")->strarg, O_RDONLY)) == -1) {
         mprintf("!htmlnorm: Can't open file %s\n", optget(opts, "html-normalise")->strarg);
         return -1;

     }

     if ((map = fmap(fd, 0, 0))) {
         html_normalise_map(map, ".", NULL, NULL);
         funmap(map);

     } else

         mprintf("!fmap failed\n");
 

     close(fd);

     return 0;
 }

 static int asciinorm(const struct optstruct *opts)
 {
     const char *fname;
     unsigned char *norm_buff;
     struct text_norm_state state;
     size_t map_off;

     fmap_t *map;

     int fd, ofd;
 
     fname = optget(opts, "ascii-normalise")->strarg;

     fd    = open(fname, O_RDONLY);

 
     if (fd == -1) {

         mprintf("!asciinorm: Can't open file %s\n", fname);
         return -1;

     }
 

     if (!(norm_buff = malloc(ASCII_FILE_BUFF_LENGTH))) {
         mprintf("!asciinorm: Can't allocate memory\n");
         close(fd);
         return -1;

     }
 
     if (!(map = fmap(fd, 0, 0))) {

         mprintf("!fmap: Could not map fd %d\n", fd);
         close(fd);
         free(norm_buff);
         return -1;

     }
 
     if (map->len > MAX_ASCII_FILE_SIZE) {

         mprintf("!asciinorm: File size of %zu too large\n", map->len);
         close(fd);
         free(norm_buff);
         funmap(map);
         return -1;

     }
 
     ofd = open("./normalised_text", O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
     if (ofd == -1) {

         mprintf("!asciinorm: Can't open file ./normalised_text\n");
         close(fd);
         free(norm_buff);
         funmap(map);
         return -1;

     }
 
     text_normalize_init(&state, norm_buff, ASCII_FILE_BUFF_LENGTH);
 
     map_off = 0;

     while (map_off != map->len) {
         size_t written;
         if (!(written = text_normalize_map(&state, map, map_off))) break;
         map_off += written;
 
         if (write(ofd, norm_buff, state.out_pos) == -1) {
             mprintf("!asciinorm: Can't write to file ./normalised_text\n");
             close(fd);
             close(ofd);
             free(norm_buff);
             funmap(map);
             return -1;
         }
         text_normalize_reset(&state);

     }
 
     close(fd);
     close(ofd);
     free(norm_buff);
     funmap(map);
     return 0;
 }
 

 static int utf16decode(const struct optstruct *opts)

 {

     const char *fname;
     char *newname, buff[512], *decoded;
     int fd1, fd2, bytes;

     fname = optget(opts, "utf16-decode")->strarg;

     if ((fd1 = open(fname, O_RDONLY)) == -1) {
         mprintf("!utf16decode: Can't open file %s\n", fname);
         return -1;

     }
 
     newname = malloc(strlen(fname) + 7);

     if (!newname) {
         mprintf("!utf16decode: Can't allocate memory\n");
         close(fd1);
         return -1;

     }

     sprintf(newname, "%s.ascii", fname);
 

     if ((fd2 = open(newname, O_WRONLY | O_CREAT | O_TRUNC, S_IRWXU)) < 0) {
         mprintf("!utf16decode: Can't create file %s\n", newname);
         free(newname);
         close(fd1);
         return -1;
     }
 
     while ((bytes = read(fd1, buff, sizeof(buff))) > 0) {
         decoded = cli_utf16toascii(buff, bytes);
         if (decoded) {
             if (write(fd2, decoded, strlen(decoded)) == -1) {
                 mprintf("!utf16decode: Can't write to file %s\n", newname);
                 free(decoded);
                 close(fd1);
                 close(fd2);
                 unlink(newname);
                 free(newname);
                 return -1;
             }
             free(decoded);
         }

     }
 
     free(newname);
     close(fd1);
     close(fd2);
 
     return 0;
 }
 

 static char *getdsig(const char *host, const char *user, const unsigned char *data, unsigned int datalen, unsigned short mode)

 {

     char buff[512], cmd[128], pass[30], *pt;
     struct sockaddr_in server;
     int sockd, bread, len;

 #ifdef HAVE_TERMIOS_H

     struct termios old, new;

 #endif

     memset(&server, 0x00, sizeof(struct sockaddr_in));

     if ((pt = getenv("SIGNDPASS"))) {
         strncpy(pass, pt, sizeof(pass));
         pass[sizeof(pass) - 1] = '\0';

     } else {

         mprintf("Password: ");

 
 #ifdef HAVE_TERMIOS_H

         if (tcgetattr(0, &old)) {
             mprintf("!getdsig: tcgetattr() failed\n");
             return NULL;
         }
         new = old;
         new.c_lflag &= ~ECHO;
         if (tcsetattr(0, TCSAFLUSH, &new)) {
             mprintf("!getdsig: tcsetattr() failed\n");
             return NULL;
         }

 #endif

         if (scanf("%30s", pass) == EOF) {
             mprintf("!getdsig: Can't get password\n");

 #ifdef HAVE_TERMIOS_H

             tcsetattr(0, TCSAFLUSH, &old);

 #endif

             return NULL;
         }

 
 #ifdef HAVE_TERMIOS_H

         if (tcsetattr(0, TCSAFLUSH, &old)) {
             mprintf("!getdsig: tcsetattr() failed\n");
             memset(pass, 0, sizeof(pass));
             return NULL;
         }

 #endif

         mprintf("\n");

     }
 

     if ((sockd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
         perror("socket()");
         mprintf("!getdsig: Can't create socket\n");
         memset(pass, 0, sizeof(pass));
         return NULL;

     }

     server.sin_family      = AF_INET;

     server.sin_addr.s_addr = inet_addr(host);

     server.sin_port        = htons(33101);

     if (connect(sockd, (struct sockaddr *)&server, sizeof(struct sockaddr_in)) < 0) {
         perror("connect()");

         closesocket(sockd);

         mprintf("!getdsig: Can't connect to ClamAV Signing Service at %s\n", host);
         memset(pass, 0, sizeof(pass));
         return NULL;

     }

     memset(cmd, 0, sizeof(cmd));

     if (mode == 1)
         snprintf(cmd, sizeof(cmd) - datalen, "ClamSign:%s:%s:", user, pass);
     else if (mode == 2)
         snprintf(cmd, sizeof(cmd) - datalen, "ClamSignPSS:%s:%s:", user, pass);

     else

         snprintf(cmd, sizeof(cmd) - datalen, "ClamSignPSS2:%s:%s:", user, pass);

     len = strlen(cmd);

     pt  = cmd + len;

     memcpy(pt, data, datalen);
     len += datalen;

     if (send(sockd, cmd, len, 0) < 0) {
         mprintf("!getdsig: Can't write to socket\n");
         closesocket(sockd);
         memset(cmd, 0, sizeof(cmd));
         memset(pass, 0, sizeof(pass));
         return NULL;

     }

     memset(cmd, 0, sizeof(cmd));
     memset(pass, 0, sizeof(pass));

     memset(buff, 0, sizeof(buff));

     if ((bread = recv(sockd, buff, sizeof(buff) - 1, 0)) > 0) {
         buff[bread] = '\0';
         if (!strstr(buff, "Signature:")) {
             mprintf("!getdsig: Error generating digital signature\n");
             mprintf("!getdsig: Answer from remote server: %s\n", buff);
             closesocket(sockd);
             return NULL;
         } else {
             mprintf("Signature received (length = %lu)\n", (unsigned long)strlen(buff) - 10);
         }

     } else {

         mprintf("!getdsig: Communication error with remote server\n");
         closesocket(sockd);
         return NULL;

     }

     closesocket(sockd);

     pt = buff;
     pt += 10;
     return strdup(pt);

 }
 

 static char *sha256file(const char *file, unsigned int *size)

 {

     FILE *fh;
     unsigned int i, bytes;
     unsigned char digest[32], buffer[FILEBUFF];
     char *sha;
     void *ctx;

     ctx = cl_hash_init("sha256");

     if (!(ctx))
         return NULL;

     if (!(fh = fopen(file, "rb"))) {
         mprintf("!sha256file: Can't open file %s\n", file);
         cl_hash_destroy(ctx);
         return NULL;

     }

     if (size)
         *size = 0;
     while ((bytes = fread(buffer, 1, sizeof(buffer), fh))) {
         cl_update_hash(ctx, buffer, bytes);
         if (size)
             *size += bytes;

     }

     cl_finish_hash(ctx, digest);

     sha = (char *)malloc(65);
     if (!sha) {

         fclose(fh);

         return NULL;
     }
     for (i = 0; i < 32; i++)
         sprintf(sha + i * 2, "%02x", digest[i]);

     fclose(fh);

     return sha;
 }

 static int writeinfo(const char *dbname, const char *builder, const char *header, const struct optstruct *opts, char *const *dblist2, unsigned int dblist2cnt)

 {

     FILE *fh;
     unsigned int i, bytes;
     char file[32], *pt, dbfile[32];
     unsigned char digest[32], buffer[FILEBUFF];
     void *ctx;

     snprintf(file, sizeof(file), "%s.info", dbname);

     if (!access(file, R_OK)) {
         if (unlink(file) == -1) {
             mprintf("!writeinfo: Can't unlink %s\n", file);
             return -1;
         }
     }
 
     if (!(fh = fopen(file, "wb+"))) {
         mprintf("!writeinfo: Can't create file %s\n", file);
         return -1;
     }
 
     if (fprintf(fh, "%s\n", header) < 0) {
         mprintf("!writeinfo: Can't write to %s\n", file);

         fclose(fh);
         return -1;
     }
 

     if (dblist2cnt) {
         for (i = 0; i < dblist2cnt; i++) {
             if (!(pt = sha256file(dblist2[i], &bytes))) {
                 mprintf("!writeinfo: Can't generate SHA256 for %s\n", file);
                 fclose(fh);
                 return -1;
             }
             if (fprintf(fh, "%s:%u:%s\n", dblist2[i], bytes, pt) < 0) {
                 mprintf("!writeinfo: Can't write to info file\n");
                 fclose(fh);
                 free(pt);
                 return -1;
             }
             free(pt);
         }
     }
     if (!dblist2cnt || optget(opts, "hybrid")->enabled) {
         for (i = 0; dblist[i].ext; i++) {
             snprintf(dbfile, sizeof(dbfile), "%s.%s", dbname, dblist[i].ext);
             if (strcmp(dblist[i].ext, "info") && !access(dbfile, R_OK)) {
                 if (!(pt = sha256file(dbfile, &bytes))) {
                     mprintf("!writeinfo: Can't generate SHA256 for %s\n", file);
                     fclose(fh);
                     return -1;
                 }
                 if (fprintf(fh, "%s:%u:%s\n", dbfile, bytes, pt) < 0) {
                     mprintf("!writeinfo: Can't write to info file\n");
                     fclose(fh);
                     free(pt);
                     return -1;
                 }
                 free(pt);
             }
         }
     }
     if (!optget(opts, "unsigned")->enabled) {
         rewind(fh);
         ctx = cl_hash_init("sha256");
         if (!(ctx)) {
             fclose(fh);
             return -1;
         }
 
         while ((bytes = fread(buffer, 1, sizeof(buffer), fh)))
             cl_update_hash(ctx, buffer, bytes);
         cl_finish_hash(ctx, digest);
         if (!(pt = getdsig(optget(opts, "server")->strarg, builder, digest, 32, 3))) {
             mprintf("!writeinfo: Can't get digital signature from remote server\n");
             fclose(fh);
             return -1;
         }
         fprintf(fh, "DSIG:%s\n", pt);
         free(pt);

     }

     fclose(fh);
     return 0;
 }
 

 static int diffdirs(const char *old, const char *new, const char *patch);

 static int verifydiff(const char *diff, const char *cvd, const char *incdir);
 

 static int script2cdiff(const char *script, const char *builder, const struct optstruct *opts)

 {

     char *cdiff, *pt, buffer[FILEBUFF];
     unsigned char digest[32];
     void *ctx;
     STATBUF sb;
     FILE *scripth, *cdiffh;
     gzFile gzh;
     unsigned int ver, osize;
     int bytes;

     if (CLAMSTAT(script, &sb) == -1) {
         mprintf("!script2diff: Can't stat file %s\n", script);
         return -1;

     }

     osize = (unsigned int)sb.st_size;

 
     cdiff = strdup(script);

     if (NULL == cdiff) {

         mprintf("!script2cdiff: Unable to allocate memory for file name\n");
         return -1;

     }

     pt = strstr(cdiff, ".script");

     if (!pt) {
         mprintf("!script2cdiff: Incorrect file name (no .script extension)\n");
         free(cdiff);
         return -1;

     }
     strcpy(pt, ".cdiff");
 

     if (!(pt = strchr(script, '-'))) {
         mprintf("!script2cdiff: Incorrect file name syntax\n");
         free(cdiff);
         return -1;

     }

     if (sscanf(++pt, "%u.script", &ver) == EOF) {
         mprintf("!script2cdiff: Incorrect file name syntax\n");
         free(cdiff);
         return -1;

     }

     if (!(cdiffh = fopen(cdiff, "wb"))) {
         mprintf("!script2cdiff: Can't open %s for writing\n", cdiff);
         free(cdiff);
         return -1;

