@@ -115,6 +115,11 @@ static void tracehook_val(struct cli_bc_ctx *ctx, const char *name, uint32_t val

     fprintf(stderr, "[trace] %s = %u\n", name, value);

 }

+static void tracehook_ptr(struct cli_bc_ctx *ctx, const void *ptr)

+{

+    fprintf(stderr, "[trace] %p\n", ptr);

+}

+

 int main(int argc, char *argv[])

 {

     FILE *f;

@@ -219,7 +224,8 @@ int main(int argc, char *argv[])

     cli_bytecode_context_set_trace(ctx, tracelevel,

 				   tracehook,

 				   tracehook_op,

-				   tracehook_val);

+				   tracehook_val,

+				   tracehook_ptr);

     if (opts->filename[1]) {

 	funcid = atoi(opts->filename[1]);

@@ -57,6 +57,7 @@ struct cli_bc_ctx *cli_bytecode_context_alloc(void)

     ctx->trace = NULL;

     ctx->trace_op = NULL;

     ctx->trace_val = NULL;

+    ctx->trace_ptr = NULL;

     ctx->scope = NULL;

     ctx->scopeid = 0;

     ctx->file = "??";

@@ -1048,7 +1049,7 @@ static int parseBB(struct cli_bc *bc, unsigned func, unsigned bb, unsigned char

 		    inst.u.ops.ops = cli_calloc(numOp, sizeof(*inst.u.ops.ops));

 		    if (!inst.u.ops.ops) {

 			cli_errmsg("Out of memory allocating operands\n");

-			return CL_EMALFDB;

+			return CL_EMEM;

 		    }

 		    if (inst.opcode == OP_BC_CALL_DIRECT)

 			inst.u.ops.funcid = readFuncID(bc, buffer, &offset, len, &ok);

@@ -1080,6 +1081,21 @@ static int parseBB(struct cli_bc *bc, unsigned func, unsigned bb, unsigned char

 			(1ull<<inst.u.cast.mask)-1 :

 			~0ull;

 		break;

+	    case OP_BC_GEPN:

+		numOp = readFixedNumber(buffer, &offset, len, &ok, 1);

+		if (ok) {

+		    inst.u.ops.numOps = numOp+1;

+		    inst.u.ops.opsizes = NULL;

+		    inst.u.ops.ops = cli_calloc(numOp, sizeof(*inst.u.ops.ops));

+		    if (!inst.u.ops.ops) {

+			cli_errmsg("Out of memory allocating operands\n");

+			return CL_EMEM;

+		    }

+		    inst.u.ops.ops[0] = readNumber(buffer, &offset, len, &ok);

+		    for (i=1;i<numOp+1;i++)

+			inst.u.ops.ops[i] = readOperand(bcfunc, buffer, &offset, len, &ok);

+		}

+		break;

 	    case OP_BC_ICMP_EQ:

 	    case OP_BC_ICMP_NE:

 	    case OP_BC_ICMP_UGT:

@@ -1532,14 +1548,13 @@ static int cli_bytecode_prepare_interpreter(struct cli_bc *bc)

 		    MAP(inst->u.unaryop);

 		    break;

 		case OP_BC_GEP1:

-		    MAP(inst->u.binop[0]);

-		    MAP(inst->u.binop[1]);

-		    break;

-		case OP_BC_GEP2:

-		    MAP(inst->u.three[0]);

+		    //three[0] is the type

 		    MAP(inst->u.three[1]);

 		    MAP(inst->u.three[2]);

 		    break;

+		case OP_BC_GEPN:

+		    /*TODO */

+		    break;

 		default:

 		    cli_dbgmsg("Unhandled opcode: %d\n", inst->opcode);

 		    return CL_EBYTECODE;

@@ -122,10 +122,12 @@ void cli_bytecode_debug_printsrc(const struct cli_bc_ctx *ctx);

 typedef void (*bc_dbg_callback_trace)(struct cli_bc_ctx*, unsigned event);

 typedef void (*bc_dbg_callback_trace_op)(struct cli_bc_ctx*, const char *op);

 typedef void (*bc_dbg_callback_trace_val)(struct cli_bc_ctx*, const char *name, uint32_t value);

