/* * Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved. * Copyright (C) 2007-2013 Sourcefire, Inc. * Copyright (C) 2002-2007 Tomasz Kojm * * CDIFF code (C) 2006 Sensory Networks, Inc. * * Author: Tomasz Kojm * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, * MA 02110-1301, USA. */ #if HAVE_CONFIG_H #include "clamav-config.h" #endif #include #include #include #ifdef HAVE_UNISTD_H #include #endif #include #include #include #include #include #include #ifndef _WIN32 #include #include #include #include #include #else #include "w32_stat.h" #endif #include #include #include #ifdef HAVE_TERMIOS_H #include #endif #include "vba.h" #include "shared/output.h" #include "shared/optparser.h" #include "shared/misc.h" #include "shared/cdiff.h" #include "shared/tar.h" #include "libclamav/clamav.h" #include "libclamav/matcher.h" #include "libclamav/cvd.h" #include "libclamav/str.h" #include "libclamav/ole2_extract.h" #include "libclamav/htmlnorm.h" #include "libclamav/textnorm.h" #include "libclamav/default.h" #include "libclamav/fmap.h" #include "libclamav/readdb.h" #include "libclamav/others.h" #include "libclamav/pe.h" #define MAX_DEL_LOOKAHEAD 5000 //struct s_info info; short recursion = 0, bell = 0; short printinfected = 0, printclean = 1; static const struct dblist_s { const char *ext; unsigned int count; } dblist[] = { /* special files */ {"info", 0}, {"cfg", 0}, {"ign", 0}, {"ign2", 0}, {"ftm", 0}, /* databases */ {"db", 1}, {"hdb", 1}, {"hdu", 1}, {"hsb", 1}, {"hsu", 1}, {"mdb", 1}, {"mdu", 1}, {"msb", 1}, {"msu", 1}, {"ndb", 1}, {"ndu", 1}, {"ldb", 1}, {"ldu", 1}, {"sdb", 1}, {"zmd", 1}, {"rmd", 1}, {"idb", 0}, {"fp", 1}, // TODO Should count be 0 here? We don't count others like this {"sfp", 0}, {"gdb", 1}, {"pdb", 1}, {"wdb", 0}, {"crb", 1}, {"cdb", 1}, {"imp", 1}, // TODO Should we add .ioc, .yar, .yara, and .pwdb so that sigtool will // include these sigs in a build (just in case we need this functionality // in the future?) {NULL, 0}}; static char *getdbname(const char *str, char *dst, int dstlen) { int len = strlen(str); if (cli_strbcasestr(str, ".cvd") || cli_strbcasestr(str, ".cld") || cli_strbcasestr(str, ".cud")) len -= 4; if (dst) { strncpy(dst, str, MIN(dstlen - 1, len)); dst[MIN(dstlen - 1, len)] = 0; } else { dst = (char *)malloc(len + 1); if (!dst) return NULL; strncpy(dst, str, len - 4); dst[MIN(dstlen - 1, len - 4)] = 0; } return dst; } static int hexdump(void) { char buffer[FILEBUFF], *pt; int bytes; while ((bytes = read(0, buffer, FILEBUFF)) > 0) { pt = cli_str2hex(buffer, bytes); if (write(1, pt, 2 * bytes) == -1) { mprintf("!hexdump: Can't write to stdout\n"); free(pt); return -1; } free(pt); } if (bytes == -1) return -1; return 0; } static int hashpe(const char *filename, unsigned int class, int type) { STATBUF sb; const char *fmptr; struct cl_engine *engine; cli_ctx ctx; struct cl_scan_options options; int fd, ret; /* build engine */ if (!(engine = cl_engine_new())) { mprintf("!hashpe: Can't create new engine\n"); return -1; } cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1); if (cli_initroots(engine, 0) != CL_SUCCESS) { mprintf("!hashpe: cli_initroots() failed\n"); cl_engine_free(engine); return -1; } if (cli_parse_add(engine->root[0], "test", "deadbeef", 0, 0, 0, "*", 0, NULL, 0) != CL_SUCCESS) { mprintf("!hashpe: Can't parse signature\n"); cl_engine_free(engine); return -1; } if (cl_engine_compile(engine) != CL_SUCCESS) { mprintf("!hashpe: Can't compile engine\n"); cl_engine_free(engine); return -1; } /* prepare context */ memset(&ctx, '\0', sizeof(cli_ctx)); memset(&options, 0, sizeof(struct cl_scan_options)); ctx.engine = engine; ctx.options = &options; ctx.options->parse = ~0; ctx.containers = cli_calloc(sizeof(cli_ctx_container), engine->maxreclevel + 2); if (!ctx.containers) { cl_engine_free(engine); return -1; } ctx.containers[0].type = CL_TYPE_ANY; ctx.dconf = (struct cli_dconf *)engine->dconf; ctx.fmap = calloc(sizeof(fmap_t *), 1); if (!ctx.fmap) { free(ctx.containers); cl_engine_free(engine); return -1; } /* Prepare file */ fd = open(filename, O_RDONLY); if (fd < 0) { mprintf("!hashpe: Can't open file %s!\n", filename); free(ctx.containers); free(ctx.fmap); cl_engine_free(engine); return -1; } lseek(fd, 0, SEEK_SET); FSTAT(fd, &sb); if (!(*ctx.fmap = fmap(fd, 0, sb.st_size))) { free(ctx.containers); free(ctx.fmap); close(fd); cl_engine_free(engine); return -1; } fmptr = fmap_need_off_once(*ctx.fmap, 0, sb.st_size); if (!fmptr) { mprintf("!hashpe: fmap_need_off_once failed!\n"); free(ctx.containers); funmap(*ctx.fmap); free(ctx.fmap); close(fd); cl_engine_free(engine); return -1; } cl_debug(); /* Send to PE-specific hasher */ switch (class) { case 1: ret = cli_genhash_pe(&ctx, CL_GENHASH_PE_CLASS_SECTION, type, NULL); break; case 2: ret = cli_genhash_pe(&ctx, CL_GENHASH_PE_CLASS_IMPTBL, type, NULL); break; default: mprintf("!hashpe: unknown classification(%u) for pe hash!\n", class); free(ctx.containers); funmap(*ctx.fmap); free(ctx.fmap); close(fd); cl_engine_free(engine); return -1; } /* THIS MAY BE UNNECESSARY */ switch (ret) { case CL_CLEAN: break; case CL_VIRUS: mprintf("*hashpe: CL_VIRUS after cli_genhash_pe()!\n"); break; case CL_BREAK: mprintf("*hashpe: CL_BREAK after cli_genhash_pe()!\n"); break; case CL_EFORMAT: mprintf("!hashpe: Not a valid PE file!\n"); break; default: mprintf("!hashpe: Other error %d inside cli_genhash_pe.