     }
 

     if (fprintf(cdiffh, "ClamAV-Diff:%u:%u:", ver, osize) < 0) {
         mprintf("!script2cdiff: Can't write to %s\n", cdiff);
         fclose(cdiffh);
         free(cdiff);
         return -1;

     }
     fclose(cdiffh);
 

     if (!(scripth = fopen(script, "rb"))) {
         mprintf("!script2cdiff: Can't open file %s for reading\n", script);
         unlink(cdiff);
         free(cdiff);
         return -1;

     }
 

     if (!(gzh = gzopen(cdiff, "ab9f"))) {
         mprintf("!script2cdiff: Can't open file %s for appending\n", cdiff);
         unlink(cdiff);
         free(cdiff);
         fclose(scripth);
         return -1;

     }
 

     while ((bytes = fread(buffer, 1, sizeof(buffer), scripth)) > 0) {
         if (!gzwrite(gzh, buffer, bytes)) {
             mprintf("!script2cdiff: Can't gzwrite to %s\n", cdiff);
             unlink(cdiff);
             free(cdiff);
             fclose(scripth);
             gzclose(gzh);
             return -1;
         }

     }
     fclose(scripth);
     gzclose(gzh);
 

     if (!(cdiffh = fopen(cdiff, "rb"))) {
         mprintf("!script2cdiff: Can't open %s for reading/writing\n", cdiff);
         unlink(cdiff);
         free(cdiff);
         return -1;

     }
 

     ctx = cl_hash_init("sha256");

     if (!(ctx)) {
         unlink(cdiff);
         free(cdiff);

         fclose(cdiffh);

         return -1;
     }

     while ((bytes = fread(buffer, 1, sizeof(buffer), cdiffh)))
         cl_update_hash(ctx, (unsigned char *)buffer, bytes);

 
     fclose(cdiffh);

     cl_finish_hash(ctx, digest);

     if (!(pt = getdsig(optget(opts, "server")->strarg, builder, digest, 32, 2))) {
         mprintf("!script2cdiff: Can't get digital signature from remote server\n");
         unlink(cdiff);
         free(cdiff);
         return -1;

     }
 

     if (!(cdiffh = fopen(cdiff, "ab"))) {
         mprintf("!script2cdiff: Can't open %s for appending\n", cdiff);
         unlink(cdiff);
         free(cdiff);
         return -1;

     }
     fprintf(cdiffh, ":%s", pt);
     free(pt);
     fclose(cdiffh);
 
     mprintf("Created %s\n", cdiff);
     free(cdiff);
 
     return 0;
 }

 static int qcompare(const void *a, const void *b)
 {

     return strcmp(*(char *const *)a, *(char *const *)b);

 }
 

 static int build(const struct optstruct *opts)

 {

     int ret, bc = 0, hy = 0;
     size_t bytes;
     unsigned int i, sigs = 0, oldsigs = 0, entries = 0, version, real_header, fl, maxentries;
     STATBUF foo;
     unsigned char buffer[FILEBUFF];
     char *tarfile, header[513], smbuff[32], builder[32], *pt, olddb[512];
     char patch[32], broken[32], dbname[32], dbfile[32];
     const char *newcvd, *localdbdir = NULL;
     struct cl_engine *engine;
     FILE *cvd, *fh;
     gzFile tar;
     time_t timet;
     struct tm *brokent;
     struct cl_cvd *oldcvd;
     char **dblist2          = NULL;
     unsigned int dblist2cnt = 0;
     DIR *dd;
     struct dirent *dent;
 
 #define FREE_LS(x)                   \
     for (i = 0; i < dblist2cnt; i++) \
         free(x[i]);                  \

     free(x);

     if (!optget(opts, "server")->enabled && !optget(opts, "unsigned")->enabled) {
         mprintf("!build: --server is required for --build\n");
         return -1;

     }
 

     if (optget(opts, "datadir")->active)
         localdbdir = optget(opts, "datadir")->strarg;

     if (CLAMSTAT("COPYING", &foo) == -1) {
         mprintf("!build: COPYING file not found in current working directory.\n");
         return -1;

     }
 

     getdbname(optget(opts, "build")->strarg, dbname, sizeof(dbname));

     if (!strcmp(dbname, "bytecode"))
         bc = 1;

     if (optget(opts, "hybrid")->enabled)
         hy = 1;

     if (!(engine = cl_engine_new())) {
         mprintf("!build: Can't initialize antivirus engine\n");
         return 50;

     }
 

     if ((ret = cl_load(".", engine, &sigs, CL_DB_STDOPT | CL_DB_PUA | CL_DB_SIGNED))) {
         mprintf("!build: Can't load database: %s\n", cl_strerror(ret));
         cl_engine_free(engine);
         return -1;

     }

     cl_engine_free(engine);

     if (!sigs) {
         mprintf("!build: There are no signatures in database files\n");

     } else {

         if (bc || hy) {
             if ((dd = opendir(".")) == NULL) {
                 mprintf("!build: Can't open current directory\n");
                 return -1;
             }
             while ((dent = readdir(dd))) {
                 if (dent->d_ino) {
                     if (cli_strbcasestr(dent->d_name, ".cbc")) {
                         dblist2 = (char **)realloc(dblist2, (dblist2cnt + 1) * sizeof(char *));
                         if (!dblist2) { /* dblist2 leaked but we don't really care */
                             mprintf("!build: Memory allocation error\n");

                             closedir(dd);

                             return -1;
                         }
                         dblist2[dblist2cnt] = strdup(dent->d_name);
                         if (!dblist2[dblist2cnt]) {
                             FREE_LS(dblist2);
                             mprintf("!build: Memory allocation error\n");
                             return -1;
                         }
                         dblist2cnt++;
                     }
                 }
             }
             closedir(dd);
             entries += dblist2cnt;
             if (dblist2 != NULL) {
                 qsort(dblist2, dblist2cnt, sizeof(char *), qcompare);
             }
 
             if (!access("last.hdb", R_OK)) {
                 if (!dblist2cnt) {
                     mprintf("!build: dblist2 == NULL (no .cbc files?)\n");
                     return -1;
                 }
                 dblist2 = (char **)realloc(dblist2, (dblist2cnt + 1) * sizeof(char *));
                 if (!dblist2) {
                     mprintf("!build: Memory allocation error\n");
                     return -1;
                 }
                 dblist2[dblist2cnt] = strdup("last.hdb");
                 if (!dblist2[dblist2cnt]) {
                     FREE_LS(dblist2);
                     mprintf("!build: Memory allocation error\n");
                     return -1;
                 }
                 dblist2cnt++;
                 entries += countlines("last.hdb");
             }
         }
         if (!bc || hy) {
             for (i = 0; dblist[i].ext; i++) {
                 snprintf(dbfile, sizeof(dbfile), "%s.%s", dbname, dblist[i].ext);
                 if (dblist[i].count && !access(dbfile, R_OK))
                     entries += countlines(dbfile);
             }
         }
 
         if (entries != sigs)
             mprintf("^build: Signatures in %s db files: %u, loaded by libclamav: %u\n", dbname, entries, sigs);
 
         maxentries = optget(opts, "max-bad-sigs")->numarg;
 
         if (maxentries) {
             if (!entries || (sigs > entries && sigs - entries >= maxentries)) {
                 mprintf("!Bad number of signatures in database files\n");
                 FREE_LS(dblist2);
                 return -1;
             }
         }

     }

     /* try to read cvd header of current database */

     if (opts->filename) {
         if (cli_strbcasestr(opts->filename[0], ".cvd") || cli_strbcasestr(opts->filename[0], ".cld") || cli_strbcasestr(opts->filename[0], ".cud")) {
             strncpy(olddb, opts->filename[0], sizeof(olddb));
             olddb[sizeof(olddb) - 1] = '\0';
         } else {
             mprintf("!build: Not a CVD/CLD/CUD file\n");
             FREE_LS(dblist2);
             return -1;
         }

 
     } else {

         pt = freshdbdir();
         snprintf(olddb, sizeof(olddb), "%s" PATHSEP "%s.cvd", localdbdir ? localdbdir : pt, dbname);
         if (access(olddb, R_OK))
             snprintf(olddb, sizeof(olddb), "%s" PATHSEP "%s.cld", localdbdir ? localdbdir : pt, dbname);
         if (access(olddb, R_OK))
             snprintf(olddb, sizeof(olddb), "%s" PATHSEP "%s.cud", localdbdir ? localdbdir : pt, dbname);
         free(pt);

     }

     if (!(oldcvd = cl_cvdhead(olddb)) && !optget(opts, "unsigned")->enabled) {
         mprintf("^build: CAN'T READ CVD HEADER OF CURRENT DATABASE %s (wait 3 s)\n", olddb);
         sleep(3);

     }
 

     if (oldcvd) {
         version = oldcvd->version + 1;
         oldsigs = oldcvd->sigs;
         cl_cvdfree(oldcvd);

     } else if (optget(opts, "cvd-version")->numarg != 0) {
         version = optget(opts, "cvd-version")->numarg;

     } else {

         mprintf("Version number: ");
         if (scanf("%u", &version) == EOF) {
             mprintf("!build: scanf() failed\n");
             FREE_LS(dblist2);
             return -1;
         }

     }
 

     mprintf("Total sigs: %u\n", sigs);

     if (sigs > oldsigs)
         mprintf("New sigs: %u\n", sigs - oldsigs);

     strcpy(header, "ClamAV-VDB:");
 
     /* time */
     time(&timet);
     brokent = localtime(&timet);
     setlocale(LC_TIME, "C");
     strftime(smbuff, sizeof(smbuff), "%d %b %Y %H-%M %z", brokent);
     strcat(header, smbuff);
 
     /* version */

     sprintf(header + strlen(header), ":%u:", version);

 
     /* number of signatures */

     sprintf(header + strlen(header), "%u:", sigs);

 
     /* functionality level */

     fl = (unsigned int)(optget(opts, "flevel")->numarg);

     sprintf(header + strlen(header), "%u:", fl);

 
     real_header = strlen(header);
 
     /* add fake MD5 and dsig (for writeinfo) */
     strcat(header, "X:X:");
 

     if ((pt = getenv("SIGNDUSER"))) {
         strncpy(builder, pt, sizeof(builder));
         builder[sizeof(builder) - 1] = '\0';

     } else {

         mprintf("Builder name: ");
         if (scanf("%32s", builder) == EOF) {
             mprintf("!build: Can't get builder name\n");
             free(dblist2);
             return -1;
         }

     }
 
     /* add builder */
     strcat(header, builder);
 
     /* add current time */

     sprintf(header + strlen(header), ":%u", (unsigned int)timet);

     if (writeinfo(dbname, builder, header, opts, dblist2, dblist2cnt) == -1) {
         mprintf("!build: Can't generate info file\n");
         FREE_LS(dblist2);
         return -1;

     }
 

     header[real_header] = 0;
 

     if (!(tarfile = cli_gentemp("."))) {
         mprintf("!build: Can't generate temporary name for tarfile\n");
         FREE_LS(dblist2);
         return -1;
     }
 
     if ((tar = gzopen(tarfile, "wb9f")) == NULL) {
         mprintf("!build: Can't open file %s for writing\n", tarfile);
         free(tarfile);
         FREE_LS(dblist2);
         return -1;
     }
 
     if (tar_addfile(-1, tar, "COPYING") == -1) {
         mprintf("!build: Can't add COPYING to tar archive\n");
         gzclose(tar);
         unlink(tarfile);
         free(tarfile);
         FREE_LS(dblist2);
         return -1;
     }
 
     if (bc || hy) {
         if (!hy && tar_addfile(-1, tar, "bytecode.info") == -1) {
             gzclose(tar);
             unlink(tarfile);
             free(tarfile);
             FREE_LS(dblist2);
             return -1;
         }
         for (i = 0; i < dblist2cnt; i++) {
             if (tar_addfile(-1, tar, dblist2[i]) == -1) {
                 gzclose(tar);
                 unlink(tarfile);
                 free(tarfile);
                 FREE_LS(dblist2);
                 return -1;
             }
         }
     }
     if (!bc || hy) {
         for (i = 0; dblist[i].ext; i++) {
             snprintf(dbfile, sizeof(dbfile), "%s.%s", dbname, dblist[i].ext);
             if (!access(dbfile, R_OK)) {
                 if (tar_addfile(-1, tar, dbfile) == -1) {
                     gzclose(tar);
                     unlink(tarfile);
                     free(tarfile);
                     FREE_LS(dblist2);
                     return -1;
                 }
             }
         }

     }

     gzclose(tar);

     FREE_LS(dblist2);

     /* MD5 + dsig */

     if (!(fh = fopen(tarfile, "rb"))) {
         mprintf("!build: Can't open file %s for reading\n", tarfile);
         unlink(tarfile);
         free(tarfile);
         return -1;

     }
 

     if (!(pt = cli_hashstream(fh, buffer, 1))) {
         mprintf("!build: Can't generate MD5 checksum for %s\n", tarfile);
         fclose(fh);
         unlink(tarfile);
         free(tarfile);
         return -1;

     }

     rewind(fh);
     sprintf(header + strlen(header), "%s:", pt);

     free(pt);

     if (!optget(opts, "unsigned")->enabled) {
         if (!(pt = getdsig(optget(opts, "server")->strarg, builder, buffer, 16, 1))) {
             mprintf("!build: Can't get digital signature from remote server\n");
             fclose(fh);
             unlink(tarfile);
             free(tarfile);
             return -1;
         }
         sprintf(header + strlen(header), "%s:", pt);
         free(pt);