+typedef void (*bc_dbg_callback_trace_ptr)(struct cli_bc_ctx*, const void *val);

 void cli_bytecode_context_set_trace(struct cli_bc_ctx*, unsigned level,

 				    bc_dbg_callback_trace,

 				    bc_dbg_callback_trace_op,

-				    bc_dbg_callback_trace_val);

+				    bc_dbg_callback_trace_val,

+				    bc_dbg_callback_trace_ptr);

 #ifdef __cplusplus

 }

@@ -142,11 +142,13 @@ int32_t cli_bcapi_write(struct cli_bc_ctx *ctx, uint8_t*data, int32_t len)

 void cli_bytecode_context_set_trace(struct cli_bc_ctx* ctx, unsigned level,

 				    bc_dbg_callback_trace trace,

 				    bc_dbg_callback_trace_op trace_op,

-				    bc_dbg_callback_trace_val trace_val)

+				    bc_dbg_callback_trace_val trace_val,

+				    bc_dbg_callback_trace_ptr trace_ptr)

 {

     ctx->trace = trace;

     ctx->trace_op = trace_op;

     ctx->trace_val = trace_val;

+    ctx->trace_ptr = trace_ptr;

     ctx->trace_level = level;

 }

@@ -223,3 +225,17 @@ uint32_t cli_bcapi_trace_value(struct cli_bc_ctx *ctx, const const uint8_t* name

 	ctx->trace_val(ctx, name, value);

     return 0;

 }

+

+uint32_t cli_bcapi_trace_ptr(struct cli_bc_ctx *ctx, const const uint8_t* ptr, uint32_t dummy)

+{

+    if (LIKELY(ctx->trace_level < trace_val))

+	return 0;

+    if (ctx->trace_level&0x80) {

+	if ((ctx->trace_level&0x7f) < trace_param)

+	    return 0;

+	ctx->trace(ctx, trace_param);

+    }

+    if (ctx->trace_ptr)

+	ctx->trace_ptr(ctx, ptr);

+    return 0;

+}

@@ -164,6 +164,7 @@ uint32_t trace_scope(const uint8_t* newscope, uint32_t scopeid);

 uint32_t trace_source(const uint8_t* srcfile, uint32_t line);

 uint32_t trace_op(const uint8_t* opname, uint32_t column);

 uint32_t trace_value(const uint8_t* name, uint32_t v);

+uint32_t trace_ptr(const uint8_t* ptr, uint32_t dummy);

 #endif

 #endif

@@ -47,6 +47,7 @@ uint32_t cli_bcapi_trace_scope(struct cli_bc_ctx *ctx, const const uint8_t*, uin

 uint32_t cli_bcapi_trace_source(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

 uint32_t cli_bcapi_trace_op(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

 uint32_t cli_bcapi_trace_value(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

+uint32_t cli_bcapi_trace_ptr(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

 const struct cli_apiglobal cli_globals[] = {

 /* Bytecode globals BEGIN */

@@ -131,7 +132,8 @@ const struct cli_apicall cli_apicalls[]={

 	{"trace_scope", 14, 7, 1},

 	{"trace_source", 14, 8, 1},

 	{"trace_op", 14, 9, 1},

-	{"trace_value", 14, 10, 1}

+	{"trace_value", 14, 10, 1},

+	{"trace_ptr", 14, 11, 1}

 /* Bytecode APIcalls END */

 };

 const cli_apicall_int2 cli_apicalls0[] = {

@@ -150,6 +152,7 @@ const cli_apicall_pointer cli_apicalls1[] = {

 	(cli_apicall_pointer)cli_bcapi_trace_scope,

 	(cli_apicall_pointer)cli_bcapi_trace_source,

 	(cli_apicall_pointer)cli_bcapi_trace_op,

-	(cli_apicall_pointer)cli_bcapi_trace_value

+	(cli_apicall_pointer)cli_bcapi_trace_value,

+	(cli_apicall_pointer)cli_bcapi_trace_ptr

 };

 const unsigned cli_apicall_maxapi = sizeof(cli_apicalls)/sizeof(cli_apicalls[0]);