\n", ret); break; } /* Cleanup */ free(ctx.containers); funmap(*ctx.fmap); free(ctx.fmap); close(fd); cl_engine_free(engine); return 0; } static int hashsig(const struct optstruct *opts, unsigned int class, int type) { char *hash; unsigned int i; STATBUF sb; if (opts->filename) { for (i = 0; opts->filename[i]; i++) { if (CLAMSTAT(opts->filename[i], &sb) == -1) { perror("hashsig"); mprintf("!hashsig: Can't access file %s\n", opts->filename[i]); return -1; } else { if ((sb.st_mode & S_IFMT) == S_IFREG) { if ((class == 0) && (hash = cli_hashfile(opts->filename[i], type))) { mprintf("%s:%u:%s\n", hash, (unsigned int)sb.st_size, basename(opts->filename[i])); free(hash); } else if ((class > 0) && (hashpe(opts->filename[i], class, type) == 0)) { /* intentionally empty - printed in cli_genhash_pe() */ } else { mprintf("!hashsig: Can't generate hash for %s\n", opts->filename[i]); return -1; } } } } } else { /* stream */ if (class > 0) { mprintf("!hashsig: Can't generate requested hash for input stream\n"); return -1; } hash = cli_hashstream(stdin, NULL, type); if (!hash) { mprintf("!hashsig: Can't generate hash for input stream\n"); return -1; } mprintf("%s\n", hash); free(hash); } return 0; } static int htmlnorm(const struct optstruct *opts) { int fd; fmap_t *map; if ((fd = open(optget(opts, "html-normalise")->strarg, O_RDONLY)) == -1) { mprintf("!htmlnorm: Can't open file %s\n", optget(opts, "html-normalise")->strarg); return -1; } if ((map = fmap(fd, 0, 0))) { html_normalise_map(map, ".", NULL, NULL); funmap(map); } else mprintf("!fmap failed\n"); close(fd); return 0; } static int asciinorm(const struct optstruct *opts) { const char *fname; unsigned char *norm_buff; struct text_norm_state state; size_t map_off; fmap_t *map; int fd, ofd; fname = optget(opts, "ascii-normalise")->strarg; fd = open(fname, O_RDONLY); if (fd == -1) { mprintf("!asciinorm: Can't open file %s\n", fname); return -1; } if (!(norm_buff = malloc(ASCII_FILE_BUFF_LENGTH))) { mprintf("!asciinorm: Can't allocate memory\n"); close(fd); return -1; } if (!(map = fmap(fd, 0, 0))) { mprintf("!fmap: Could not map fd %d\n", fd); close(fd); free(norm_buff); return -1; } if (map->len > MAX_ASCII_FILE_SIZE) { mprintf("!asciinorm: File size of %zu too large\n", map->len); close(fd); free(norm_buff); funmap(map); return -1; } ofd = open("./normalised_text", O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR); if (ofd == -1) { mprintf("!asciinorm: Can't open file ./normalised_text\n"); close(fd); free(norm_buff); funmap(map); return -1; } text_normalize_init(&state, norm_buff, ASCII_FILE_BUFF_LENGTH); map_off = 0; while (map_off != map->len) { size_t written; if (!(written = text_normalize_map(&state, map, map_off))) break; map_off += written; if (write(ofd, norm_buff, state.out_pos) == -1) { mprintf("!asciinorm: Can't write to file ./normalised_text\n"); close(fd); close(ofd); free(norm_buff); funmap(map); return -1; } text_normalize_reset(&state); } close(fd); close(ofd); free(norm_buff); funmap(map); return 0; } static int utf16decode(const struct optstruct *opts) { const char *fname; char *newname, buff[512], *decoded; int fd1, fd2, bytes; fname = optget(opts, "utf16-decode")->strarg; if ((fd1 = open(fname, O_RDONLY)) == -1) { mprintf("!utf16decode: Can't open file %s\n", fname); return -1; } newname = malloc(strlen(fname) + 7); if (!newname) { mprintf("!utf16decode: Can't allocate memory\n"); close(fd1); return -1; } sprintf(newname, "%s.ascii", fname); if ((fd2 = open(newname, O_WRONLY | O_CREAT | O_TRUNC, S_IRWXU)) < 0) { mprintf("!utf16decode: Can't create file %s\n", newname); free(newname); close(fd1); return -1; } while ((bytes = read(fd1, buff, sizeof(buff))) > 0) { decoded = cli_utf16toascii(buff, bytes); if (decoded) { if (write(fd2, decoded, strlen(decoded)) == -1) { mprintf("!utf16decode: Can't write to file %s\n", newname); free(decoded); close(fd1); close(fd2); unlink(newname); free(newname); return -1; } free(decoded); } } free(newname); close(fd1); close(fd2); return 0; } static char *getdsig(const char *host, const char *user, const unsigned char *data, unsigned int datalen, unsigned short mode) { char buff[512], cmd[128], pass[30], *pt; struct sockaddr_in server; int sockd, bread, len; #ifdef HAVE_TERMIOS_H struct termios old, new; #endif memset(&server, 0x00, sizeof(struct sockaddr_in)); if ((pt = getenv("SIGNDPASS"))) { strncpy(pass, pt, sizeof(pass)); pass[sizeof(pass) - 1] = '\0'; } else { mprintf("Password: "); #ifdef HAVE_TERMIOS_H if (tcgetattr(0, &old)) { mprintf("!getdsig: tcgetattr() failed\n"); return NULL; } new = old; new.c_lflag &= ~ECHO; if (tcsetattr(0, TCSAFLUSH, &new)) { mprintf("!getdsig: tcsetattr() failed\n"); return NULL; } #endif if (scanf("%30s", pass) == EOF) { mprintf("!getdsig: Can't get password\n"); #ifdef HAVE_TERMIOS_H tcsetattr(0, TCSAFLUSH, &old); #endif return NULL; } #ifdef HAVE_TERMIOS_H if (tcsetattr(0, TCSAFLUSH, &old)) { mprintf("!getdsig: tcsetattr() failed\n"); memset(pass, 0, sizeof(pass)); return NULL; } #endif mprintf("\n"); } if ((sockd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { perror("socket()"); mprintf("!getdsig: Can't create socket\n"); memset(pass, 0, sizeof(pass)); return NULL; } server.sin_family = AF_INET; server.sin_addr.s_addr = inet_addr(host); server.sin_port = htons(33101); if (connect(sockd, (struct sockaddr *)&server, sizeof(struct sockaddr_in)) < 0) { perror("connect()"); closesocket(sockd); mprintf("!getdsig: Can't connect to ClamAV Signing Service at %s\n", host); memset(pass, 0, sizeof(pass)); return NULL; } memset(cmd, 0, sizeof(cmd)); if (mode == 1) snprintf(cmd, sizeof(cmd) - datalen, "ClamSign:%s:%s:", user, pass); else if (mode == 2) snprintf(cmd, sizeof(cmd) - datalen, "ClamSignPSS:%s:%s:", user, pass); else snprintf(cmd, sizeof(cmd) - datalen, "ClamSignPSS2:%s:%s:", user, pass); len = strlen(cmd); pt = cmd + len; memcpy(pt, data, datalen); len += datalen; if (send(sockd, cmd, len, 0) < 0) { mprintf("!getdsig: Can't write to socket\n"); closesocket(sockd); memset(cmd, 0, sizeof(cmd)); memset(pass, 0, sizeof(pass)); return NULL; } memset(cmd, 0, sizeof(cmd)); memset(pass, 0, sizeof(pass)); memset(buff, 0, sizeof(buff)); if ((bread = recv(sockd, buff, sizeof(buff) - 1, 0)) > 0) { buff[bread] = '\0'; if (!strstr(buff, "Signature:")) { mprintf("!getdsig: Error generating digital signature\n"); mprintf("!getdsig: Answer from remote server: %s\n", buff); closesocket(sockd); return NULL; } else { mprintf("Signature received (length = %lu)\n", (unsigned long)strlen(buff) - 10); } } else { mprintf("!getdsig: Communication error with remote server\n"); closesocket(sockd); return NULL; } closesocket(sockd); pt = buff; pt += 10; return strdup(pt); } static char *sha256file(const char *file, unsigned int *size) { FILE *fh; unsigned int i, bytes; unsigned char digest[32], buffer[FILEBUFF]; char *sha; void *ctx; ctx = cl_hash_init("sha256"); if (!