@@ -1,3 +1,7 @@

+Fri May  7 09:56:57 EEST 2010 (edwin)

+-------------------------------------

+ * libclamav/bytecode*: add match_offsets support.

+

 Wed May  5 21:28:04 CEST 2010 (tk)

 ----------------------------------

  * shared/output.c: workaround FreeBSD's file locking issue (bb#1918)

@@ -386,6 +386,7 @@ int main(int argc, char *argv[])

 	}

 	/* for testing */

 	ctx->hooks.match_counts = deadbeefcounts;

+	ctx->hooks.match_offsets = deadbeefcounts;

 	rc = cli_bytecode_run(&bcs, bc, ctx);

 	if (rc != CL_SUCCESS) {

 	    fprintf(stderr,"Unable to run bytecode: %s\n", cl_strerror(rc));

@@ -49,6 +49,24 @@ static const uint32_t nomatch[64] = {

     0, 0, 0, 0, 0, 0, 0, 0,

     0, 0, 0, 0, 0, 0, 0, 0

 };

+static const uint32_t nooffsets[64] = {

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE,

+    CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE, CLI_OFF_NONE

+};

 static const uint16_t nokind;

 static const uint32_t nofilesize;

@@ -61,6 +79,8 @@ static void context_safe(struct cli_bc_ctx *ctx)

 	ctx->hooks.kind = &nokind;

     if (!ctx->hooks.match_counts)

 	ctx->hooks.match_counts = nomatch;

+    if (!ctx->hooks.match_offsets)

+	ctx->hooks.match_counts = nooffsets;

     if (!ctx->hooks.filesize)

 	ctx->hooks.filesize = &nofilesize;

     if (!ctx->hooks.pedata)

@@ -1940,6 +1960,7 @@ int cli_bytecode_runlsig(cli_ctx *cctx, const struct cli_all_bc *bcs, unsigned b

     memset(&ctx, 0, sizeof(ctx));

     cli_bytecode_context_setfuncid(&ctx, bc, 0);

     ctx.hooks.match_counts = lsigcnt;

+    ctx.hooks.match_offsets = lsigsuboff;

     cli_bytecode_context_setctx(&ctx, cctx);

     cli_bytecode_context_setfile(&ctx, map);

@@ -54,6 +54,12 @@ enum BytecodeKind {

 enum { PE_INVALID_RVA = 0xFFFFFFFF };

+/** LibClamAV functionality level constants */

+enum FunctionalityLevels {

+    FUNC_LEVEL_096 = 51,

+    FUNC_LEVEL_096_dev

+};

+

 #ifdef __CLAMBC__

 /** @brief Logical signature match counts

@@ -62,6 +68,13 @@ enum { PE_INVALID_RVA = 0xFFFFFFFF };

  *  access it.

  * */

 extern const uint32_t __clambc_match_counts[64];

+

+/** @brief Logical signature match offsets

+  * This is a low-level variable, use the Macros in bytecode_local.h instead to

+  * access it.

+  */

+extern const uint32_t __clambc_match_offsets[64];

+

 /** PE data, if this is a PE hook */

 extern const struct cli_pe_hook_data __clambc_pedata;

 /** File size (max 4G) */

@@ -81,6 +81,8 @@ int32_t cli_bcapi_jsnorm_done(struct cli_bc_ctx *ctx , int32_t);

 const struct cli_apiglobal cli_globals[] = {

 /* Bytecode globals BEGIN */

+	{"__clambc_match_offsets", GLOBAL_MATCH_OFFSETS, 76,

+	 ((char*)&((struct cli_bc_ctx*)0)->hooks.match_offsets - (char*)NULL)},

 	{"__clambc_kind", GLOBAL_KIND, 16,

 	 ((char*)&((struct cli_bc_ctx*)0)->hooks.kind - (char*)NULL)},

 	{"__clambc_match_counts", GLOBAL_MATCH_COUNTS, 76,

@@ -30,6 +30,7 @@

 #define BYTECODE_HOOKS_H

 struct cli_bc_hooks {

+	 const uint32_t* match_offsets;

 	 const uint16_t* kind;

 	 const uint32_t* match_counts;

 	 const uint32_t* filesize;

@@ -126,9 +126,11 @@ enum bc_global {

   GLOBAL_VIRUSNAMES,

   GLOBAL_PEDATA,

   GLOBAL_FILESIZE,

+  GLOBAL_MATCH_OFFSETS,

   _LAST_GLOBAL

 };

 #define BC_START_TID 69

+

 #endif

@@ -62,11 +62,11 @@ struct pe_image_optional_hdr32 {

     uint32_t FileAlignment;			    /**< usually 32 or 512 */

     uint16_t MajorOperatingSystemVersion;	    /**< not used */

     uint16_t MinorOperatingSystemVersion;	    /**< not used */

-    uint16_t MajorImageVersion;			    /** unreliable */

-    uint16_t MinorImageVersion;			    /** unreliable */

+    uint16_t MajorImageVersion;			    /**< unreliable */

+    uint16_t MinorImageVersion;			    /**< unreliable */

     uint16_t MajorSubsystemVersion;

     uint16_t MinorSubsystemVersion;

-    uint32_t Win32VersionValue;			    /* ? */

+    uint32_t Win32VersionValue;			    /*< ? */

     uint32_t SizeOfImage;

     uint32_t SizeOfHeaders;

     uint32_t CheckSum;				    /**< NT drivers only */

@@ -76,7 +76,7 @@ struct pe_image_optional_hdr32 {

     uint32_t SizeOfStackCommit;

     uint32_t SizeOfHeapReserve;

     uint32_t SizeOfHeapCommit;

-    uint32_t LoaderFlags;			    /* ? */

+    uint32_t LoaderFlags;			    /*< ? */

     uint32_t NumberOfRvaAndSizes;		    /**< unreliable */

     struct pe_image_data_dir DataDirectory[16];

 };

@@ -138,14 +138,14 @@ struct pe_image_section_hdr {

 /** Data for the bytecode PE hook */

 struct cli_pe_hook_data {

   uint32_t offset;

-  uint32_t ep;

-  uint16_t nsections;

+  uint32_t ep; /**< EntryPoint as file offset */

+  uint16_t nsections;/**< Number of sections */

   uint16_t dummy; /* align */

-  struct pe_image_file_hdr file_hdr;

-  struct pe_image_optional_hdr32 opt32;

+  struct pe_image_file_hdr file_hdr;/**< Header for this PE file */

+  struct pe_image_optional_hdr32 opt32; /**< 32-bit PE optional header */

   uint32_t dummy2; /* align */

-  struct pe_image_optional_hdr64 opt64;

-  struct pe_image_data_dir dirs[16];

+  struct pe_image_optional_hdr64 opt64;/**< 64-bit PE optional header */

+  struct pe_image_data_dir dirs[16]; /**< PE data directory header */

   uint32_t e_lfanew;/**< address of new exe header */

   uint32_t overlays;/**< number of overlays */

   int32_t overlays_sz;/**< size of overlays */