@@ -44,5 +44,6 @@ uint32_t cli_bcapi_trace_scope(struct cli_bc_ctx *ctx, const const uint8_t*, uin

 uint32_t cli_bcapi_trace_source(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

 uint32_t cli_bcapi_trace_op(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

 uint32_t cli_bcapi_trace_value(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

+uint32_t cli_bcapi_trace_ptr(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);

 #endif

@@ -136,6 +136,7 @@ struct cli_bc_ctx {

     bc_dbg_callback_trace trace;

     bc_dbg_callback_trace_op trace_op;

     bc_dbg_callback_trace_val trace_val;

+    bc_dbg_callback_trace_ptr trace_ptr;

     unsigned trace_level;

     const char *directory;

     const char *file;

@@ -241,6 +241,10 @@ private:

 		return V;

 	    }

 	    V = Builder.CreateLoad(V);

+	    if (V->getType() != Ty &&

+		isa<PointerType>(V->getType()) &&

+		isa<PointerType>(Ty))

+		V = Builder.CreateBitCast(V, Ty);

 	    if (V->getType() != Ty) {

 		errs() << operand << " ";

 		V->dump();

@@ -425,8 +429,10 @@ public:

 	assert(dest >= numArgs && dest < numLocals+numArgs && "Instruction destination out of range");

 	const Type *ETy = cast<PointerType>(cast<PointerType>(Values[dest]->getType())->getElementType())->getElementType();

 	Value *V = createGEP(Base, ETy, Start, End);

-	if (!V)

+	if (!V) {

+	    errs() << "@ " << dest << "\n";

 	    return false;

+	}

 	V = Builder.CreateBitCast(V, PointerType::getUnqual(ETy));

 	Store(dest, V);

 	return true;

@@ -630,6 +636,7 @@ public:

 		    Ty = PointerType::getUnqual(PointerType::getUnqual(Ty));

 		    Value *Cast = Builder.CreateBitCast(GEP, Ty);

 		    Value *SpecialGV = Builder.CreateLoad(Cast);

+		    SpecialGV->setName("g"+Twine(g-_FIRST_GLOBAL)+"_");

 		    Value *C[] = {

 			ConstantInt::get(Type::getInt32Ty(Context), 0),

 			ConstantInt::get(Type::getInt32Ty(Context), bc->globals[i][0])

@@ -640,8 +647,10 @@ public:

 			Ty->dump();

 			llvm_report_error("(libclamav) unable to create fake global");

 		    }

-		    else if(GetElementPtrInst *GI = dyn_cast<GetElementPtrInst>(globals[i]))

+		    else if(GetElementPtrInst *GI = dyn_cast<GetElementPtrInst>(globals[i])) {

 			GI->setIsInBounds(true);

+			GI->setName("geped"+Twine(i)+"_");

+		    }

 		}

 	    }

@@ -674,7 +683,6 @@ public:

 			case OP_BC_SEXT:

 			case OP_BC_TRUNC:

 			case OP_BC_GEP1:

-			case OP_BC_GEP2:

 			case OP_BC_GEPN:

 			case OP_BC_STORE:

 			case OP_BC_COPY:

@@ -877,28 +885,20 @@ public:

 			}

 			case OP_BC_GEP1:

 			{

-			    Value *V = convertOperand(func, inst, inst->u.binop[0]);

-			    Value *Op = convertOperand(func, I32Ty, inst->u.binop[1]);

+			    const Type *SrcTy = mapType(inst->u.three[0]);

+			    Value *V = convertOperand(func, SrcTy, inst->u.three[1]);

+			    Value *Op = convertOperand(func, I32Ty, inst->u.three[2]);

 			    if (!createGEP(inst->dest, V, &Op, &Op+1))

 				return false;

 			    break;

 			}

-			case OP_BC_GEP2:

-			{

-			    std::vector<Value*> Idxs;

-			    Value *V = convertOperand(func, inst, inst->u.three[0]);

-			    Idxs.push_back(convertOperand(func, I32Ty, inst->u.three[1]));

-			    Idxs.push_back(convertOperand(func, I32Ty, inst->u.three[2]));

-			    if (!createGEP(inst->dest, V, Idxs.begin(), Idxs.end()))