(ctx)) return NULL; if (!(fh = fopen(file, "rb"))) { mprintf("!sha256file: Can't open file %s\n", file); cl_hash_destroy(ctx); return NULL; } if (size) *size = 0; while ((bytes = fread(buffer, 1, sizeof(buffer), fh))) { cl_update_hash(ctx, buffer, bytes); if (size) *size += bytes; } cl_finish_hash(ctx, digest); sha = (char *)malloc(65); if (!sha) { fclose(fh); return NULL; } for (i = 0; i < 32; i++) sprintf(sha + i * 2, "%02x", digest[i]); fclose(fh); return sha; } static int writeinfo(const char *dbname, const char *builder, const char *header, const struct optstruct *opts, char *const *dblist2, unsigned int dblist2cnt) { FILE *fh; unsigned int i, bytes; char file[32], *pt, dbfile[32]; unsigned char digest[32], buffer[FILEBUFF]; void *ctx; snprintf(file, sizeof(file), "%s.info", dbname); if (!access(file, R_OK)) { if (unlink(file) == -1) { mprintf("!writeinfo: Can't unlink %s\n", file); return -1; } } if (!(fh = fopen(file, "wb+"))) { mprintf("!writeinfo: Can't create file %s\n", file); return -1; } if (fprintf(fh, "%s\n", header) < 0) { mprintf("!writeinfo: Can't write to %s\n", file); fclose(fh); return -1; } if (dblist2cnt) { for (i = 0; i < dblist2cnt; i++) { if (!(pt = sha256file(dblist2[i], &bytes))) { mprintf("!writeinfo: Can't generate SHA256 for %s\n", file); fclose(fh); return -1; } if (fprintf(fh, "%s:%u:%s\n", dblist2[i], bytes, pt) < 0) { mprintf("!writeinfo: Can't write to info file\n"); fclose(fh); free(pt); return -1; } free(pt); } } if (!dblist2cnt || optget(opts, "hybrid")->enabled) { for (i = 0; dblist[i].ext; i++) { snprintf(dbfile, sizeof(dbfile), "%s.%s", dbname, dblist[i].ext); if (strcmp(dblist[i].ext, "info") && !access(dbfile, R_OK)) { if (!(pt = sha256file(dbfile, &bytes))) { mprintf("!writeinfo: Can't generate SHA256 for %s\n", file); fclose(fh); return -1; } if (fprintf(fh, "%s:%u:%s\n", dbfile, bytes, pt) < 0) { mprintf("!writeinfo: Can't write to info file\n"); fclose(fh); free(pt); return -1; } free(pt); } } } if (!optget(opts, "unsigned")->enabled) { rewind(fh); ctx = cl_hash_init("sha256"); if (!(ctx)) { fclose(fh); return -1; } while ((bytes = fread(buffer, 1, sizeof(buffer), fh))) cl_update_hash(ctx, buffer, bytes); cl_finish_hash(ctx, digest); if (!(pt = getdsig(optget(opts, "server")->strarg, builder, digest, 32, 3))) { mprintf("!writeinfo: Can't get digital signature from remote server\n"); fclose(fh); return -1; } fprintf(fh, "DSIG:%s\n", pt); free(pt); } fclose(fh); return 0; } static int diffdirs(const char *old, const char *new, const char *patch); static int verifydiff(const char *diff, const char *cvd, const char *incdir); static int script2cdiff(const char *script, const char *builder, const struct optstruct *opts) { char *cdiff, *pt, buffer[FILEBUFF]; unsigned char digest[32]; void *ctx; STATBUF sb; FILE *scripth, *cdiffh; gzFile gzh; unsigned int ver, osize; int bytes; if (CLAMSTAT(script, &sb) == -1) { mprintf("!script2diff: Can't stat file %s\n", script); return -1; } osize = (unsigned int)sb.st_size; cdiff = strdup(script); if (NULL == cdiff) { mprintf("!script2cdiff: Unable to allocate memory for file name\n"); return -1; } pt = strstr(cdiff, ".script"); if (!pt) { mprintf("!script2cdiff: Incorrect file name (no .script extension)\n"); free(cdiff); return -1; } strcpy(pt, ".cdiff"); if (!(pt = strchr(script, '-'))) { mprintf("!script2cdiff: Incorrect file name syntax\n"); free(cdiff); return -1; } if (sscanf(++pt, "%u.script", &ver) == EOF) { mprintf("!script2cdiff: Incorrect file name syntax\n"); free(cdiff); return -1; } if (!(cdiffh = fopen(cdiff, "wb"))) { mprintf("!script2cdiff: Can't open %s for writing\n", cdiff); free(cdiff); return -1; } if (fprintf(cdiffh, "ClamAV-Diff:%u:%u:", ver, osize) < 0) { mprintf("!script2cdiff: Can't write to %s\n", cdiff); fclose(cdiffh); free(cdiff); return -1; } fclose(cdiffh); if (!(scripth = fopen(script, "rb"))) { mprintf("!script2cdiff: Can't open file %s for reading\n", script); unlink(cdiff); free(cdiff); return -1; } if (!(gzh = gzopen(cdiff, "ab9f"))) { mprintf("!script2cdiff: Can't open file %s for appending\n", cdiff); unlink(cdiff); free(cdiff); fclose(scripth); return -1; } while ((bytes = fread(buffer, 1, sizeof(buffer), scripth)) > 0) { if (!gzwrite(gzh, buffer, bytes)) { mprintf("!script2cdiff: Can't gzwrite to %s\n", cdiff); unlink(cdiff); free(cdiff); fclose(scripth); gzclose(gzh); return -1; } } fclose(scripth); gzclose(gzh); if (!(cdiffh = fopen(cdiff, "rb"))) { mprintf("!script2cdiff: Can't open %s for reading/writing\n", cdiff); unlink(cdiff); free(cdiff); return -1; } ctx = cl_hash_init("sha256"); if (!(ctx)) { unlink(cdiff); free(cdiff); fclose(cdiffh); return -1; } while ((bytes = fread(buffer, 1, sizeof(buffer), cdiffh))) cl_update_hash(ctx, (unsigned char *)buffer, bytes); fclose(cdiffh); cl_finish_hash(ctx, digest); if (!(pt = getdsig(optget(opts, "server")->strarg, builder, digest, 32, 2))) { mprintf("!script2cdiff: Can't get digital signature from remote server\n"); unlink(cdiff); free(cdiff); return -1; } if (!(cdiffh = fopen(cdiff, "ab"))) { mprintf("!script2cdiff: Can't open %s for appending\n", cdiff); unlink(cdiff); free(cdiff); return -1; } fprintf(cdiffh, ":%s", pt); free(pt); fclose(cdiffh); mprintf("Created %s\n", cdiff); free(cdiff); return 0; } static int qcompare(const void *a, const void *b) { return strcmp(*(char *const *)a, *(char *const *)b); } static int build(const struct optstruct *opts) { int ret, bc = 0, hy = 0; size_t bytes; unsigned int i, sigs = 0, oldsigs = 0, entries = 0, version, real_header, fl, maxentries; STATBUF foo; unsigned char buffer[FILEBUFF]; char *tarfile, header[513], smbuff[32], builder[32], *pt, olddb[512]; char patch[32], broken[32], dbname[32], dbfile[32]; const char *newcvd, *localdbdir = NULL; struct cl_engine *engine; FILE *cvd, *fh; gzFile tar; time_t timet; struct tm *brokent; struct cl_cvd *oldcvd; char **dblist2 = NULL; unsigned int dblist2cnt = 0; DIR *dd; struct dirent *dent; #define FREE_LS(x) \ for (i = 0; i < dblist2cnt; i++) \ free(x[i]); \ free(x); if (!optget(opts, "server")->enabled && !optget(opts, "unsigned")->enabled) { mprintf("!build: --server is required for --build\n"); return -1; } if (optget(opts, "datadir")->active) localdbdir = optget(opts, "datadir")->strarg; if (CLAMSTAT("COPYING", &foo) == -1) { mprintf("!build: COPYING file not found in current working directory.