     } else {

         sprintf(header + strlen(header), "X:");

     }

     /* add builder */

     strcat(header, builder);

     /* add current time */

     sprintf(header + strlen(header), ":%u", (unsigned int)timet);

     /* fill up with spaces */

     while (strlen(header) < sizeof(header) - 1)
         strcat(header, " ");

 
     /* build the final database */

     newcvd = optget(opts, "build")->strarg;

     if (!(cvd = fopen(newcvd, "wb"))) {
         mprintf("!build: Can't create final database %s\n", newcvd);
         fclose(fh);
         unlink(tarfile);
         free(tarfile);
         return -1;
     }
 
     if (fwrite(header, 1, 512, cvd) != 512) {
         mprintf("!build: Can't write to %s\n", newcvd);
         fclose(fh);
         unlink(tarfile);
         free(tarfile);
         fclose(cvd);
         unlink(newcvd);
         return -1;
     }
 
     while ((bytes = fread(buffer, 1, FILEBUFF, fh)) > 0) {
         if (fwrite(buffer, 1, bytes, cvd) != bytes) {
             mprintf("!build: Can't write to %s\n", newcvd);
             fclose(fh);
             unlink(tarfile);
             free(tarfile);
             fclose(cvd);
             unlink(newcvd);
             return -1;
         }

     }

     fclose(fh);

     fclose(cvd);

     if (unlink(tarfile) == -1) {
         mprintf("^build: Can't unlink %s\n", tarfile);
         unlink(tarfile);
         free(tarfile);
         unlink(newcvd);
         return -1;

     }

     free(tarfile);

     mprintf("Created %s\n", newcvd);

     if (optget(opts, "unsigned")->enabled)
         return 0;

     if (!oldcvd || optget(opts, "no-cdiff")->enabled) {
         mprintf("Skipping .cdiff creation\n");
         return 0;

     }
 

     /* generate patch */

     if (!(pt = cli_gentemp(NULL))) {
         mprintf("!build: Can't generate temporary name\n");
         unlink(newcvd);
         return -1;

     }

     if (mkdir(pt, 0700)) {
         mprintf("!build: Can't create temporary directory %s\n", pt);
         free(pt);
         unlink(newcvd);
         return -1;

     }
 

     if (cli_cvdunpack(olddb, pt) == -1) {
         mprintf("!build: Can't unpack CVD file %s\n", olddb);
         cli_rmdirs(pt);
         free(pt);
         unlink(newcvd);
         return -1;

     }
     strncpy(olddb, pt, sizeof(olddb));

     olddb[sizeof(olddb) - 1] = '\0';

     free(pt);
 

     if (!(pt = cli_gentemp(NULL))) {
         mprintf("!build: Can't generate temporary name\n");
         cli_rmdirs(olddb);
         unlink(newcvd);
         return -1;

     }
 

     if (mkdir(pt, 0700)) {
         mprintf("!build: Can't create temporary directory %s\n", pt);
         free(pt);
         cli_rmdirs(olddb);
         unlink(newcvd);
         return -1;

     }

     if (cli_cvdunpack(newcvd, pt) == -1) {
         mprintf("!build: Can't unpack CVD file %s\n", newcvd);
         cli_rmdirs(pt);
         free(pt);
         cli_rmdirs(olddb);
         unlink(newcvd);
         return -1;

     }
 

     snprintf(patch, sizeof(patch), "%s-%u.script", dbname, version);

     ret = diffdirs(olddb, pt, patch);
 

     cli_rmdirs(pt);

     free(pt);
 

     if (ret == -1) {
         cli_rmdirs(olddb);
         unlink(newcvd);
         return -1;

     }
 

     ret = verifydiff(patch, NULL, olddb);

     cli_rmdirs(olddb);

     if (ret == -1) {
         snprintf(broken, sizeof(broken), "%s.broken", patch);
         if (rename(patch, broken)) {
             unlink(patch);
             mprintf("!Generated file is incorrect, removed");
         } else {
             mprintf("!Generated file is incorrect, renamed to %s\n", broken);
         }

     } else {

         ret = script2cdiff(patch, builder, opts);

     }
 
     return ret;

 }
 

 static int unpack(const struct optstruct *opts)

 {

     char name[512], *dbdir;
     const char *localdbdir = NULL;
 
     if (optget(opts, "datadir")->active)
         localdbdir = optget(opts, "datadir")->strarg;
 
     if (optget(opts, "unpack-current")->enabled) {
         dbdir = freshdbdir();
         snprintf(name, sizeof(name), "%s" PATHSEP "%s.cvd", localdbdir ? localdbdir : dbdir, optget(opts, "unpack-current")->strarg);
         if (access(name, R_OK)) {
             snprintf(name, sizeof(name), "%s" PATHSEP "%s.cld", localdbdir ? localdbdir : dbdir, optget(opts, "unpack-current")->strarg);
             if (access(name, R_OK)) {
                 mprintf("!unpack: Couldn't find %s CLD/CVD database in %s\n", optget(opts, "unpack-current")->strarg, localdbdir ? localdbdir : dbdir);
                 free(dbdir);
                 return -1;
             }
         }
         free(dbdir);

     } else {

         strncpy(name, optget(opts, "unpack")->strarg, sizeof(name));
         name[sizeof(name) - 1] = '\0';

     }

     if (cl_cvdverify(name) != CL_SUCCESS) {
         mprintf("!unpack: %s is not a valid CVD\n", name);
         return -1;
     }
 

     if (cli_cvdunpack(name, ".") == -1) {
         mprintf("!unpack: Can't unpack file %s\n", name);
         return -1;

     }
 

     return 0;

 }
 

 static int cvdinfo(const struct optstruct *opts)

 {

     struct cl_cvd *cvd;
     char *pt;
     int ret;

     pt = optget(opts, "info")->strarg;

     if ((cvd = cl_cvdhead(pt)) == NULL) {
         mprintf("!cvdinfo: Can't read/parse CVD header of %s\n", pt);
         return -1;

     }

     mprintf("File: %s\n", pt);

     pt = strchr(cvd->time, '-');

     if (!pt) {

         cl_cvdfree(cvd);

         return -1;
     }

     *pt = ':';

     mprintf("Build time: %s\n", cvd->time);

     mprintf("Version: %u\n", cvd->version);
     mprintf("Signatures: %u\n", cvd->sigs);
     mprintf("Functionality level: %u\n", cvd->fl);

     mprintf("Builder: %s\n", cvd->builder);

     pt = optget(opts, "info")->strarg;

     if (cli_strbcasestr(pt, ".cvd")) {
         mprintf("MD5: %s\n", cvd->md5);
         mprintf("Digital signature: %s\n", cvd->dsig);

     }

     cl_cvdfree(cvd);

     if (cli_strbcasestr(pt, ".cud"))
         mprintf("Verification: Unsigned container\n");
     else if ((ret = cl_cvdverify(pt))) {
         mprintf("!cvdinfo: Verification: %s\n", cl_strerror(ret));
         return -1;

     } else

         mprintf("Verification OK.\n");

     return 0;

 }
 

 static int listdb(const char *filename, const regex_t *regex);

 static int listdir(const char *dirname, const regex_t *regex)

 {

     DIR *dd;
     struct dirent *dent;
     char *dbfile;

     if ((dd = opendir(dirname)) == NULL) {

         mprintf("!listdir: Can't open directory %s\n", dirname);

         return -1;

     }
 

     while ((dent = readdir(dd))) {
         if (dent->d_ino) {
             if (strcmp(dent->d_name, ".") && strcmp(dent->d_name, "..") &&
                 (cli_strbcasestr(dent->d_name, ".db") ||
                  cli_strbcasestr(dent->d_name, ".hdb") ||
                  cli_strbcasestr(dent->d_name, ".hdu") ||
                  cli_strbcasestr(dent->d_name, ".hsb") ||
                  cli_strbcasestr(dent->d_name, ".hsu") ||
                  cli_strbcasestr(dent->d_name, ".mdb") ||
                  cli_strbcasestr(dent->d_name, ".mdu") ||
                  cli_strbcasestr(dent->d_name, ".msb") ||
                  cli_strbcasestr(dent->d_name, ".msu") ||
                  cli_strbcasestr(dent->d_name, ".ndb") ||
                  cli_strbcasestr(dent->d_name, ".ndu") ||
                  cli_strbcasestr(dent->d_name, ".ldb") ||
                  cli_strbcasestr(dent->d_name, ".ldu") ||
                  cli_strbcasestr(dent->d_name, ".sdb") ||
                  cli_strbcasestr(dent->d_name, ".zmd") ||
                  cli_strbcasestr(dent->d_name, ".rmd") ||
                  cli_strbcasestr(dent->d_name, ".cdb") ||
                  cli_strbcasestr(dent->d_name, ".cbc") ||
                  cli_strbcasestr(dent->d_name, ".cld") ||
                  cli_strbcasestr(dent->d_name, ".cvd") ||
                  cli_strbcasestr(dent->d_name, ".crb") ||
                  cli_strbcasestr(dent->d_name, ".imp"))) {
 
                 dbfile = (char *)malloc(strlen(dent->d_name) + strlen(dirname) + 2);
                 if (!dbfile) {
                     mprintf("!listdir: Can't allocate memory for dbfile\n");
                     closedir(dd);
                     return -1;
                 }
                 sprintf(dbfile, "%s" PATHSEP "%s", dirname, dent->d_name);
 
                 if (listdb(dbfile, regex) == -1) {
                     mprintf("!listdb: Error listing database %s\n", dbfile);
                     free(dbfile);
                     closedir(dd);
                     return -1;
                 }
                 free(dbfile);
             }
         }

     }

     closedir(dd);
     return 0;

 }

 static int listdb(const char *filename, const regex_t *regex)

 {

     FILE *fh;
     char *buffer, *pt, *start, *dir;
     const char *dbname, *pathsep = PATHSEP;
     unsigned int line = 0;

     if ((fh = fopen(filename, "rb")) == NULL) {
         mprintf("!listdb: Can't open file %s\n", filename);
         return -1;

     }
 

     if (!(buffer = (char *)malloc(FILEBUFF))) {
         mprintf("!listdb: Can't allocate memory for buffer\n");
         fclose(fh);
         return -1;

     }
 
     /* check for CVD file */

     if (!fgets(buffer, 12, fh)) {
         mprintf("!listdb: fgets failed\n");
         free(buffer);
         fclose(fh);
         return -1;

     }
     rewind(fh);

     if (!strncmp(buffer, "ClamAV-VDB:", 11)) {
         free(buffer);
         fclose(fh);

         if (!(dir = cli_gentemp(NULL))) {
             mprintf("!listdb: Can't generate temporary name\n");
             return -1;
         }

         if (mkdir(dir, 0700)) {
             mprintf("!listdb: Can't create temporary directory %s\n", dir);
             free(dir);
             return -1;
         }

         if (cli_cvdunpack(filename, dir) == -1) {
             mprintf("!listdb: Can't unpack CVD file %s\n", filename);
             cli_rmdirs(dir);
             free(dir);
             return -1;
         }

         /* list extracted directory */
         if (listdir(dir, regex) == -1) {
             mprintf("!listdb: Can't list directory %s\n", filename);
             cli_rmdirs(dir);
             free(dir);
             return -1;
         }

         cli_rmdirs(dir);
         free(dir);

         return 0;

     }
 

     if (!(dbname = strrchr(filename, *pathsep))) {
         mprintf("!listdb: Invalid filename %s\n", filename);
         fclose(fh);
         free(buffer);
         return -1;

     }
     dbname++;
 

     if (cli_strbcasestr(filename, ".db")) { /* old style database */

         while (fgets(buffer, FILEBUFF, fh)) {
             if (regex) {
                 cli_chomp(buffer);
                 if (!cli_regexec(regex, buffer, 0, NULL, 0))
                     mprintf("[%s] %s\n", dbname, buffer);
                 continue;
             }
             line++;

             if (buffer && buffer[0] == '#')

                 continue;
 

             pt = strchr(buffer, '=');
             if (!pt) {
                 mprintf("!listdb: Malformed pattern line %u (file %s)\n", line, filename);
                 fclose(fh);
                 free(buffer);
                 return -1;
             }

             start = buffer;
             *pt   = 0;

             if ((pt = strstr(start, " (Clam)")))
                 *pt = 0;

             mprintf("%s\n", start);
         }

     } else if (cli_strbcasestr(filename, ".crb")) {
         while (fgets(buffer, FILEBUFF, fh)) {
             cli_chomp(buffer);

             if (buffer[0] == '#')
                 continue;
 
             if (regex) {

                 if (!cli_regexec(regex, buffer, 0, NULL, 0))

                     mprintf("[%s] %s\n", dbname, buffer);
 
                 continue;
             }
             line++;
             mprintf("%s\n", buffer);
         }