-				return false;

-			    break;

-			}

 			case OP_BC_GEPN:

 			{

 			    std::vector<Value*> Idxs;

-			    assert(inst->u.ops.numOps > 1);

-			    Value *V = convertOperand(func, inst, inst->u.binop[0]);

-			    for (unsigned a=1;a<inst->u.ops.numOps;a++)

+			    assert(inst->u.ops.numOps > 2);

+			    const Type *SrcTy = mapType(inst->u.ops.ops[0]);

+			    Value *V = convertOperand(func, SrcTy, inst->u.ops.ops[1]);

+			    for (unsigned a=2;a<inst->u.ops.numOps;a++)

 				Idxs.push_back(convertOperand(func, I32Ty, inst->u.ops.ops[a]));

 			    if (!createGEP(inst->dest, V, Idxs.begin(), Idxs.end()))

 				return false;

@@ -14488,7 +14488,7 @@ $as_echo_n "checking for supported C++ compiler version... " >&6; }

     gxx_version=`${CXX} -dumpversion` ||

     as_fn_error "Unable to get GNU C++ compiler version" "$LINENO" 5

     case "${gxx_version}" in

-     [0123].*)

+     [023].*)

 	as_fn_error "C++ compiler too old (${gxx_version})" "$LINENO" 5

         ;;

      4.0.1*|4.1.[12]*)

@@ -28,7 +28,7 @@ struct bytecode_metadata {

   char *targetExclude;

 };

-#define BC_FUNC_LEVEL 2

+#define BC_FUNC_LEVEL 3

 #define BC_HEADER "ClamBC"

 enum bc_opcode {

@@ -70,7 +70,6 @@ enum bc_opcode {

   OP_BC_CALL_API,

   OP_BC_COPY,

   OP_BC_GEP1,

-  OP_BC_GEP2,

   OP_BC_GEPN,

   OP_BC_STORE,

   OP_BC_LOAD,

@@ -99,8 +98,8 @@ static const unsigned char operand_counts[] = {

   0, 0,

   /* OP_BC_COPY */

   2,

-  /* OP_BC_GEP1, OP_BC_GEP2, OP_BC_GEPN, OP_BC_STORE, OP_BC_LOAD*/

-  2, 3, 0, 2, 1,

+  /* OP_BC_GEP1, OP_BC_GEPN, OP_BC_STORE, OP_BC_LOAD*/

+  3, 0, 2, 1,

   /* OP_MEM* */

   3, 3, 3, 3,

   /* OP_BC_ISBIGENDIAN */

@@ -1984,8 +1984,7 @@ int cli_scanpe(cli_ctx *ctx, icon_groupset *iconset)

     /* yC 1.3 & variants */

-

-    if((DCONF & PE_CONF_YC) && nsections > 1 &&

+    if((0 & DCONF & PE_CONF_YC) && nsections > 1 &&

        (EC32(optional_hdr32.AddressOfEntryPoint) == exe_sections[nsections - 1].rva + 0x60)) {

 	uint32_t ecx = 0;

@@ -1,4 +1,4 @@

-ClamBCab`|``````|`agafp`clamcoincidencejb:82

+ClamBCac`|``````|`agafp`clamcoincidencejb:82

 Tedaaa`aacb`bb`bb`b

 Eabaaabbfd|afdgefcgdgac``

@@ -1,10 +1,10 @@

-ClamBCab`|``````|`akafp`clamcoincidencejb:82

+ClamBCac`|``````|`akafp`clamcoincidencejb:86

-Tedcaabjdebjdaaa`aacb`bbjdb`baacb`bb`bb`bebed

-Eababaabhd|afdgefcgdg`c``abbid|afdgefcgdgac``

+Tedcaabfdebedebfdaaa`aacb`bbfdb`baacb`bb`bb`b

+Eababaabid|afdgefcgdg`c``abbjd|afdgefcgdgac``

 G`aa`@`

-A`b`bLahbedabfd```b`b`aa`b`b`aa`b`b`Fajac

-Bbfdaadb`@d@d``fb`aab`bacabbabHonnkm``odHm``oonnkdaaadeab`bacHhgfedcbadTaaadaaab