\n"); return -1; } getdbname(optget(opts, "build")->strarg, dbname, sizeof(dbname)); if (!strcmp(dbname, "bytecode")) bc = 1; if (optget(opts, "hybrid")->enabled) hy = 1; if (!(engine = cl_engine_new())) { mprintf("!build: Can't initialize antivirus engine\n"); return 50; } if ((ret = cl_load(".", engine, &sigs, CL_DB_STDOPT | CL_DB_PUA | CL_DB_SIGNED))) { mprintf("!build: Can't load database: %s\n", cl_strerror(ret)); cl_engine_free(engine); return -1; } cl_engine_free(engine); if (!sigs) { mprintf("!build: There are no signatures in database files\n"); } else { if (bc || hy) { if ((dd = opendir(".")) == NULL) { mprintf("!build: Can't open current directory\n"); return -1; } while ((dent = readdir(dd))) { if (dent->d_ino) { if (cli_strbcasestr(dent->d_name, ".cbc")) { dblist2 = (char **)realloc(dblist2, (dblist2cnt + 1) * sizeof(char *)); if (!dblist2) { /* dblist2 leaked but we don't really care */ mprintf("!build: Memory allocation error\n"); closedir(dd); return -1; } dblist2[dblist2cnt] = strdup(dent->d_name); if (!dblist2[dblist2cnt]) { FREE_LS(dblist2); mprintf("!build: Memory allocation error\n"); return -1; } dblist2cnt++; } } } closedir(dd); entries += dblist2cnt; if (dblist2 != NULL) { qsort(dblist2, dblist2cnt, sizeof(char *), qcompare); } if (!access("last.hdb", R_OK)) { if (!dblist2cnt) { mprintf("!build: dblist2 == NULL (no .cbc files?)\n"); return -1; } dblist2 = (char **)realloc(dblist2, (dblist2cnt + 1) * sizeof(char *)); if (!dblist2) { mprintf("!build: Memory allocation error\n"); return -1; } dblist2[dblist2cnt] = strdup("last.hdb"); if (!dblist2[dblist2cnt]) { FREE_LS(dblist2); mprintf("!build: Memory allocation error\n"); return -1; } dblist2cnt++; entries += countlines("last.hdb"); } } if (!bc || hy) { for (i = 0; dblist[i].ext; i++) { snprintf(dbfile, sizeof(dbfile), "%s.%s", dbname, dblist[i].ext); if (dblist[i].count && !access(dbfile, R_OK)) entries += countlines(dbfile); } } if (entries != sigs) mprintf("^build: Signatures in %s db files: %u, loaded by libclamav: %u\n", dbname, entries, sigs); maxentries = optget(opts, "max-bad-sigs")->numarg; if (maxentries) { if (!entries || (sigs > entries && sigs - entries >= maxentries)) { mprintf("!Bad number of signatures in database files\n"); FREE_LS(dblist2); return -1; } } } /* try to read cvd header of current database */ if (opts->filename) { if (cli_strbcasestr(opts->filename[0], ".cvd") || cli_strbcasestr(opts->filename[0], ".cld") || cli_strbcasestr(opts->filename[0], ".cud")) { strncpy(olddb, opts->filename[0], sizeof(olddb)); olddb[sizeof(olddb) - 1] = '\0'; } else { mprintf("!build: Not a CVD/CLD/CUD file\n"); FREE_LS(dblist2); return -1; } } else { pt = freshdbdir(); snprintf(olddb, sizeof(olddb), "%s" PATHSEP "%s.cvd", localdbdir ? localdbdir : pt, dbname); if (access(olddb, R_OK)) snprintf(olddb, sizeof(olddb), "%s" PATHSEP "%s.cld", localdbdir ? localdbdir : pt, dbname); if (access(olddb, R_OK)) snprintf(olddb, sizeof(olddb), "%s" PATHSEP "%s.cud", localdbdir ? localdbdir : pt, dbname); free(pt); } if (!(oldcvd = cl_cvdhead(olddb)) && !optget(opts, "unsigned")->enabled) { mprintf("^build: CAN'T READ CVD HEADER OF CURRENT DATABASE %s (wait 3 s)\n", olddb); sleep(3); } if (oldcvd) { version = oldcvd->version + 1; oldsigs = oldcvd->sigs; cl_cvdfree(oldcvd); } else if (optget(opts, "cvd-version")->numarg != 0) { version = optget(opts, "cvd-version")->numarg; } else { mprintf("Version number: "); if (scanf("%u", &version) == EOF) { mprintf("!build: scanf() failed\n"); FREE_LS(dblist2); return -1; } } mprintf("Total sigs: %u\n", sigs); if (sigs > oldsigs) mprintf("New sigs: %u\n", sigs - oldsigs); strcpy(header, "ClamAV-VDB:"); /* time */ time(&timet); brokent = localtime(&timet); setlocale(LC_TIME, "C"); strftime(smbuff, sizeof(smbuff), "%d %b %Y %H-%M %z", brokent); strcat(header, smbuff); /* version */ sprintf(header + strlen(header), ":%u:", version); /* number of signatures */ sprintf(header + strlen(header), "%u:", sigs); /* functionality level */ fl = (unsigned int)(optget(opts, "flevel")->numarg); sprintf(header + strlen(header), "%u:", fl); real_header = strlen(header); /* add fake MD5 and dsig (for writeinfo) */ strcat(header, "X:X:"); if ((pt = getenv("SIGNDUSER"))) { strncpy(builder, pt, sizeof(builder)); builder[sizeof(builder) - 1] = '\0'; } else { mprintf("Builder name: "); if (scanf("%32s", builder) == EOF) { mprintf("!build: Can't get builder name\n"); free(dblist2); return -1; } } /* add builder */ strcat(header, builder); /* add current time */ sprintf(header + strlen(header), ":%u", (unsigned int)timet); if (writeinfo(dbname, builder, header, opts, dblist2, dblist2cnt) == -1) { mprintf("!build: Can't generate info file\n"); FREE_LS(dblist2); return -1; } header[real_header] = 0; if (!(tarfile = cli_gentemp("."))) { mprintf("!build: Can't generate temporary name for tarfile\n"); FREE_LS(dblist2); return -1; } if ((tar = gzopen(tarfile, "wb9f")) == NULL) { mprintf("!build: Can't open file %s for writing\n", tarfile); free(tarfile); FREE_LS(dblist2); return -1; } if (tar_addfile(-1, tar, "COPYING") == -1) { mprintf("!build: Can't add COPYING to tar archive\n"); gzclose(tar); unlink(tarfile); free(tarfile); FREE_LS(dblist2); return -1; } if (bc || hy) { if (!hy && tar_addfile(-1, tar, "bytecode.info") == -1) { gzclose(tar); unlink(tarfile); free(tarfile); FREE_LS(dblist2); return -1; } for (i = 0; i < dblist2cnt; i++) { if (tar_addfile(-1, tar, dblist2[i]) == -1) { gzclose(tar); unlink(tarfile); free(tarfile); FREE_LS(dblist2); return -1; } } } if (!bc || hy) { for (i = 0; dblist[i].ext; i++) { snprintf(dbfile, sizeof(dbfile), "%s.