     } else if (cli_strbcasestr(filename, ".hdb") || cli_strbcasestr(filename, ".hdu") || cli_strbcasestr(filename, ".mdb") || cli_strbcasestr(filename, ".mdu") || cli_strbcasestr(filename, ".hsb") || cli_strbcasestr(filename, ".hsu") || cli_strbcasestr(filename, ".msb") || cli_strbcasestr(filename, ".msu") || cli_strbcasestr(filename, ".imp")) { /* hash database */

         while (fgets(buffer, FILEBUFF, fh)) {
             cli_chomp(buffer);
             if (regex) {
                 if (!cli_regexec(regex, buffer, 0, NULL, 0))
                     mprintf("[%s] %s\n", dbname, buffer);
                 continue;
             }
             line++;

             if (buffer && buffer[0] == '#')

                 continue;
 
             start = cli_strtok(buffer, 2, ":");

             if (!start) {
                 mprintf("!listdb: Malformed pattern line %u (file %s)\n", line, filename);
                 fclose(fh);
                 free(buffer);
                 return -1;
             }

             if ((pt = strstr(start, " (Clam)")))
                 *pt = 0;

             mprintf("%s\n", start);
             free(start);
         }

     } else if (cli_strbcasestr(filename, ".ndb") || cli_strbcasestr(filename, ".ndu") || cli_strbcasestr(filename, ".ldb") || cli_strbcasestr(filename, ".ldu") || cli_strbcasestr(filename, ".sdb") || cli_strbcasestr(filename, ".zmd") || cli_strbcasestr(filename, ".rmd") || cli_strbcasestr(filename, ".cdb")) {

         while (fgets(buffer, FILEBUFF, fh)) {
             cli_chomp(buffer);
             if (regex) {
                 if (!cli_regexec(regex, buffer, 0, NULL, 0))
                     mprintf("[%s] %s\n", dbname, buffer);
                 continue;
             }
             line++;

             if (buffer && buffer[0] == '#')

                 continue;
 

             if (cli_strbcasestr(filename, ".ldb") || cli_strbcasestr(filename, ".ldu"))
                 pt = strchr(buffer, ';');
             else
                 pt = strchr(buffer, ':');
 
             if (!pt) {
                 mprintf("!listdb: Malformed pattern line %u (file %s)\n", line, filename);
                 fclose(fh);
                 free(buffer);
                 return -1;
             }
             *pt = 0;
 
             if ((pt = strstr(buffer, " (Clam)")))
                 *pt = 0;
 
             mprintf("%s\n", buffer);
         }
 
     } else if (cli_strbcasestr(filename, ".cbc")) {
         if (fgets(buffer, FILEBUFF, fh) && fgets(buffer, FILEBUFF, fh)) {
             pt = strchr(buffer, ';');
             if (!pt) { /* not a real sig */
                 fclose(fh);
                 free(buffer);
                 return 0;
             }
             if (regex) {
                 if (!cli_regexec(regex, buffer, 0, NULL, 0)) {
                     mprintf("[%s BYTECODE] %s", dbname, buffer);
                 }
             } else {
                 *pt = 0;
                 mprintf("%s\n", buffer);
             }
         }

     }

     fclose(fh);

     free(buffer);
     return 0;
 }
 

 static int listsigs(const struct optstruct *opts, int mode)

 {

     int ret;
     const char *name;
     char *dbdir;
     STATBUF sb;
     regex_t reg;
     const char *localdbdir = NULL;
 
     if (optget(opts, "datadir")->active)
         localdbdir = optget(opts, "datadir")->strarg;
 
     if (mode == 0) {
         name = optget(opts, "list-sigs")->strarg;
         if (access(name, R_OK) && localdbdir)
             name = localdbdir;
         if (CLAMSTAT(name, &sb) == -1) {
             mprintf("--list-sigs: Can't get status of %s\n", name);
             return -1;
         }
 
         mprintf_stdout = 1;
         if (S_ISDIR(sb.st_mode)) {
             if (!strcmp(name, DATADIR)) {
                 dbdir = freshdbdir();
                 ret   = listdir(localdbdir ? localdbdir : dbdir, NULL);
                 free(dbdir);
             } else {
                 ret = listdir(name, NULL);
             }
         } else {
             ret = listdb(name, NULL);
         }

     } else {

         if (cli_regcomp(&reg, optget(opts, "find-sigs")->strarg, REG_EXTENDED | REG_NOSUB) != 0) {
             mprintf("--find-sigs: Can't compile regex\n");
             return -1;
         }
         mprintf_stdout = 1;
         dbdir          = freshdbdir();
         ret            = listdir(localdbdir ? localdbdir : dbdir, &reg);
         free(dbdir);
         cli_regfree(&reg);

     }

     return ret;
 }
 

 static int vbadump(const struct optstruct *opts)

 {

     int fd, hex_output;
     char *dir;
     const char *pt;
     struct uniq *vba = NULL;
     cli_ctx *ctx;
 
     if (optget(opts, "vba-hex")->enabled) {
         hex_output = 1;
         pt         = optget(opts, "vba-hex")->strarg;

     } else {

         hex_output = 0;
         pt         = optget(opts, "vba")->strarg;

     }

 
     if ((fd = open(pt, O_RDONLY | O_BINARY)) == -1) {
         mprintf("!vbadump: Can't open file %s\n", pt);
         return -1;

     }
 
     /* generate the temporary directory */

     if (!(dir = cli_gentemp(NULL))) {
         mprintf("!vbadump: Can't generate temporary name\n");
         close(fd);
         return -1;

     }
 

     if (mkdir(dir, 0700)) {
         mprintf("!vbadump: Can't create temporary directory %s\n", dir);
         free(dir);
         close(fd);

         return -1;
     }

     if (!(ctx = convenience_ctx(fd))) {
         close(fd);
         free(dir);
         return -1;

     }

     if (cli_ole2_extract(dir, ctx, &vba)) {
         destroy_ctx(-1, ctx);
         cli_rmdirs(dir);

         free(dir);

         close(fd);

         return -1;
     }

     destroy_ctx(-1, ctx);

     if (vba)
         sigtool_vba_scandir(dir, hex_output, vba);

     cli_rmdirs(dir);

     free(dir);

     close(fd);

     return 0;

 }
 

 static int comparesha(const char *diff)

 {

     char info[32], buff[FILEBUFF], *sha, *pt, *name;
     const char *tokens[3];
     FILE *fh;
     int ret = 0, tokens_count;

     name = strdup(diff);

     if (!name) {
         mprintf("!verifydiff: strdup() failed\n");
         return -1;

     }

     if (!(pt = strrchr(name, '-')) || !isdigit(pt[1])) {
         mprintf("!verifydiff: Invalid diff name\n");
         free(name);
         return -1;

     }
     *pt = 0;

     if ((pt = strrchr(name, *PATHSEP)))
         pt++;

     else

         pt = name;

     snprintf(info, sizeof(info), "%s.info", pt);
     free(name);

     if (!(fh = fopen(info, "rb"))) {
         mprintf("!verifydiff: Can't open %s\n", info);
         return -1;
     }
 
     if (!fgets(buff, sizeof(buff), fh) || strncmp(buff, "ClamAV-VDB", 10)) {
         mprintf("!verifydiff: Incorrect info file %s\n", info);
         fclose(fh);
         return -1;
     }
 
     while (fgets(buff, sizeof(buff), fh)) {
         cli_chomp(buff);
         tokens_count = cli_strtokenize(buff, ':', 3, tokens);
         if (tokens_count != 3) {
             if (!strcmp(tokens[0], "DSIG"))
                 continue;
             mprintf("!verifydiff: Incorrect format of %s\n", info);
             ret = -1;
             break;
         }
         if (!(sha = sha256file(tokens[0], NULL))) {
             mprintf("!verifydiff: Can't generate SHA256 for %s\n", buff);
             ret = -1;
             break;
         }
         if (strcmp(sha, tokens[2])) {
             mprintf("!verifydiff: %s has incorrect checksum\n", buff);
             ret = -1;
             free(sha);
             break;
         }
         free(sha);

     }
 
     fclose(fh);
     return ret;
 }
 

 static int rundiff(const struct optstruct *opts)

 {

     int fd, ret;
     unsigned short mode;
     const char *diff;

     diff = optget(opts, "run-cdiff")->strarg;

     if (strstr(diff, ".cdiff")) {
         mode = 1;
     } else if (strstr(diff, ".script")) {
         mode = 0;

     } else {

         mprintf("!rundiff: Incorrect file name (no .cdiff/.script extension)\n");
         return -1;

     }

     if ((fd = open(diff, O_RDONLY | O_BINARY)) == -1) {
         mprintf("!rundiff: Can't open file %s\n", diff);
         return -1;

     }

     ret = cdiff_apply(fd, mode);

     close(fd);
 

     if (!ret)
         ret = comparesha(diff);

     return ret;
 }
 

 static int maxlinelen(const char *file)
 {

     int fd, bytes, n = 0, nmax = 0, i;
     char buff[512];

     if ((fd = open(file, O_RDONLY)) == -1) {
         mprintf("!maxlinelen: Can't open file %s\n", file);
         return -1;

     }
 

     while ((bytes = read(fd, buff, 512)) > 0) {
         for (i = 0; i < bytes; i++, ++n) {
             if (buff[i] == '\n') {
                 if (n > nmax)
                     nmax = n;
                 n = 0;
             }
         }

     }
 

     if (bytes == -1) {
         mprintf("!maxlinelen: Can't read file %s\n", file);
         close(fd);
         return -1;

     }

     close(fd);

     return nmax + 1;

 }
 

 static int compare(const char *oldpath, const char *newpath, FILE *diff)
 {

     FILE *old, *new;
     char *obuff, *nbuff, *tbuff, *pt, *omd5, *nmd5;
     unsigned int oline = 0, tline, found, i, badxchg = 0;
     int l1 = 0, l2;
     long opos;
 
     if (!access(oldpath, R_OK) && (omd5 = cli_hashfile(oldpath, 1))) {
         if (!(nmd5 = cli_hashfile(newpath, 1))) {
             mprintf("!compare: Can't get MD5 checksum of %s\n", newpath);
             free(omd5);
             return -1;
         }
         if (!strcmp(omd5, nmd5)) {
             free(omd5);
             free(nmd5);
             return 0;
         }
         free(omd5);
         free(nmd5);
         l1 = maxlinelen(oldpath);

     }
 

     l2 = maxlinelen(newpath);

     if (l1 == -1 || l2 == -1)
         return -1;

     l1 = MAX(l1, l2) + 1;
 
     obuff = malloc(l1);

     if (!obuff) {
         mprintf("!compare: Can't allocate memory for 'obuff'\n");
         return -1;

     }
     nbuff = malloc(l1);

     if (!nbuff) {
         mprintf("!compare: Can't allocate memory for 'nbuff'\n");
         free(obuff);
         return -1;

     }
     tbuff = malloc(l1);

     if (!tbuff) {
         mprintf("!compare: Can't allocate memory for 'tbuff'\n");
         free(obuff);
         free(nbuff);
         return -1;

     }
 

     if (l1 > CLI_DEFAULT_LSIG_BUFSIZE)
         fprintf(diff, "#LSIZE %u\n", l1 + 32);

     fprintf(diff, "OPEN %s\n", newpath);
 

     if (!(new = fopen(newpath, "rb"))) {
         mprintf("!compare: Can't open file %s for reading\n", newpath);
         free(obuff);
         free(nbuff);
         free(tbuff);
         return -1;

     }

     old = fopen(oldpath, "rb");

     while (fgets(nbuff, l1, new)) {
         i = strlen(nbuff);
         if (i >= 2 && (nbuff[i - 1] == '\r' || (nbuff[i - 1] == '\n' && nbuff[i - 2] == '\r'))) {
             mprintf("!compare: New %s file contains lines terminated with CRLF or CR\n", newpath);
             if (old)
                 fclose(old);
             fclose(new);
             free(obuff);
             free(nbuff);
             free(tbuff);
             return -1;
         }
         cli_chomp(nbuff);
         if (!old) {
             fprintf(diff, "ADD %s\n", nbuff);
         } else {
             if (fgets(obuff, l1, old)) {
                 oline++;
                 cli_chomp(obuff);
                 if (!strcmp(nbuff, obuff)) {
                     continue;
                 } else {
                     tline = 0;
                     found = 0;
                     opos  = ftell(old);
                     while (fgets(tbuff, l1, old)) {
                         tline++;
                         cli_chomp(tbuff);
 
                         if (tline > MAX_DEL_LOOKAHEAD)
                             break;
 
                         if (!strcmp(tbuff, nbuff)) {
                             found = 1;
                             break;
                         }
                     }
                     fseek(old, opos, SEEK_SET);
 
                     if (found) {
                         strncpy(tbuff, obuff, l1);
                         tbuff[l1 - 1] = '\0';
                         for (i = 0; i < tline; i++) {
                             tbuff[MIN(16, l1 - 1)] = 0;
                             if ((pt = strchr(tbuff, ' ')))
                                 *pt = 0;
                             fprintf(diff, "DEL %u %s\n", oline + i, tbuff);
                             if (!fgets(tbuff, l1, old))
                                 break;
                         }
                         oline += tline;
 
                     } else {
                         if (!*obuff || *obuff == ' ') {
                             badxchg = 1;
                             break;
                         }
                         obuff[MIN(16, l1 - 1)] = 0;
                         if ((pt = strchr(obuff, ' ')))
                             *pt = 0;
                         fprintf(diff, "XCHG %u %s %s\n", oline, obuff, nbuff);
                     }
                 }
             } else {
                 fclose(old);
                 old = NULL;
                 fprintf(diff, "ADD %s\n", nbuff);
             }
         }
     }
 
     if (old) {
         if (!badxchg) {
             while (fgets(obuff, l1, old)) {
                 oline++;
                 cli_chomp(obuff);
                 obuff[MIN(16, l1 - 1)] = 0;
                 if ((pt = strchr(obuff, ' ')))
                     *pt = 0;
                 fprintf(diff, "DEL %u %s\n", oline, obuff);
             }
         }
         fclose(old);