+A`b`bLahbedabgd```b`b`aa`b`b`aa`b`b`Fajac

+Bbgdaadbcbfd`@d@d``eb`aab`bacabbabHonnkm``odHm``oonnkdaaadeab`bacHhgfedcbadTaaadaaab

 Bb`baeabbaa`Honnkmjnmdaaafeab`baeHhgfedcbadb`bagoaafDm``odDmjnmdTcab`bag

 BTcab`bDmjnmdE

 Aab`bLabah`aa`b`b`Facaa

@@ -1,4 +1,4 @@

-ClamBCab`|``````|`afbbep`clamcoincidencejb:418

+ClamBCac`|``````|`afbbep`clamcoincidencejb:418

 Tedaaa`

 E``

@@ -1,4 +1,4 @@

-ClamBCab`|``````|`afabp`clamcoincidencejb:23

+ClamBCac`|``````|`afabp`clamcoincidencejb:23

 Tedaaa`

 E``

@@ -1,11 +1,11 @@

-ClamBCab`|``c``a```|`bjaabp`clamcoincidencejb:326

+ClamBCac`|``c``a```|`bjaabp`clamcoincidencejb:326

 Trojan.Foo.{A,B};Target:1;(((0|1|2)=42,2)|(3=10));EP+0:aabb;ffff;aaccee;f00d;dead

 Tedebieebheebgeebfeebeeebdeebbeebaeebadebcdaaa`aacb`bbadb`bdb`db`bcajbadbcebadbcebadbcebadbcebadbcecaab`bdagahdaeahdajahdabbaddabahdakah

 Eafaaafb`e|amcgefdgfgifbgegcgnfafmfef``

 Gd```hbia`@`bieBdeBbgBofBjfBafBnfBnbBfdBofBof@`bheBad@`bheBbd@`bge@Ab@Ac`b`aAa`b`aC``a`bfeBedB`eBkbB`cBjcBafBafBbfBbf@`beeBffBffBffBff@`beeBffB`cB`cBdf@`bdeBafBafBcfBcfBefBef@`beeBdfBefBafBdf@`bbe@Ag@@AhAa@AiAc@AjAb@AkAd`bad@Ab`bad@Ac`bad@Ag`bad@Ah`bad@Ai`bad@Aj`bad@Ak`bcdAdD```h`bcdAcD```h`bcdAbD```h`bcdAaD```h`bcd@D```h`

 A`b`bLaeb`b`aa`aa`bad`b`b`Fahac

-Bb`b`gbBda`aaaagab`b`AadTaaaaaaab

+Bb`b`fbBda`aaaagab`b`AadTaaaaaaab

 Baaabeab`b`AbdbadacoaabAm`An`b`badabbafac@dTcab`b@d

 BTcab`b@dE

 A`aaLbcab`b`b`b`b`b`b`b`b`b`aa`aa`aa`aa`b`b`b`b`b`b`b`b`b`b`aa`aa`b`b`aa`aa`Fbdaaa

-Bb`b`gbBha`b`baagbBga`b`babgbBfa`b`baca`aa`b`bada`acabaaaeeab`badBjbdaaaffab`bab@daaagfab`baa@daaahfab`b`@db`bai`aafb`baj`aagb`bak`aahb`bala`ajakb`bama`alaiaaaneab`bamAbdaaaok`anaeb`bb`agbBea`aabaaeab`bb`aAjdaabbal`aobaaTcaaabbaE

+Bb`b`fbBha`b`baafbBga`b`babfbBfa`b`baca`aa`b`bada`acabaaaeeab`badBjbdaaaffab`bab@daaagfab`baa@daaahfab`b`@db`bai`aafb`baj`aagb`bak`aahb`bala`ajakb`bama`alaiaaaneab`bamAbdaaaok`anaeb`bb`afbBea`aabaaeab`bb`aAjdaabbal`aobaaTcaaabbaE

@@ -1,4 +1,4 @@

-ClamBCab`|``````|`afaap`clamcoincidencejb:20

+ClamBCac`|``````|`afaap`clamcoincidencejb:20

 Tedaaa`

 E``