%s", dbname, dblist[i].ext); if (!access(dbfile, R_OK)) { if (tar_addfile(-1, tar, dbfile) == -1) { gzclose(tar); unlink(tarfile); free(tarfile); FREE_LS(dblist2); return -1; } } } } gzclose(tar); FREE_LS(dblist2); /* MD5 + dsig */ if (!(fh = fopen(tarfile, "rb"))) { mprintf("!build: Can't open file %s for reading\n", tarfile); unlink(tarfile); free(tarfile); return -1; } if (!(pt = cli_hashstream(fh, buffer, 1))) { mprintf("!build: Can't generate MD5 checksum for %s\n", tarfile); fclose(fh); unlink(tarfile); free(tarfile); return -1; } rewind(fh); sprintf(header + strlen(header), "%s:", pt); free(pt); if (!optget(opts, "unsigned")->enabled) { if (!(pt = getdsig(optget(opts, "server")->strarg, builder, buffer, 16, 1))) { mprintf("!build: Can't get digital signature from remote server\n"); fclose(fh); unlink(tarfile); free(tarfile); return -1; } sprintf(header + strlen(header), "%s:", pt); free(pt); } else { sprintf(header + strlen(header), "X:"); } /* add builder */ strcat(header, builder); /* add current time */ sprintf(header + strlen(header), ":%u", (unsigned int)timet); /* fill up with spaces */ while (strlen(header) < sizeof(header) - 1) strcat(header, " "); /* build the final database */ newcvd = optget(opts, "build")->strarg; if (!(cvd = fopen(newcvd, "wb"))) { mprintf("!build: Can't create final database %s\n", newcvd); fclose(fh); unlink(tarfile); free(tarfile); return -1; } if (fwrite(header, 1, 512, cvd) != 512) { mprintf("!build: Can't write to %s\n", newcvd); fclose(fh); unlink(tarfile); free(tarfile); fclose(cvd); unlink(newcvd); return -1; } while ((bytes = fread(buffer, 1, FILEBUFF, fh)) > 0) { if (fwrite(buffer, 1, bytes, cvd) != bytes) { mprintf("!build: Can't write to %s\n", newcvd); fclose(fh); unlink(tarfile); free(tarfile); fclose(cvd); unlink(newcvd); return -1; } } fclose(fh); fclose(cvd); if (unlink(tarfile) == -1) { mprintf("^build: Can't unlink %s\n", tarfile); unlink(tarfile); free(tarfile); unlink(newcvd); return -1; } free(tarfile); mprintf("Created %s\n", newcvd); if (optget(opts, "unsigned")->enabled) return 0; if (!oldcvd || optget(opts, "no-cdiff")->enabled) { mprintf("Skipping .cdiff creation\n"); return 0; } /* generate patch */ if (!(pt = cli_gentemp(NULL))) { mprintf("!build: Can't generate temporary name\n"); unlink(newcvd); return -1; } if (mkdir(pt, 0700)) { mprintf("!build: Can't create temporary directory %s\n", pt); free(pt); unlink(newcvd); return -1; } if (cli_cvdunpack(olddb, pt) == -1) { mprintf("!build: Can't unpack CVD file %s\n", olddb); cli_rmdirs(pt); free(pt); unlink(newcvd); return -1; } strncpy(olddb, pt, sizeof(olddb)); olddb[sizeof(olddb) - 1] = '\0'; free(pt); if (!(pt = cli_gentemp(NULL))) { mprintf("!build: Can't generate temporary name\n"); cli_rmdirs(olddb); unlink(newcvd); return -1; } if (mkdir(pt, 0700)) { mprintf("!build: Can't create temporary directory %s\n", pt); free(pt); cli_rmdirs(olddb); unlink(newcvd); return -1; } if (cli_cvdunpack(newcvd, pt) == -1) { mprintf("!build: Can't unpack CVD file %s\n", newcvd); cli_rmdirs(pt); free(pt); cli_rmdirs(olddb); unlink(newcvd); return -1; } snprintf(patch, sizeof(patch), "%s-%u.script", dbname, version); ret = diffdirs(olddb, pt, patch); cli_rmdirs(pt); free(pt); if (ret == -1) { cli_rmdirs(olddb); unlink(newcvd); return -1; } ret = verifydiff(patch, NULL, olddb); cli_rmdirs(olddb); if (ret == -1) { snprintf(broken, sizeof(broken), "%s.broken", patch); if (rename(patch, broken)) { unlink(patch); mprintf("!Generated file is incorrect, removed"); } else { mprintf("!Generated file is incorrect, renamed to %s\n", broken); } } else { ret = script2cdiff(patch, builder, opts); } return ret; } static int unpack(const struct optstruct *opts) { char name[512], *dbdir; const char *localdbdir = NULL; if (optget(opts, "datadir")->active) localdbdir = optget(opts, "datadir")->strarg; if (optget(opts, "unpack-current")->enabled) { dbdir = freshdbdir(); snprintf(name, sizeof(name), "%s" PATHSEP "%s.cvd", localdbdir ? localdbdir : dbdir, optget(opts, "unpack-current")->strarg); if (access(name, R_OK)) { snprintf(name, sizeof(name), "%s" PATHSEP "%s.cld", localdbdir ? localdbdir : dbdir, optget(opts, "unpack-current")->strarg); if (access(name, R_OK)) { mprintf("!unpack: Couldn't find %s CLD/CVD database in %s\n", optget(opts, "unpack-current")->strarg, localdbdir ? localdbdir : dbdir); free(dbdir); return -1; } } free(dbdir); } else { strncpy(name, optget(opts, "unpack")->strarg, sizeof(name)); name[sizeof(name) - 1] = '\0'; } if (cl_cvdverify(name) != CL_SUCCESS) { mprintf("!unpack: %s is not a valid CVD\n", name); return -1; } if (cli_cvdunpack(name, ".") == -1) { mprintf("!unpack: Can't unpack file %s\n", name); return -1; } return 0; } static int cvdinfo(const struct optstruct *opts) { struct cl_cvd *cvd; char *pt; int ret; pt = optget(opts, "info")->strarg; if ((cvd = cl_cvdhead(pt)) == NULL) { mprintf("!cvdinfo: Can't read/parse CVD header of %s\n", pt); return -1; } mprintf("File: %s\n", pt); pt = strchr(cvd->time, '-'); if (!pt) { cl_cvdfree(cvd); return -1; } *pt = ':'; mprintf("Build time: %s\n", cvd->time); mprintf("Version: %u\n", cvd->version); mprintf("Signatures: %u\n", cvd->sigs); mprintf("Functionality level: %u\n", cvd->fl); mprintf("Builder: %s\n", cvd->builder); pt = optget(opts, "info")->strarg; if (cli_strbcasestr(pt, ".cvd")) { mprintf("MD5: %s\n", cvd->md5); mprintf("Digital signature: %s\n", cvd->dsig); } cl_cvdfree(cvd); if (cli_strbcasestr(pt, ".cud")) mprintf("Verification: Unsigned container\n"); else if ((ret = cl_cvdverify(pt))) { mprintf("!cvdinfo: Verification: %s\n", cl_strerror(ret)); return -1; } else mprintf("Verification OK.