     }

     fprintf(diff, "CLOSE\n");

     free(obuff);
     free(tbuff);

     if (badxchg) {
         fprintf(diff, "UNLINK %s\n", newpath);
         fprintf(diff, "OPEN %s\n", newpath);
         rewind(new);
         while (fgets(nbuff, l1, new)) {
             cli_chomp(nbuff);
             fprintf(diff, "ADD %s\n", nbuff);
         }
         fprintf(diff, "CLOSE\n");

     }
     free(nbuff);
     fclose(new);

     return 0;
 }
 

 static int compareone(const struct optstruct *opts)
 {

     if (!opts->filename) {
         mprintf("!makediff: --compare requires two arguments\n");
         return -1;

     }

     return compare(optget(opts, "compare")->strarg, opts->filename[0], stdout);

 }
 

 static int dircopy(const char *src, const char *dest)
 {

     DIR *dd;
     struct dirent *dent;
     STATBUF sb;
     char spath[512], dpath[512];

     if (CLAMSTAT(dest, &sb) == -1) {
         if (mkdir(dest, 0755)) {
             /* mprintf("!dircopy: Can't create temporary directory %s\n", dest); */
             return -1;
         }

     }
 

     if ((dd = opendir(src)) == NULL) {

         /* mprintf("!dircopy: Can't open directory %s\n", src); */
         return -1;
     }
 

     while ((dent = readdir(dd))) {
         if (dent->d_ino) {
             if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, ".."))
                 continue;

             snprintf(spath, sizeof(spath), "%s" PATHSEP "%s", src, dent->d_name);
             snprintf(dpath, sizeof(dpath), "%s" PATHSEP "%s", dest, dent->d_name);

             if (filecopy(spath, dpath) == -1) {
                 /* mprintf("!dircopy: Can't copy %s to %s\n", spath, dpath); */
                 cli_rmdirs(dest);
                 closedir(dd);
                 return -1;
             }
         }

     }
 
     closedir(dd);
     return 0;
 }
 

 static int verifydiff(const char *diff, const char *cvd, const char *incdir)

 {

     char *tempdir, cwd[512];
     int ret = 0, fd;
     unsigned short mode;
 
     if (strstr(diff, ".cdiff")) {
         mode = 1;
     } else if (strstr(diff, ".script")) {
         mode = 0;

     } else {

         mprintf("!verifydiff: Incorrect file name (no .cdiff/.script extension)\n");
         return -1;

     }

 
     tempdir = cli_gentemp(NULL);

     if (!tempdir) {
         mprintf("!verifydiff: Can't generate temporary name for tempdir\n");
         return -1;

     }
 

     if (mkdir(tempdir, 0700) == -1) {
         mprintf("!verifydiff: Can't create directory %s\n", tempdir);
         free(tempdir);
         return -1;

     }
 

     if (cvd) {
         if (cli_cvdunpack(cvd, tempdir) == -1) {
             mprintf("!verifydiff: Can't unpack CVD file %s\n", cvd);
             cli_rmdirs(tempdir);
             free(tempdir);
             return -1;
         }

     } else {

         if (dircopy(incdir, tempdir) == -1) {
             mprintf("!verifydiff: Can't copy dir %s to %s\n", incdir, tempdir);
             cli_rmdirs(tempdir);
             free(tempdir);
             return -1;
         }

     }
 

     if (!getcwd(cwd, sizeof(cwd))) {
         mprintf("!verifydiff: getcwd() failed\n");
         cli_rmdirs(tempdir);
         free(tempdir);
         return -1;

     }
 

     if ((fd = open(diff, O_RDONLY | O_BINARY)) == -1) {
         mprintf("!verifydiff: Can't open diff file %s\n", diff);
         cli_rmdirs(tempdir);
         free(tempdir);
         return -1;

     }

     if (chdir(tempdir) == -1) {
         mprintf("!verifydiff: Can't chdir to %s\n", tempdir);
         cli_rmdirs(tempdir);
         free(tempdir);
         close(fd);
         return -1;

     }
 

     if (cdiff_apply(fd, mode) == -1) {
         mprintf("!verifydiff: Can't apply %s\n", diff);
         if (chdir(cwd) == -1)
             mprintf("^verifydiff: Can't chdir to %s\n", cwd);
         cli_rmdirs(tempdir);
         free(tempdir);
         close(fd);
         return -1;

     }
     close(fd);
 

     ret = comparesha(diff);

     if (chdir(cwd) == -1)
         mprintf("^verifydiff: Can't chdir to %s\n", cwd);

     cli_rmdirs(tempdir);

     free(tempdir);
 

     if (!ret) {
         if (cvd)
             mprintf("Verification: %s correctly applies to %s\n", diff, cvd);
         else
             mprintf("Verification: %s correctly applies to the previous version\n", diff);

     }

 
     return ret;
 }
 

 static void matchsig(const char *sig, const char *offset, int fd)

 {

     struct cl_engine *engine;
     struct cli_ac_result *acres = NULL, *res;
     STATBUF sb;
     unsigned int matches = 0;
     cli_ctx ctx;
     struct cl_scan_options options;
     int ret;

     mprintf("SUBSIG: %s\n", sig);
 

     if (!(engine = cl_engine_new())) {
         mprintf("!matchsig: Can't create new engine\n");
         return;

     }

     cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1);

     if (cli_initroots(engine, 0) != CL_SUCCESS) {
         mprintf("!matchsig: cli_initroots() failed\n");
         cl_engine_free(engine);
         return;

     }
 

     if (cli_parse_add(engine->root[0], "test", sig, 0, 0, 0, "*", 0, NULL, 0) != CL_SUCCESS) {
         mprintf("!matchsig: Can't parse signature\n");
         cl_engine_free(engine);
         return;

     }
 

     if (cl_engine_compile(engine) != CL_SUCCESS) {
         mprintf("!matchsig: Can't compile engine\n");
         cl_engine_free(engine);
         return;

     }
     memset(&ctx, '\0', sizeof(cli_ctx));

     memset(&options, 0, sizeof(struct cl_scan_options));

     ctx.engine         = engine;
     ctx.options        = &options;

     ctx.options->parse = ~0;

     ctx.containers     = cli_calloc(sizeof(cli_ctx_container), engine->maxreclevel + 2);
     if (!ctx.containers) {
         cl_engine_free(engine);
         return;

     }
     ctx.containers[0].type = CL_TYPE_ANY;

     ctx.dconf              = (struct cli_dconf *)engine->dconf;
     ctx.fmap               = calloc(sizeof(fmap_t *), 1);
     if (!ctx.fmap) {

         free(ctx.containers);

         cl_engine_free(engine);
         return;

     }
     lseek(fd, 0, SEEK_SET);

     FSTAT(fd, &sb);

     if (!(*ctx.fmap = fmap(fd, 0, sb.st_size))) {

         free(ctx.containers);

         free(ctx.fmap);
         cl_engine_free(engine);
         return;

     }
     ret = cli_fmap_scandesc(&ctx, 0, 0, NULL, AC_SCAN_VIR, &acres, NULL);
     res = acres;

     while (res) {
         matches++;
         res = res->next;
     }
     if (matches) {
         /* TODO: check offsets automatically */
         mprintf("MATCH: ** YES%s ** (%u %s:", offset ? "/CHECK OFFSET" : "", matches, matches > 1 ? "matches at offsets" : "match at offset");
         res = acres;
         while (res) {
             mprintf(" %u", (unsigned int)res->offset);
             res = res->next;
         }
         mprintf(")\n");

     } else {

         mprintf("MATCH: ** NO **\n");

     }

     while (acres) {
         res   = acres;
         acres = acres->next;
         free(res);

     }

     free(ctx.containers);

     funmap(*ctx.fmap);

     free(ctx.fmap);

     cl_engine_free(engine);
 }
 

 static char *decodehexstr(const char *hex, unsigned int *dlen)

 {

     uint16_t *str16;
     char *decoded;
     unsigned int i, p = 0, wildcard = 0, len = strlen(hex) / 2;

 
     str16 = cli_hex2ui(hex);

     if (!str16)
         return NULL;

     for (i = 0; i < len; i++)
         if (str16[i] & CLI_MATCH_WILDCARD)
             wildcard++;

     decoded = calloc(len + 1 + wildcard * 32, sizeof(char));

     if (!decoded) {

         free(str16);

         mprintf("!decodehexstr: Can't allocate memory for decoded\n");
         return NULL;
     }
 
     for (i = 0; i < len; i++) {
         if (str16[i] & CLI_MATCH_WILDCARD) {
             switch (str16[i] & CLI_MATCH_WILDCARD) {
                 case CLI_MATCH_IGNORE:
                     p += sprintf(decoded + p, "{WILDCARD_IGNORE}");
                     break;
 
                 case CLI_MATCH_NIBBLE_HIGH:
                     p += sprintf(decoded + p, "{WILDCARD_NIBBLE_HIGH:0x%x}", str16[i] & 0x00f0);
                     break;
 
                 case CLI_MATCH_NIBBLE_LOW:
                     p += sprintf(decoded + p, "{WILDCARD_NIBBLE_LOW:0x%x}", str16[i] & 0x000f);
                     break;
 
                 default:
                     mprintf("!decodehexstr: Unknown wildcard (0x%x@%u)\n", str16[i] & CLI_MATCH_WILDCARD, i);
                     free(decoded);
                     free(str16);
                     return NULL;
             }
         } else {
             decoded[p] = str16[i];
             p++;
         }
     }
 
     if (dlen)
         *dlen = p;

     free(str16);

     return decoded;
 }
 

 inline static char *get_paren_end(char *hexstr)
 {
     char *pt;
     int level = 0;
 
     pt = hexstr;

     while (*pt != '\0') {
         if (*pt == '(') {
             level++;
         } else if (*pt == ')') {
             if (!level)
                 return pt;
             level--;
         }
         pt++;

     }
     return NULL;
 }
 

 static char *decodehexspecial(const char *hex, unsigned int *dlen)
 {

     char *pt, *start, *hexcpy, *decoded, *h, *e, *c, op, lop;

     unsigned int len = 0, hlen, negative;

     int level;
     char *buff;

     hexcpy = NULL;

     buff   = NULL;

 
     hexcpy = strdup(hex);

     if (!hexcpy) {
         mprintf("!decodehexspecial: strdup(hex) failed\n");
         return NULL;

     }
     pt = strchr(hexcpy, '(');

     if (!pt) {
         free(hexcpy);
         return decodehexstr(hex, dlen);

     } else {

         buff = calloc(strlen(hex) + 512, sizeof(char));
         if (!buff) {
             mprintf("!decodehexspecial: Can't allocate memory for buff\n");
             free(hexcpy);
             return NULL;
         }
         start = hexcpy;
         do {
             negative = 0;
             *pt++    = 0;
             if (!start) {
                 mprintf("!decodehexspecial: Unexpected EOL\n");
                 free(hexcpy);
                 free(buff);
                 return NULL;
             }
             if (pt >= hexcpy + 2) {
                 if (pt[-2] == '!') {
                     negative = 1;
                     pt[-2]   = 0;
                 }
             }
             if (!(decoded = decodehexstr(start, &hlen))) {
                 mprintf("!Decoding failed (1): %s\n", pt);
                 free(hexcpy);
                 free(buff);
                 return NULL;
             }
             memcpy(&buff[len], decoded, hlen);
             len += hlen;
             free(decoded);
 
             if (!(start = get_paren_end(pt))) {
                 mprintf("!decodehexspecial: Missing closing parenthesis\n");
                 free(hexcpy);
                 free(buff);
                 return NULL;
             }
 
             *start++ = 0;
             if (!strlen(pt)) {
                 mprintf("!decodehexspecial: Empty block\n");
                 free(hexcpy);
                 free(buff);
                 return NULL;
             }
 
             if (!strcmp(pt, "B")) {
                 if (!*start) {
                     if (negative)
                         len += sprintf(buff + len, "{NOT_BOUNDARY_RIGHT}");
                     else
                         len += sprintf(buff + len, "{BOUNDARY_RIGHT}");
                     continue;
                 } else if (pt - 1 == hexcpy) {
                     if (negative)
                         len += sprintf(buff + len, "{NOT_BOUNDARY_LEFT}");
                     else
                         len += sprintf(buff + len, "{BOUNDARY_LEFT}");
                     continue;
                 }
             } else if (!strcmp(pt, "L")) {
                 if (!*start) {
                     if (negative)
                         len += sprintf(buff + len, "{NOT_LINE_MARKER_RIGHT}");
                     else
                         len += sprintf(buff + len, "{LINE_MARKER_RIGHT}");
                     continue;
                 } else if (pt - 1 == hexcpy) {
                     if (negative)
                         len += sprintf(buff + len, "{NOT_LINE_MARKER_LEFT}");
                     else
                         len += sprintf(buff + len, "{LINE_MARKER_LEFT}");
                     continue;
                 }
             } else if (!strcmp(pt, "W")) {
                 if (!*start) {
                     if (negative)
                         len += sprintf(buff + len, "{NOT_WORD_MARKER_RIGHT}");
                     else
                         len += sprintf(buff + len, "{WORD_MARKER_RIGHT}");
                     continue;
                 } else if (pt - 1 == hexcpy) {
                     if (negative)
                         len += sprintf(buff + len, "{NOT_WORD_MARKER_LEFT}");
                     else
                         len += sprintf(buff + len, "{WORD_MARKER_LEFT}");
                     continue;
                 }
             } else {
                 if (!strlen(pt)) {
                     mprintf("!decodehexspecial: Empty block\n");
                     free(hexcpy);
                     free(buff);
                     return NULL;
                 }
 