\n"); return 0; } static int listdb(const char *filename, const regex_t *regex); static int listdir(const char *dirname, const regex_t *regex) { DIR *dd; struct dirent *dent; char *dbfile; if ((dd = opendir(dirname)) == NULL) { mprintf("!listdir: Can't open directory %s\n", dirname); return -1; } while ((dent = readdir(dd))) { if (dent->d_ino) { if (strcmp(dent->d_name, ".") && strcmp(dent->d_name, "..") && (cli_strbcasestr(dent->d_name, ".db") || cli_strbcasestr(dent->d_name, ".hdb") || cli_strbcasestr(dent->d_name, ".hdu") || cli_strbcasestr(dent->d_name, ".hsb") || cli_strbcasestr(dent->d_name, ".hsu") || cli_strbcasestr(dent->d_name, ".mdb") || cli_strbcasestr(dent->d_name, ".mdu") || cli_strbcasestr(dent->d_name, ".msb") || cli_strbcasestr(dent->d_name, ".msu") || cli_strbcasestr(dent->d_name, ".ndb") || cli_strbcasestr(dent->d_name, ".ndu") || cli_strbcasestr(dent->d_name, ".ldb") || cli_strbcasestr(dent->d_name, ".ldu") || cli_strbcasestr(dent->d_name, ".sdb") || cli_strbcasestr(dent->d_name, ".zmd") || cli_strbcasestr(dent->d_name, ".rmd") || cli_strbcasestr(dent->d_name, ".cdb") || cli_strbcasestr(dent->d_name, ".cbc") || cli_strbcasestr(dent->d_name, ".cld") || cli_strbcasestr(dent->d_name, ".cvd") || cli_strbcasestr(dent->d_name, ".crb") || cli_strbcasestr(dent->d_name, ".imp"))) { dbfile = (char *)malloc(strlen(dent->d_name) + strlen(dirname) + 2); if (!dbfile) { mprintf("!listdir: Can't allocate memory for dbfile\n"); closedir(dd); return -1; } sprintf(dbfile, "%s" PATHSEP "%s", dirname, dent->d_name); if (listdb(dbfile, regex) == -1) { mprintf("!listdb: Error listing database %s\n", dbfile); free(dbfile); closedir(dd); return -1; } free(dbfile); } } } closedir(dd); return 0; } static int listdb(const char *filename, const regex_t *regex) { FILE *fh; char *buffer, *pt, *start, *dir; const char *dbname, *pathsep = PATHSEP; unsigned int line = 0; if ((fh = fopen(filename, "rb")) == NULL) { mprintf("!listdb: Can't open file %s\n", filename); return -1; } if (!(buffer = (char *)malloc(FILEBUFF))) { mprintf("!listdb: Can't allocate memory for buffer\n"); fclose(fh); return -1; } /* check for CVD file */ if (!fgets(buffer, 12, fh)) { mprintf("!listdb: fgets failed\n"); free(buffer); fclose(fh); return -1; } rewind(fh); if (!strncmp(buffer, "ClamAV-VDB:", 11)) { free(buffer); fclose(fh); if (!(dir = cli_gentemp(NULL))) { mprintf("!listdb: Can't generate temporary name\n"); return -1; } if (mkdir(dir, 0700)) { mprintf("!listdb: Can't create temporary directory %s\n", dir); free(dir); return -1; } if (cli_cvdunpack(filename, dir) == -1) { mprintf("!listdb: Can't unpack CVD file %s\n", filename); cli_rmdirs(dir); free(dir); return -1; } /* list extracted directory */ if (listdir(dir, regex) == -1) { mprintf("!listdb: Can't list directory %s\n", filename); cli_rmdirs(dir); free(dir); return -1; } cli_rmdirs(dir); free(dir); return 0; } if (!(dbname = strrchr(filename, *pathsep))) { mprintf("!listdb: Invalid filename %s\n", filename); fclose(fh); free(buffer); return -1; } dbname++; if (cli_strbcasestr(filename, ".db")) { /* old style database */ while (fgets(buffer, FILEBUFF, fh)) { if (regex) { cli_chomp(buffer); if (!cli_regexec(regex, buffer, 0, NULL, 0)) mprintf("[%s] %s\n", dbname, buffer); continue; } line++; if (buffer && buffer[0] == '#') continue; pt = strchr(buffer, '='); if (!pt) { mprintf("!listdb: Malformed pattern line %u (file %s)\n", line, filename); fclose(fh); free(buffer); return -1; } start = buffer; *pt = 0; if ((pt = strstr(start, " (Clam)"))) *pt = 0; mprintf("%s\n", start); } } else if (cli_strbcasestr(filename, ".crb")) { while (fgets(buffer, FILEBUFF, fh)) { cli_chomp(buffer); if (buffer[0] == '#') continue; if (regex) { if (!cli_regexec(regex, buffer, 0, NULL, 0)) mprintf("[%s] %s\n", dbname, buffer); continue; } line++; mprintf("%s\n", buffer); } } else if (cli_strbcasestr(filename, ".hdb") || cli_strbcasestr(filename, ".hdu") || cli_strbcasestr(filename, ".mdb") || cli_strbcasestr(filename, ".mdu") || cli_strbcasestr(filename, ".hsb") || cli_strbcasestr(filename, ".hsu") || cli_strbcasestr(filename, ".msb") || cli_strbcasestr(filename, ".msu") || cli_strbcasestr(filename, ".imp")) { /* hash database */ while (fgets(buffer, FILEBUFF, fh)) { cli_chomp(buffer); if (regex) { if (!cli_regexec(regex, buffer, 0, NULL, 0)) mprintf("[%s] %s\n", dbname, buffer); continue; } line++; if (buffer && buffer[0] == '#') continue; start = cli_strtok(buffer, 2, ":"); if (!start) { mprintf("!listdb: Malformed pattern line %u (file %s)\n", line, filename); fclose(fh); free(buffer); return -1; } if ((pt = strstr(start, " (Clam)"))) *pt = 0; mprintf("%s\n", start); free(start); } } else if (cli_strbcasestr(filename, ".ndb") || cli_strbcasestr(filename, ".ndu") || cli_strbcasestr(filename, ".ldb") || cli_strbcasestr(filename, ".ldu") || cli_strbcasestr(filename, ".sdb") || cli_strbcasestr(filename, ".zmd") || cli_strbcasestr(filename, ".rmd") || cli_strbcasestr(filename, ".cdb")) { while (fgets(buffer, FILEBUFF, fh)) { cli_chomp(buffer); if (regex) { if (!cli_regexec(regex, buffer, 0, NULL, 0)) mprintf("[%s] %s\n", dbname, buffer); continue; } line++; if (buffer && buffer[0] == '#') continue; if (cli_strbcasestr(filename, ".ldb") || cli_strbcasestr(filename, ".ldu")) pt = strchr(buffer, ';'); else pt = strchr(buffer, ':'); if (!pt) { mprintf("!listdb: Malformed pattern line %u (file %s)\n", line, filename); fclose(fh); free(buffer); return -1; } *pt = 0; if ((pt = strstr(buffer, " (Clam)"))) *pt = 0; mprintf("%s\n", buffer); } } else if (cli_strbcasestr(filename, ".cbc")) { if (fgets(buffer, FILEBUFF, fh) && fgets(buffer, FILEBUFF, fh)) { pt = strchr(buffer, ';'); if (!pt) { /* not a real sig */ fclose(fh); free(buffer); return 0; } if (regex) { if (!cli_regexec(regex, buffer, 0, NULL, 0)) { mprintf("[%s BYTECODE] %s", dbname, buffer); } } else { *pt = 0; mprintf("%s\n", buffer); } } } fclose(fh); free(buffer); return 0; } static int listsigs(const struct optstruct *opts, int mode) { int ret; const char *name; char *dbdir; STATBUF sb; regex_t reg; const char *localdbdir = NULL; if (optget(opts, "datadir")->active) localdbdir = optget(opts, "datadir")->strarg; if (mode == 0) { name = optget(opts, "list-sigs")->strarg; if (access(name, R_OK) && localdbdir) name = localdbdir; if (CLAMSTAT(name, &sb) == -1) { mprintf("--list-sigs: Can't get status of %s\n", name); return -1; } mprintf_stdout = 1; if (S_ISDIR(sb.st_mode)) { if (!strcmp(name, DATADIR)) { dbdir = freshdbdir(); ret = listdir(localdbdir ? localdbdir : dbdir, NULL); free(dbdir); } else { ret = listdir(name, NULL); } } else { ret = listdb(name, NULL); } } else { if (cli_regcomp(®, optget(opts, "find-sigs")->strarg, REG_EXTENDED | REG_NOSUB) != 0) { mprintf("--find-sigs: Can't compile regex\n"); return -1; } mprintf_stdout = 1; dbdir = freshdbdir(); ret = listdir(localdbdir ? localdbdir : dbdir, ®); free(dbdir); cli_regfree(®); } return ret; } static int vbadump(const struct optstruct *opts) { int fd, hex_output; char *dir; const char *pt; struct uniq *vba = NULL; cli_ctx *ctx; if (optget(opts, "vba-hex")->enabled) { hex_output = 1; pt = optget(opts, "vba-hex")->strarg; } else { hex_output = 0; pt = optget(opts, "vba")->strarg; } if ((fd = open(pt, O_RDONLY | O_BINARY)) == -1) { mprintf("!vbadump: Can't open file %s\n", pt); return -1; } /* generate the temporary directory */ if (!(dir = cli_gentemp(NULL))) { mprintf("!vbadump: Can't generate temporary name\n"); close(fd); return -1; } if (mkdir(dir, 0700)) { mprintf("!vbadump: Can't create temporary directory %s\n", dir); free(dir); close(fd); return -1; } if (!(ctx = convenience_ctx(fd))) { close(fd); free(dir); return -1; } if (cli_ole2_extract(dir, ctx, &vba)) { destroy_ctx(-1, ctx); cli_rmdirs(dir); free(dir); close(fd); return -1; } destroy_ctx(-1, ctx); if (vba) sigtool_vba_scandir(dir, hex_output, vba); cli_rmdirs(dir); free(dir); close(fd); return 0; } static int comparesha(const char *diff) { char info[32], buff[FILEBUFF], *sha, *pt, *name; const char *tokens[3]; FILE *fh; int ret = 0, tokens_count; name = strdup(diff); if (!name) { mprintf("!verifydiff: strdup() failed\n"); return -1; } if (!(pt = strrchr(name, '-')) || !isdigit(pt[1])) { mprintf("!verifydiff: Invalid diff name\n"); free(name); return -1; } *pt = 0; if ((pt = strrchr(name, *PATHSEP))) pt++; else pt = name; snprintf(info, sizeof(info), "%s.info", pt); free(name); if (!(fh = fopen(info, "rb"))) { mprintf("!verifydiff: Can't open %s\n", info); return -1; } if (!fgets(buff, sizeof(buff), fh) || strncmp(buff, "ClamAV-VDB", 10)) { mprintf("!verifydiff: Incorrect info file %s\n", info); fclose(fh); return -1; } while (fgets(buff, sizeof(buff), fh)) { cli_chomp(buff); tokens_count = cli_strtokenize(buff, ':', 3, tokens); if (tokens_count != 3) { if (!strcmp(tokens[0], "DSIG")) continue; mprintf("!verifydiff: Incorrect format of %s\n", info); ret = -1; break; } if (!(sha = sha256file(tokens[0], NULL))) { mprintf("!verifydiff: Can't generate SHA256 for %s\n", buff); ret = -1; break; } if (strcmp(sha, tokens[2])) { mprintf("!verifydiff: %s has incorrect checksum\n", buff); ret = -1; free(sha); break; } free(sha); } fclose(fh); return ret; } static int rundiff(const struct optstruct *opts) { int fd, ret; unsigned short mode; const char *diff; diff = optget(opts, "run-cdiff")->strarg; if (strstr(diff, ".cdiff")) { mode = 1; } else if (strstr(diff, ".script")) { mode = 0; } else { mprintf("!rundiff: Incorrect file name (no .cdiff/.script extension)\n"); return -1; } if ((fd = open(diff, O_RDONLY | O_BINARY)) == -1) { mprintf("!rundiff: Can't open file %s\n", diff); return -1; } ret = cdiff_apply(fd, mode); close(fd); if (!ret) ret = comparesha(diff); return ret; } static int maxlinelen(const char *file) { int fd, bytes, n = 0, nmax = 0, i; char buff[512]; if ((fd = open(file, O_RDONLY)) == -1) { mprintf("!maxlinelen: Can't open file %s\n", file); return -1; } while ((bytes = read(fd, buff, 512)) > 0) { for (i = 0; i < bytes; i++, ++n) { if (buff[i] == '\n') { if (n > nmax) nmax = n; n = 0; } } } if (bytes == -1) { mprintf("!maxlinelen: Can't read file %s\n", file); close(fd); return -1; } close(fd); return nmax + 1; } static int compare(const char *oldpath, const char *newpath, FILE *diff) { FILE *old, *new; char *obuff, *nbuff, *tbuff, *pt, *omd5, *nmd5; unsigned int oline = 0, tline, found, i, badxchg = 0; int l1 = 0, l2; long opos; if (!access(oldpath, R_OK) && (omd5 = cli_hashfile(oldpath, 1))) { if (!(nmd5 = cli_hashfile(newpath, 1))) { mprintf("!compare: Can't get MD5 checksum of %s\n", newpath); free(omd5); return -1; } if (!strcmp(omd5, nmd5)) { free(omd5); free(nmd5); return 0; } free(omd5); free(nmd5); l1 = maxlinelen(oldpath); } l2 = maxlinelen(newpath); if (l1 == -1 || l2 == -1) return -1; l1 = MAX(l1, l2) + 1; obuff = malloc(l1); if (!obuff) { mprintf("!compare: Can't allocate memory for 'obuff'\n"); return -1; } nbuff = malloc(l1); if (!nbuff) { mprintf("!compare: Can't allocate memory for 'nbuff'\n"); free(obuff); return -1; } tbuff = malloc(l1); if (!tbuff) { mprintf("!compare: Can't allocate memory for 'tbuff'\n"); free(obuff); free(nbuff); return -1; } if (l1 > CLI_DEFAULT_LSIG_BUFSIZE) fprintf(diff, "#LSIZE %u\n", l1 + 32); fprintf(diff, "OPEN %s\n", newpath); if (!(new = fopen(newpath, "rb"))) { mprintf("!compare: Can't open file %s for reading\n", newpath); free(obuff); free(nbuff); free(tbuff); return -1; } old = fopen(oldpath, "rb"); while (fgets(nbuff, l1, new)) { i = strlen(nbuff); if (i >= 2 && (nbuff[i - 1] == '\r' || (nbuff[i - 1] == '\n' && nbuff[i - 2] == '\r'))) { mprintf("!compare: New %s file contains lines terminated with CRLF or CR\n", newpath); if (old) fclose(old); fclose(new); free(obuff); free(nbuff); free(tbuff); return -1; } cli_chomp(nbuff); if (!old) { fprintf(diff, "ADD %s\n", nbuff); } else { if (fgets(obuff, l1, old)) { oline++; cli_chomp(obuff); if (!strcmp(nbuff, obuff)) { continue; } else { tline = 0; found = 0; opos = ftell(old); while (fgets(tbuff, l1, old)) { tline++; cli_chomp(tbuff); if (tline > MAX_DEL_LOOKAHEAD) break; if (!strcmp(tbuff, nbuff)) { found = 1; break; } } fseek(old, opos, SEEK_SET); if (found) { strncpy(tbuff, obuff, l1); tbuff[l1 - 1] = '\0'; for (i = 0; i < tline; i++) { tbuff[MIN(16, l1 - 1)] = 0; if ((pt = strchr(tbuff, ' '))) *pt = 0; fprintf(diff, "DEL %u %s\n", oline + i, tbuff); if (!fgets(tbuff, l1, old)) break; } oline += tline; } else { if (!