                 /* TODO: analyze string alternative for typing */
                 if (negative)
                     len += sprintf(buff + len, "{EXCLUDING_STRING_ALTERNATIVE:");
                 else
                     len += sprintf(buff + len, "{STRING_ALTERNATIVE:");
 
                 level = 0;
                 h = e = pt;
                 op    = '\0';
                 while ((level >= 0) && (e = strpbrk(h, "()|"))) {
                     lop = op;
                     op  = *e;
 
                     *e++ = 0;
                     if (op != '(' && lop != ')' && !strlen(h)) {
                         mprintf("!decodehexspecial: Empty string alternative block\n");
                         free(hexcpy);
                         free(buff);
                         return NULL;
                     }
 
                     //mprintf("decodehexspecial: %s\n", h);
                     if (!(c = cli_hex2str(h))) {
                         mprintf("!Decoding failed (3): %s\n", h);
                         free(hexcpy);
                         free(buff);
                         return NULL;
                     }
                     memcpy(&buff[len], c, strlen(h) / 2);
                     len += strlen(h) / 2;
                     free(c);
 
                     switch (op) {
                         case '(':
                             level++;
                             negative = 0;
                             if (e >= pt + 2) {
                                 if (e[-2] == '!') {
                                     negative = 1;
                                     e[-2]    = 0;
                                 }
                             }
 
                             if (negative)
                                 len += sprintf(buff + len, "{EXCLUDING_STRING_ALTERNATIVE:");
                             else
                                 len += sprintf(buff + len, "{STRING_ALTERNATIVE:");
 
                             break;
                         case ')':
                             level--;
                             buff[len++] = '}';
 
                             break;
                         case '|':
                             buff[len++] = '|';
 
                             break;
                         default:;
                     }
 
                     h = e;
                 }
                 if (!(c = cli_hex2str(h))) {
                     mprintf("!Decoding failed (4): %s\n", h);
                     free(hexcpy);
                     free(buff);
                     return NULL;
                 }
                 memcpy(&buff[len], c, strlen(h) / 2);
                 len += strlen(h) / 2;
                 free(c);
 
                 buff[len++] = '}';
                 if (level != 0) {
                     mprintf("!decodehexspecial: Invalid string alternative nesting\n");
                     free(hexcpy);
                     free(buff);
                     return NULL;
                 }
             }
         } while ((pt = strchr(start, '(')));
 
         if (start) {
             if (!(decoded = decodehexstr(start, &hlen))) {
                 mprintf("!Decoding failed (2)\n");
                 free(buff);
                 free(hexcpy);
                 return NULL;
             }
             memcpy(&buff[len], decoded, hlen);
             len += hlen;
             free(decoded);
         }

     }
     free(hexcpy);

     if (dlen)
         *dlen = len;

     return buff;
 }
 

 static int decodehex(const char *hexsig)

 {

     char *pt, *hexcpy, *start, *n, *decoded, *wild;
     int asterisk = 0;
     unsigned int i, j, hexlen, dlen, parts = 0, bw;
     int mindist = 0, maxdist = 0, error = 0;

 
     hexlen = strlen(hexsig);

     if ((wild = strchr(hexsig, '/'))) {

         /* ^offset:trigger-logic/regex/options$ */
         char *trigger, *regex, *regex_end, *cflags;
         size_t tlen = wild - hexsig, rlen, clen;
 
         /* check for trigger */
         if (!tlen) {
             mprintf("!pcre without logical trigger\n");
             return -1;
         }
 
         /* locate end of regex for options start, locate options length */
         if ((regex_end = strchr(wild + 1, '/')) == NULL) {
             mprintf("!missing regex expression terminator /\n");
             return -1;
         }
         rlen = regex_end - wild - 1;
         clen = hexlen - tlen - rlen - 2; /* 2 from regex boundaries '/' */
 
         /* get the trigger statement */
         trigger = cli_calloc(tlen + 1, sizeof(char));
         if (!trigger) {
             mprintf("!cannot allocate memory for trigger string\n");
             return -1;
         }
         strncpy(trigger, hexsig, tlen);
         trigger[tlen] = '\0';
 
         /* get the regex expression */
         regex = cli_calloc(rlen + 1, sizeof(char));
         if (!regex) {
             mprintf("!cannot allocate memory for regex expression\n");
             free(trigger);
             return -1;
         }
         strncpy(regex, hexsig + tlen + 1, rlen);
         regex[rlen] = '\0';
 
         /* get the compile flags */
         if (clen) {
             cflags = cli_calloc(clen + 1, sizeof(char));
             if (!cflags) {
                 mprintf("!cannot allocate memory for compile flags\n");
                 free(trigger);
                 free(regex);
                 return -1;
             }
             strncpy(cflags, hexsig + tlen + rlen + 2, clen);
             cflags[clen] = '\0';
         } else {
             cflags = NULL;
         }
 
         /* print components of regex subsig */
         mprintf("     +-> TRIGGER: %s\n", trigger);
         mprintf("     +-> REGEX: %s\n", regex);
         mprintf("     +-> CFLAGS: %s\n", cflags);
 
         free(trigger);
         free(regex);
         if (cflags)
             free(cflags);

 #if HAVE_PCRE

         return 0;

 #else

         mprintf("!PCRE subsig cannot be loaded without PCRE support\n");
         return -1;

 #endif

     } else if (strchr(hexsig, '{') || strchr(hexsig, '[')) {
         if (!(hexcpy = strdup(hexsig)))
             return -1;
 
         for (i = 0; i < hexlen; i++)
             if (hexsig[i] == '{' || hexsig[i] == '[' || hexsig[i] == '*')
                 parts++;
 
         if (parts)
             parts++;
 
         start = pt = hexcpy;
         for (i = 1; i <= parts; i++) {
             if (i != parts) {
                 for (j = 0; j < strlen(start); j++) {
                     if (start[j] == '{' || start[j] == '[') {
                         asterisk = 0;
                         pt       = start + j;
                         break;
                     }
                     if (start[j] == '*') {
                         asterisk = 1;
                         pt       = start + j;
                         break;
                     }
                 }
                 *pt++ = 0;
             }
 
             if (mindist && maxdist) {
                 if (mindist == maxdist)
                     mprintf("{WILDCARD_ANY_STRING(LENGTH==%u)}", mindist);
                 else
                     mprintf("{WILDCARD_ANY_STRING(LENGTH>=%u&&<=%u)}", mindist, maxdist);
             } else if (mindist)
                 mprintf("{WILDCARD_ANY_STRING(LENGTH>=%u)}", mindist);
             else if (maxdist)
                 mprintf("{WILDCARD_ANY_STRING(LENGTH<=%u)}", maxdist);
 
             if (!(decoded = decodehexspecial(start, &dlen))) {
                 mprintf("!Decoding failed\n");
                 free(hexcpy);
                 return -1;
             }
             bw = write(1, decoded, dlen);
             free(decoded);
 
             if (i == parts)
                 break;
 
             if (asterisk)
                 mprintf("{WILDCARD_ANY_STRING}");
 
             mindist = maxdist = 0;
 
             if (asterisk) {
                 start = pt;
                 continue;
             }
 
             if (!(start = strchr(pt, '}')) && !(start = strchr(pt, ']'))) {
                 error = 1;
                 break;
             }
             *start++ = 0;
 
             if (!pt) {
                 error = 1;
                 break;
             }
 
             if (!strchr(pt, '-')) {
                 if (!cli_isnumber(pt) || (mindist = maxdist = atoi(pt)) < 0) {
                     error = 1;
                     break;
                 }
             } else {
                 if ((n = cli_strtok(pt, 0, "-"))) {
                     if (!cli_isnumber(n) || (mindist = atoi(n)) < 0) {
                         error = 1;
                         free(n);
                         break;
                     }
                     free(n);
                 }
 
                 if ((n = cli_strtok(pt, 1, "-"))) {
                     if (!cli_isnumber(n) || (maxdist = atoi(n)) < 0) {
                         error = 1;
                         free(n);
                         break;
                     }
                     free(n);
                 }
 
                 if ((n = cli_strtok(pt, 2, "-"))) { /* strict check */
                     error = 1;
                     free(n);
                     break;
                 }
             }
         }
 
         free(hexcpy);
         if (error)
             return -1;
 
     } else if (strchr(hexsig, '*')) {
         for (i = 0; i < hexlen; i++)
             if (hexsig[i] == '*')
                 parts++;
 
         if (parts)
             parts++;
 
         for (i = 1; i <= parts; i++) {
             if ((pt = cli_strtok(hexsig, i - 1, "*")) == NULL) {
                 mprintf("!Can't extract part %u of partial signature\n", i);
                 return -1;
             }
             if (!(decoded = decodehexspecial(pt, &dlen))) {
                 mprintf("!Decoding failed\n");
                 free(pt);
                 return -1;
             }
             bw = write(1, decoded, dlen);
             free(decoded);
             if (i < parts)
                 mprintf("{WILDCARD_ANY_STRING}");
             free(pt);
         }

 
     } else {

         if (!(decoded = decodehexspecial(hexsig, &dlen))) {
             mprintf("!Decoding failed\n");
             return -1;
         }
         bw = write(1, decoded, dlen);
         free(decoded);

     }
 

     mprintf("\n");
     return 0;

 }
 

 static int decodesigmod(const char *sigmod)
 {

     size_t i;

 
     for (i = 0; i < strlen(sigmod); i++) {
         mprintf(" ");
 
         switch (sigmod[i]) {
             case 'i':
                 mprintf("NOCASE");
                 break;
             case 'f':
                 mprintf("FULLWORD");
                 break;
             case 'w':
                 mprintf("WIDE");
                 break;
             case 'a':
                 mprintf("ASCII");
                 break;
             default:
                 mprintf("UNKNOWN");
                 return -1;
         }

     }
 
     mprintf("\n");
     return 0;
 }
 

 static int decodecdb(char **tokens)

 {

     int sz = 0;

     char *range[2];
 
     if (!tokens)
         return -1;
 
     mprintf("VIRUS NAME: %s\n", tokens[0]);
     mprintf("CONTAINER TYPE: %s\n", (strcmp(tokens[1], "*") ? tokens[1] : "ANY"));
     mprintf("CONTAINER SIZE: ");
     if (!cli_isnumber(tokens[2])) {
         if (!strcmp(tokens[2], "*")) {
             mprintf("ANY\n");
 
         } else if (strchr(tokens[2], '-')) {
             sz = cli_strtokenize(tokens[2], '-', 2 + 1, (const char **)range);
             if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) {
                 mprintf("!decodesig: Invalid container size range\n");
                 return -1;
             }
             mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]);
 
         } else {
             mprintf("!decodesig: Invalid container size\n");
             return -1;
         }
     } else {
         mprintf("%s\n", tokens[2]);
     }
     mprintf("FILENAME REGEX: %s\n", tokens[3]);
     mprintf("COMPRESSED FILESIZE: ");
     if (!cli_isnumber(tokens[4])) {
         if (!strcmp(tokens[4], "*")) {
             mprintf("ANY\n");
 
         } else if (strchr(tokens[4], '-')) {
             sz = cli_strtokenize(tokens[4], '-', 2 + 1, (const char **)range);
             if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) {
                 mprintf("!decodesig: Invalid container size range\n");
                 return -1;
             }
             mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]);
 
         } else {
             mprintf("!decodesig: Invalid compressed filesize\n");
             return -1;
         }
     } else {
         mprintf("%s\n", tokens[4]);
     }
     mprintf("UNCOMPRESSED FILESIZE: ");
     if (!cli_isnumber(tokens[5])) {
         if (!strcmp(tokens[5], "*")) {
             mprintf("ANY\n");
 
         } else if (strchr(tokens[5], '-')) {
             sz = cli_strtokenize(tokens[5], '-', 2 + 1, (const char **)range);
             if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) {
                 mprintf("!decodesig: Invalid container size range\n");
                 return -1;
             }
             mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]);
 
         } else {
             mprintf("!decodesig: Invalid uncompressed filesize\n");
             return -1;
         }
     } else {
         mprintf("%s\n", tokens[5]);
     }
 
     mprintf("ENCRYPTION: ");
     if (!cli_isnumber(tokens[6])) {
         if (!strcmp(tokens[6], "*")) {
             mprintf("IGNORED\n");
         } else {
             mprintf("!decodesig: Invalid encryption flag\n");
             return -1;
         }
     } else {
         mprintf("%s\n", (atoi(tokens[6]) ? "YES" : "NO"));
     }
 
     mprintf("FILE POSITION: ");
     if (!cli_isnumber(tokens[7])) {
         if (!strcmp(tokens[7], "*")) {
             mprintf("ANY\n");
 
         } else if (strchr(tokens[7], '-')) {
             sz = cli_strtokenize(tokens[7], '-', 2 + 1, (const char **)range);
             if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) {
                 mprintf("!decodesig: Invalid container size range\n");
                 return -1;
             }
             mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]);
 
         } else {
             mprintf("!decodesig: Invalid file position\n");
             return -1;
         }
     } else {
         mprintf("%s\n", tokens[7]);
     }
 
     if (!strcmp(tokens[1], "CL_TYPE_ZIP") || !strcmp(tokens[1], "CL_TYPE_RAR")) {
         if (!strcmp(tokens[8], "*")) {
             mprintf("CRC SUM: ANY\n");
         } else {
 
             errno = 0;
             sz    = (int)strtol(tokens[8], NULL, 16);
             if (!sz && errno) {
                 mprintf("!decodesig: Invalid cyclic redundancy check sum\n");
                 return -1;
             } else {
                 mprintf("CRC SUM: %d\n", sz);
             }
         }
     }
 
     return 0;

 }
 

 static int decodeftm(char **tokens, int tokens_count)
 {
     mprintf("FILE TYPE NAME: %s\n", tokens[3]);
     mprintf("FILE SIGNATURE TYPE: %s\n", tokens[0]);
     mprintf("FILE MAGIC OFFSET: %s\n", tokens[1]);
     mprintf("FILE MAGIC HEX: %s\n", tokens[2]);
     mprintf("FILE MAGIC DECODED:\n");
     decodehex(tokens[2]);
     mprintf("FILE TYPE REQUIRED: %s\n", tokens[4]);
     mprintf("FILE TYPE DETECTED: %s\n", tokens[5]);

     if (tokens_count == 7)

         mprintf("FTM FLEVEL: >=%s\n", tokens[6]);

     else if (tokens_count == 8)

         mprintf("FTM FLEVEL: %s..%s\n", tokens[6], tokens[7]);
     return 0;
 }
 

 static int decodesig(char *sig, int fd)

 {

     char *pt;
     char *tokens[68], *subtokens[4], *subhex;
     int tokens_count, subtokens_count, subsigs, i, bc = 0;
 
     if (*sig == '[') {
         if (!(pt = strchr(sig, ']'))) {
             mprintf("!decodesig: Invalid input\n");
             return -1;
         }
         sig = &pt[2];
     }
 
     if (strchr(sig, ';')) { /* lsig */
         tokens_count = cli_ldbtokenize(sig, ';', 67 + 1, (const char **)tokens, 2);
         if (tokens_count < 4) {
             mprintf("!decodesig: Invalid or not supported signature format\n");
             return -1;
         }
         mprintf("VIRUS NAME: %s\n", tokens[0]);
         if (strlen(tokens[0]) && strstr(tokens[0], ".{") && tokens[0][strlen(tokens[0]) - 1] == '}')
             bc = 1;
         mprintf("TDB: %s\n", tokens[1]);
         mprintf("LOGICAL EXPRESSION: %s\n", tokens[2]);
         subsigs = cli_ac_chklsig(tokens[2], tokens[2] + strlen(tokens[2]), NULL, NULL, NULL, 1);
         if (subsigs == -1) {
             mprintf("!decodesig: Broken logical expression\n");
             return -1;
         }
         subsigs++;
         if (subsigs > 64) {
             mprintf("!decodesig: Too many subsignatures\n");
             return -1;
         }
         if (!bc && subsigs != tokens_count - 3) {
             mprintf("!decodesig: The number of subsignatures (==%u) doesn't match the IDs in the logical expression (==%u)\n", tokens_count - 3, subsigs);
             return -1;
         }
         for (i = 0; i < tokens_count - 3; i++) {
             if (i >= subsigs)
                 mprintf(" * BYTECODE SUBSIG\n");
             else
                 mprintf(" * SUBSIG ID %d\n", i);
 
             subtokens_count = cli_ldbtokenize(tokens[3 + i], ':', 4, (const char **)subtokens, 0);
             if (!subtokens_count) {
                 mprintf("!decodesig: Invalid or not supported subsignature format\n");
                 return -1;
             }
             if ((subtokens_count % 2) == 0)
                 mprintf(" +-> OFFSET: %s\n", subtokens[0]);
             else
                 mprintf(" +-> OFFSET: ANY\n");
 
             if (subtokens_count == 3) {
                 mprintf(" +-> SIGMOD:");
                 decodesigmod(subtokens[2]);
             } else if (subtokens_count == 4) {
                 mprintf(" +-> SIGMOD:");
                 decodesigmod(subtokens[3]);
             } else {
                 mprintf(" +-> SIGMOD: NONE\n");
             }
 
             subhex = (subtokens_count % 2) ? subtokens[0] : subtokens[1];
             if (fd == -1) {

                 mprintf(" +-> DECODED SUBSIGNATURE:\n");

                 decodehex(subhex);

             } else {
                 mprintf(" +-> ");
                 matchsig(subhex, subhex, fd);
             }
         }
     } else if (strchr(sig, ':')) { /* ndb or cdb or ftm*/
         tokens_count = cli_strtokenize(sig, ':', 12 + 1, (const char **)tokens);
 
         if (tokens_count > 9 && tokens_count < 13) { /* cdb*/
             return decodecdb(tokens);
         }

         if (tokens_count > 5 && tokens_count < 9) { /* ftm */
             long ftmsigtype;

             char *end;

             ftmsigtype = strtol(tokens[0], &end, 10);

             if (end == tokens[0] + 1 && (ftmsigtype == 0 || ftmsigtype == 1 || ftmsigtype == 4))

                 return decodeftm(tokens, tokens_count);
         }
 

         if (tokens_count < 4 || tokens_count > 6) {
             mprintf("!decodesig: Invalid or not supported signature format\n");
             mprintf("TOKENS COUNT: %u\n", tokens_count);
             return -1;
         }
         mprintf("VIRUS NAME: %s\n", tokens[0]);
         if (tokens_count == 5)
             mprintf("FUNCTIONALITY LEVEL: >=%s\n", tokens[4]);
         else if (tokens_count == 6)
             mprintf("FUNCTIONALITY LEVEL: %s..%s\n", tokens[4], tokens[5]);
 
         if (!cli_isnumber(tokens[1])) {
             mprintf("!decodesig: Invalid target type\n");
             return -1;
         }
         mprintf("TARGET TYPE: ");
         switch (atoi(tokens[1])) {
             case 0:
                 mprintf("ANY FILE\n");
                 break;
             case 1:
                 mprintf("PE\n");
                 break;
             case 2:
                 mprintf("OLE2\n");
                 break;
             case 3:
                 mprintf("HTML\n");
                 break;
             case 4:
                 mprintf("MAIL\n");
                 break;
             case 5:
                 mprintf("GRAPHICS\n");
                 break;
             case 6:
                 mprintf("ELF\n");
                 break;
             case 7:
                 mprintf("NORMALIZED ASCII TEXT\n");
                 break;
             case 8:
                 mprintf("DISASM DATA\n");
                 break;
             case 9:
                 mprintf("MACHO\n");
                 break;
             case 10:
                 mprintf("PDF\n");
                 break;
             case 11:
                 mprintf("FLASH\n");
                 break;
             case 12:
                 mprintf("JAVA CLASS\n");
                 break;
             default:
                 mprintf("!decodesig: Invalid target type\n");
                 return -1;
         }
         mprintf("OFFSET: %s\n", tokens[2]);
         if (fd == -1) {
             mprintf("DECODED SIGNATURE:\n");
             decodehex(tokens[3]);
         } else {
             matchsig(tokens[3], strcmp(tokens[2], "*") ? tokens[2] : NULL, fd);
         }
     } else if ((pt = strchr(sig, '='))) {
         *pt++ = 0;
         mprintf("VIRUS NAME: %s\n", sig);
         if (fd == -1) {
             mprintf("DECODED SIGNATURE:\n");
             decodehex(pt);
         } else {
             matchsig(pt, NULL, fd);
         }

     } else {

         mprintf("decodesig: Not supported signature format\n");
         return -1;

     }

 
     return 0;
 }
 
 static int decodesigs(void)
 {

     char buffer[32769];

 
     fflush(stdin);

     while (fgets(buffer, sizeof(buffer), stdin)) {
         cli_chomp(buffer);
         if (!strlen(buffer))
             break;
         if (decodesig(buffer, -1) == -1)
             return -1;

     }
     return 0;

 }
 

 static int testsigs(const struct optstruct *opts)
 {

     char buffer[32769];
     FILE *sigs;
     int ret = 0, fd;

     if (!opts->filename) {
         mprintf("!--test-sigs requires two arguments\n");
         return -1;

     }
 
     sigs = fopen(optget(opts, "test-sigs")->strarg, "rb");

     if (!sigs) {
         mprintf("!testsigs: Can't open file %s\n", optget(opts, "test-sigs")->strarg);
         return -1;

     }
 

     fd = open(opts->filename[0], O_RDONLY | O_BINARY);
     if (fd == -1) {
         mprintf("!testsigs: Can't open file %s\n", optget(opts, "test-sigs")->strarg);
         fclose(sigs);
         return -1;

     }
 

     while (fgets(buffer, sizeof(buffer), sigs)) {
         cli_chomp(buffer);
         if (!strlen(buffer))
             break;
         if (decodesig(buffer, fd) == -1) {
             ret = -1;
             break;
         }

     }
 
     close(fd);
     fclose(sigs);
     return ret;
 }
 

 static int diffdirs(const char *old, const char *new, const char *patch)

 {

     FILE *diff;
     DIR *dd;
     struct dirent *dent;
     char cwd[512], path[1024];

     if (!getcwd(cwd, sizeof(cwd))) {
         mprintf("!diffdirs: getcwd() failed\n");
         return -1;

     }

     if (!(diff = fopen(patch, "wb"))) {

         mprintf("!diffdirs: Can't open %s for writing\n", patch);

         return -1;

     }
 

     if (chdir(new) == -1) {
         mprintf("!diffdirs: Can't chdir to %s\n", new);
         fclose(diff);
         return -1;

     }
 

     if ((dd = opendir(new)) == NULL) {

         mprintf("!diffdirs: Can't open directory %s\n", new);

         fclose(diff);
         return -1;
     }
 
     while ((dent = readdir(dd))) {
         if (dent->d_ino) {
             if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, ".."))
                 continue;
 
             snprintf(path, sizeof(path), "%s" PATHSEP "%s", old, dent->d_name);
             if (compare(path, dent->d_name, diff) == -1) {
                 if (chdir(cwd) == -1)
                     mprintf("^diffdirs: Can't chdir to %s\n", cwd);
                 fclose(diff);
                 unlink(patch);
                 closedir(dd);
                 return -1;
             }
         }

     }

     closedir(dd);
 
     /* check for removed files */

     if ((dd = opendir(old)) == NULL) {

         mprintf("!diffdirs: Can't open directory %s\n", old);

         fclose(diff);
         return -1;

     }

     while ((dent = readdir(dd))) {
         if (dent->d_ino) {
             if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, ".."))
                 continue;

             snprintf(path, sizeof(path), "%s" PATHSEP "%s", new, dent->d_name);
             if (access(path, R_OK))
                 fprintf(diff, "UNLINK %s\n", dent->d_name);
         }

     }

     closedir(dd);
 
     fclose(diff);

     mprintf("Generated diff file %s\n", patch);

     if (chdir(cwd) == -1)
         mprintf("^diffdirs: Can't chdir to %s\n", cwd);

 
     return 0;
 }
 

 static int makediff(const struct optstruct *opts)

 {

     char *odir, *ndir, name[32], broken[32], dbname[32];
     struct cl_cvd *cvd;
     unsigned int oldver, newver;
     int ret;

     if (!opts->filename) {
         mprintf("!makediff: --diff requires two arguments\n");
         return -1;

     }
 

     if (!(cvd = cl_cvdhead(opts->filename[0]))) {
         mprintf("!makediff: Can't read CVD header from %s\n", opts->filename[0]);
         return -1;

     }
     newver = cvd->version;
     free(cvd);
 

     if (!(cvd = cl_cvdhead(optget(opts, "diff")->strarg))) {
         mprintf("!makediff: Can't read CVD header from %s\n", optget(opts, "diff")->strarg);
         return -1;

     }
     oldver = cvd->version;
     free(cvd);
 

     if (oldver + 1 != newver) {
         mprintf("!makediff: The old CVD must be %u\n", newver - 1);
         return -1;

     }
 
     odir = cli_gentemp(NULL);

     if (!odir) {
         mprintf("!makediff: Can't generate temporary name for odir\n");
         return -1;

     }
 

     if (mkdir(odir, 0700) == -1) {
         mprintf("!makediff: Can't create directory %s\n", odir);
         free(odir);
         return -1;

     }
 

     if (cli_cvdunpack(optget(opts, "diff")->strarg, odir) == -1) {
         mprintf("!makediff: Can't unpack CVD file %s\n", optget(opts, "diff")->strarg);
         cli_rmdirs(odir);
         free(odir);
         return -1;

     }
 
     ndir = cli_gentemp(NULL);

     if (!ndir) {
         mprintf("!makediff: Can't generate temporary name for ndir\n");
         cli_rmdirs(odir);
         free(odir);
         return -1;

     }
 

     if (mkdir(ndir, 0700) == -1) {
         mprintf("!makediff: Can't create directory %s\n", ndir);
         free(ndir);
         cli_rmdirs(odir);
         free(odir);
         return -1;

     }
 

     if (cli_cvdunpack(opts->filename[0], ndir) == -1) {
         mprintf("!makediff: Can't unpack CVD file %s\n", opts->filename[0]);
         cli_rmdirs(odir);
         cli_rmdirs(ndir);
         free(odir);
         free(ndir);
         return -1;

     }
 

     snprintf(name, sizeof(name), "%s-%u.script", getdbname(opts->filename[0], dbname, sizeof(dbname)), newver);

     ret = diffdirs(odir, ndir, name);

     cli_rmdirs(odir);
     cli_rmdirs(ndir);

     free(odir);
     free(ndir);

     if (ret == -1)
         return -1;

     if (verifydiff(name, optget(opts, "diff")->strarg, NULL) == -1) {
         snprintf(broken, sizeof(broken), "%s.broken", name);
         if (rename(name, broken)) {
             unlink(name);
             mprintf("!Generated file is incorrect, removed");
         } else {
             mprintf("!Generated file is incorrect, renamed to %s\n", broken);
         }
         return -1;

     }
 

     return 0;
 }
 

 static int dumpcerts(const struct optstruct *opts)
 {

     char *filename = NULL;

     STATBUF sb;
     struct cl_engine *engine;
     cli_ctx ctx;

     struct cl_scan_options options;

     int fd;
     cl_error_t ret;
 

     logg_file = NULL;
 
     filename = optget(opts, "print-certs")->strarg;

     if (!filename) {
         mprintf("!dumpcerts: No filename!\n");

         return -1;
     }
 
     /* build engine */

     if (!(engine = cl_engine_new())) {
         mprintf("!dumpcerts: Can't create new engine\n");
         return -1;

     }
     cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1);
 

     if (cli_initroots(engine, 0) != CL_SUCCESS) {
         mprintf("!dumpcerts: cli_initroots() failed\n");
         cl_engine_free(engine);
         return -1;

     }
 

     if (cli_parse_add(engine->root[0], "test", "deadbeef", 0, 0, 0, "*", 0, NULL, 0) != CL_SUCCESS) {
         mprintf("!dumpcerts: Can't parse signature\n");
         cl_engine_free(engine);
         return -1;

     }
 

     if (cl_engine_compile(engine) != CL_SUCCESS) {
         mprintf("!dumpcerts: Can't compile engine\n");
         cl_engine_free(engine);
         return -1;

     }
 

     cl_engine_set_num(engine, CL_ENGINE_PE_DUMPCERTS, 1);

     cl_debug();
 
     /* prepare context */
     memset(&ctx, '\0', sizeof(cli_ctx));

     memset(&options, 0, sizeof(struct cl_scan_options));

     ctx.engine         = engine;
     ctx.options        = &options;

     ctx.options->parse = ~0;

     ctx.containers     = cli_calloc(sizeof(cli_ctx_container), engine->maxreclevel + 2);
     if (!ctx.containers) {
         cl_engine_free(engine);
         return -1;

     }
     ctx.containers[0].type = CL_TYPE_ANY;

     ctx.dconf              = (struct cli_dconf *)engine->dconf;
     ctx.fmap               = calloc(sizeof(fmap_t *), 1);
     if (!ctx.fmap) {

         free(ctx.containers);

         cl_engine_free(engine);
         return -1;

     }
 
     /* Prepare file */
     fd = open(filename, O_RDONLY);

     if (fd < 0) {
         mprintf("!dumpcerts: Can't open file %s!\n", filename);

         free(ctx.containers);

         free(ctx.fmap);

         cl_engine_free(engine);
         return -1;
     }
 
     lseek(fd, 0, SEEK_SET);
     FSTAT(fd, &sb);

     if (!(*ctx.fmap = fmap(fd, 0, sb.st_size))) {

         free(ctx.containers);

         free(ctx.fmap);
         close(fd);
         cl_engine_free(engine);
         return -1;

     }
 

     ret = cli_check_auth_header(&ctx, NULL);

 
     switch (ret) {

         case CL_VERIFIED:

         case CL_VIRUS:

             // These shouldn't happen, since sigtool doesn't load in any sigs

             break;

         case CL_EVERIFY:

             // The Authenticode header was parsed successfully but there were
             // no applicable whitelist/blacklist rules
             break;
         case CL_BREAK:
             mprintf("*dumpcerts: No Authenticode signature detected\n");

             break;

         case CL_EFORMAT:

             mprintf("!dumpcerts: An error occurred when parsing the file\n");

             break;
         default:

             mprintf("!dumpcerts: Other error %d inside cli_check_auth_header.\n", ret);

             break;
     }
 
     /* Cleanup */

     free(ctx.containers);

     funmap(*ctx.fmap);

     free(ctx.fmap);
     close(fd);
     cl_engine_free(engine);
     return 0;
 }
 

 static void help(void)

 {
     mprintf("\n");

     mprintf("                      Clam AntiVirus: Signature Tool %s\n", get_version());

     mprintf("           By The ClamAV Team: https://www.clamav.net/about.html#credits\n");

     mprintf("           (C) 2019 Cisco Systems, Inc.\n");

     mprintf("\n");
     mprintf("    sigtool [options]\n");
     mprintf("\n");
     mprintf("    --help                 -h              Show this help\n");
     mprintf("    --version              -V              Print version number and exit\n");
     mprintf("    --quiet                                Be quiet, output only error messages\n");
     mprintf("    --debug                                Enable debug messages\n");

     mprintf("    --stdout                               Write to stdout instead of stderr. Does not affect 'debug' messages.\n");

     mprintf("    --hex-dump                             Convert data from stdin to a hex\n");

     mprintf("                                           string and print it on stdout\n");

     mprintf("    --md5 [FILES]                          Generate MD5 checksum from stdin\n");

     mprintf("                                           or MD5 sigs for FILES\n");

     mprintf("    --sha1 [FILES]                         Generate SHA1 checksum from stdin\n");

     mprintf("                                           or SHA1 sigs for FILES\n");

     mprintf("    --sha256 [FILES]                       Generate SHA256 checksum from stdin\n");

     mprintf("                                           or SHA256 sigs for FILES\n");

     mprintf("    --mdb [FILES]                          Generate .mdb (section hash) sigs\n");
     mprintf("    --imp [FILES]                          Generate .imp (import table hash) sigs\n");
     mprintf("    --html-normalise=FILE                  Create normalised parts of HTML file\n");
     mprintf("    --ascii-normalise=FILE                 Create normalised text file from ascii source\n");
     mprintf("    --utf16-decode=FILE                    Decode UTF16 encoded files\n");
     mprintf("    --info=FILE            -i FILE         Print database information\n");
     mprintf("    --build=NAME [cvd] -b NAME             Build a CVD file\n");

     mprintf("    --max-bad-sigs=NUMBER                  Maximum number of mismatched signatures\n");

     mprintf("                                           When building a CVD. Default: 3000\n");

     mprintf("    --flevel=FLEVEL                        Specify a custom flevel.\n");
     mprintf("                                           Default: %u\n", cl_retflevel());
     mprintf("    --cvd-version=NUMBER                   Specify the version number to use for\n");
     mprintf("                                           the build. Default is to use the value+1\n");
     mprintf("                                           from the current CVD in --datadir.\n");
     mprintf("                                           If no datafile is found the default\n");
     mprintf("                                           behaviour is to prompt for a version\n");
     mprintf("                                           number, this switch will prevent the\n");
     mprintf("                                           prompt.  NOTE: If a CVD is found in the\n");
     mprintf("                                           --datadir its version+1 is used and\n");
     mprintf("                                           this value is ignored.\n");

     mprintf("    --no-cdiff                             Don't generate .cdiff file\n");

     mprintf("    --unsigned                             Create unsigned database file (.cud)\n");

     mprintf("    --hybrid                               Create a hybrid (standard and bytecode) database file\n");

     mprintf("    --print-certs=FILE                     Print Authenticode details from a PE\n");

     mprintf("    --server=ADDR                          ClamAV Signing Service address\n");

     mprintf("    --datadir=DIR                          Use DIR as default database directory\n");

     mprintf("    --unpack=FILE          -u FILE         Unpack a CVD/CLD file\n");
     mprintf("    --unpack-current=SHORTNAME             Unpack local CVD/CLD into cwd\n");

     mprintf("    --list-sigs[=FILE]     -l[FILE]        List signature names\n");

     mprintf("    --find-sigs=REGEX      -fREGEX         Find signatures matching REGEX\n");

     mprintf("    --decode-sigs                          Decode signatures from stdin\n");

     mprintf("    --test-sigs=DATABASE TARGET_FILE       Test signatures from DATABASE against \n");
     mprintf("                                           TARGET_FILE\n");

     mprintf("    --vba=FILE                             Extract VBA/Word6 macro code\n");
     mprintf("    --vba-hex=FILE                         Extract Word6 macro code with hex values\n");

     mprintf("    --diff=OLD NEW         -d OLD NEW      Create diff for OLD and NEW CVDs\n");

     mprintf("    --compare=OLD NEW      -c OLD NEW      Show diff between OLD and NEW files in\n");
     mprintf("                                           cdiff format\n");

     mprintf("    --run-cdiff=FILE       -r FILE         Execute update script FILE in cwd\n");

     mprintf("    --verify-cdiff=DIFF CVD/CLD            Verify DIFF against CVD/CLD\n");

     mprintf("\n");
 

     return;
 }
 
 int main(int argc, char **argv)
 {

     int ret;
     struct optstruct *opts;
     STATBUF sb;

     if (check_flevel())
         exit(1);

     if ((ret = cl_init(CL_INIT_DEFAULT)) != CL_SUCCESS) {
         mprintf("!Can't initialize libclamav: %s\n", cl_strerror(ret));
         return -1;

     }
     ret = 1;
 

     opts = optparse(NULL, argc, argv, 1, OPT_SIGTOOL, 0, NULL);

     if (!opts) {
         mprintf("!Can't parse command line options\n");
         return 1;
     }
 
     if (optget(opts, "quiet")->enabled)
         mprintf_quiet = 1;
 
     if (optget(opts, "stdout")->enabled)
         mprintf_stdout = 1;
 
     if (optget(opts, "debug")->enabled)
         cl_debug();
 
     if (optget(opts, "version")->enabled) {
         print_version(NULL);
         optfree(opts);
         return 0;
     }
 
     if (optget(opts, "help")->enabled) {
         optfree(opts);
         help();
         return 0;
     }
 
     if (optget(opts, "hex-dump")->enabled)
         ret = hexdump();
     else if (optget(opts, "md5")->enabled)
         ret = hashsig(opts, 0, 1);
     else if (optget(opts, "sha1")->enabled)
         ret = hashsig(opts, 0, 2);
     else if (optget(opts, "sha256")->enabled)
         ret = hashsig(opts, 0, 3);
     else if (optget(opts, "mdb")->enabled)
         ret = hashsig(opts, 1, 1);
     else if (optget(opts, "imp")->enabled)
         ret = hashsig(opts, 2, 1);
     else if (optget(opts, "html-normalise")->enabled)
         ret = htmlnorm(opts);
     else if (optget(opts, "ascii-normalise")->enabled)
         ret = asciinorm(opts);
     else if (optget(opts, "utf16-decode")->enabled)
         ret = utf16decode(opts);
     else if (optget(opts, "build")->enabled)
         ret = build(opts);
     else if (optget(opts, "unpack")->enabled)
         ret = unpack(opts);
     else if (optget(opts, "unpack-current")->enabled)
         ret = unpack(opts);
     else if (optget(opts, "info")->enabled)
         ret = cvdinfo(opts);
     else if (optget(opts, "list-sigs")->active)
         ret = listsigs(opts, 0);
     else if (optget(opts, "find-sigs")->active)
         ret = listsigs(opts, 1);
     else if (optget(opts, "decode-sigs")->active)
         ret = decodesigs();
     else if (optget(opts, "test-sigs")->enabled)
         ret = testsigs(opts);
     else if (optget(opts, "vba")->enabled || optget(opts, "vba-hex")->enabled)
         ret = vbadump(opts);
     else if (optget(opts, "diff")->enabled)
         ret = makediff(opts);
     else if (optget(opts, "compare")->enabled)
         ret = compareone(opts);
     else if (optget(opts, "print-certs")->enabled)
         ret = dumpcerts(opts);
     else if (optget(opts, "run-cdiff")->enabled)
         ret = rundiff(opts);
     else if (optget(opts, "verify-cdiff")->enabled) {
         if (!opts->filename) {
             mprintf("!--verify-cdiff requires two arguments\n");
             ret = -1;
         } else {
             if (CLAMSTAT(opts->filename[0], &sb) == -1) {
                 mprintf("--verify-cdiff: Can't get status of %s\n", opts->filename[0]);
                 ret = -1;
             } else {
                 if (S_ISDIR(sb.st_mode))
                     ret = verifydiff(optget(opts, "verify-cdiff")->strarg, NULL, opts->filename[0]);
                 else
                     ret = verifydiff(optget(opts, "verify-cdiff")->strarg, opts->filename[0], NULL);
             }
         }

     } else

         help();

     optfree(opts);

     return ret ? 1 : 0;

 }