*obuff || *obuff == ' ') { badxchg = 1; break; } obuff[MIN(16, l1 - 1)] = 0; if ((pt = strchr(obuff, ' '))) *pt = 0; fprintf(diff, "XCHG %u %s %s\n", oline, obuff, nbuff); } } } else { fclose(old); old = NULL; fprintf(diff, "ADD %s\n", nbuff); } } } if (old) { if (!badxchg) { while (fgets(obuff, l1, old)) { oline++; cli_chomp(obuff); obuff[MIN(16, l1 - 1)] = 0; if ((pt = strchr(obuff, ' '))) *pt = 0; fprintf(diff, "DEL %u %s\n", oline, obuff); } } fclose(old); } fprintf(diff, "CLOSE\n"); free(obuff); free(tbuff); if (badxchg) { fprintf(diff, "UNLINK %s\n", newpath); fprintf(diff, "OPEN %s\n", newpath); rewind(new); while (fgets(nbuff, l1, new)) { cli_chomp(nbuff); fprintf(diff, "ADD %s\n", nbuff); } fprintf(diff, "CLOSE\n"); } free(nbuff); fclose(new); return 0; } static int compareone(const struct optstruct *opts) { if (!opts->filename) { mprintf("!makediff: --compare requires two arguments\n"); return -1; } return compare(optget(opts, "compare")->strarg, opts->filename[0], stdout); } static int dircopy(const char *src, const char *dest) { DIR *dd; struct dirent *dent; STATBUF sb; char spath[512], dpath[512]; if (CLAMSTAT(dest, &sb) == -1) { if (mkdir(dest, 0755)) { /* mprintf("!dircopy: Can't create temporary directory %s\n", dest); */ return -1; } } if ((dd = opendir(src)) == NULL) { /* mprintf("!dircopy: Can't open directory %s\n", src); */ return -1; } while ((dent = readdir(dd))) { if (dent->d_ino) { if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, "..")) continue; snprintf(spath, sizeof(spath), "%s" PATHSEP "%s", src, dent->d_name); snprintf(dpath, sizeof(dpath), "%s" PATHSEP "%s", dest, dent->d_name); if (filecopy(spath, dpath) == -1) { /* mprintf("!dircopy: Can't copy %s to %s\n", spath, dpath); */ cli_rmdirs(dest); closedir(dd); return -1; } } } closedir(dd); return 0; } static int verifydiff(const char *diff, const char *cvd, const char *incdir) { char *tempdir, cwd[512]; int ret = 0, fd; unsigned short mode; if (strstr(diff, ".cdiff")) { mode = 1; } else if (strstr(diff, ".script")) { mode = 0; } else { mprintf("!verifydiff: Incorrect file name (no .cdiff/.script extension)\n"); return -1; } tempdir = cli_gentemp(NULL); if (!tempdir) { mprintf("!verifydiff: Can't generate temporary name for tempdir\n"); return -1; } if (mkdir(tempdir, 0700) == -1) { mprintf("!verifydiff: Can't create directory %s\n", tempdir); free(tempdir); return -1; } if (cvd) { if (cli_cvdunpack(cvd, tempdir) == -1) { mprintf("!verifydiff: Can't unpack CVD file %s\n", cvd); cli_rmdirs(tempdir); free(tempdir); return -1; } } else { if (dircopy(incdir, tempdir) == -1) { mprintf("!verifydiff: Can't copy dir %s to %s\n", incdir, tempdir); cli_rmdirs(tempdir); free(tempdir); return -1; } } if (!getcwd(cwd, sizeof(cwd))) { mprintf("!verifydiff: getcwd() failed\n"); cli_rmdirs(tempdir); free(tempdir); return -1; } if ((fd = open(diff, O_RDONLY | O_BINARY)) == -1) { mprintf("!verifydiff: Can't open diff file %s\n", diff); cli_rmdirs(tempdir); free(tempdir); return -1; } if (chdir(tempdir) == -1) { mprintf("!verifydiff: Can't chdir to %s\n", tempdir); cli_rmdirs(tempdir); free(tempdir); close(fd); return -1; } if (cdiff_apply(fd, mode) == -1) { mprintf("!verifydiff: Can't apply %s\n", diff); if (chdir(cwd) == -1) mprintf("^verifydiff: Can't chdir to %s\n", cwd); cli_rmdirs(tempdir); free(tempdir); close(fd); return -1; } close(fd); ret = comparesha(diff); if (chdir(cwd) == -1) mprintf("^verifydiff: Can't chdir to %s\n", cwd); cli_rmdirs(tempdir); free(tempdir); if (!ret) { if (cvd) mprintf("Verification: %s correctly applies to %s\n", diff, cvd); else mprintf("Verification: %s correctly applies to the previous version\n", diff); } return ret; } static void matchsig(const char *sig, const char *offset, int fd) { struct cl_engine *engine; struct cli_ac_result *acres = NULL, *res; STATBUF sb; unsigned int matches = 0; cli_ctx ctx; struct cl_scan_options options; int ret; mprintf("SUBSIG: %s\n", sig); if (!(engine = cl_engine_new())) { mprintf("!matchsig: Can't create new engine\n"); return; } cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1); if (cli_initroots(engine, 0) != CL_SUCCESS) { mprintf("!matchsig: cli_initroots() failed\n"); cl_engine_free(engine); return; } if (cli_parse_add(engine->root[0], "test", sig, 0, 0, 0, "*", 0, NULL, 0) != CL_SUCCESS) { mprintf("!matchsig: Can't parse signature\n"); cl_engine_free(engine); return; } if (cl_engine_compile(engine) != CL_SUCCESS) { mprintf("!matchsig: Can't compile engine\n"); cl_engine_free(engine); return; } memset(&ctx, '\0', sizeof(cli_ctx)); memset(&options, 0, sizeof(struct cl_scan_options)); ctx.engine = engine; ctx.options = &options; ctx.options->parse = ~0; ctx.containers = cli_calloc(sizeof(cli_ctx_container), engine->maxreclevel + 2); if (!ctx.containers) { cl_engine_free(engine); return; } ctx.containers[0].type = CL_TYPE_ANY; ctx.dconf = (struct cli_dconf *)engine->dconf; ctx.fmap = calloc(sizeof(fmap_t *), 1); if (!ctx.fmap) { free(ctx.containers); cl_engine_free(engine); return; } lseek(fd, 0, SEEK_SET); FSTAT(fd, &sb); if (!(*ctx.fmap = fmap(fd, 0, sb.st_size))) { free(ctx.containers); free(ctx.fmap); cl_engine_free(engine); return; } ret = cli_fmap_scandesc(&ctx, 0, 0, NULL, AC_SCAN_VIR, &acres, NULL); res = acres; while (res) { matches++; res = res->next; } if (matches) { /* TODO: check offsets automatically */ mprintf("MATCH: ** YES%s ** (%u %s:", offset ? "/CHECK OFFSET" : "", matches, matches > 1 ? "matches at offsets" : "match at offset"); res = acres; while (res) { mprintf(" %u", (unsigned int)res->offset); res = res->next; } mprintf(")\n"); } else { mprintf("MATCH: ** NO **\n"); } while (acres) { res = acres; acres = acres->next; free(res); } free(ctx.containers); funmap(*ctx.fmap); free(ctx.fmap); cl_engine_free(engine); } static char *decodehexstr(const char *hex, unsigned int *dlen) { uint16_t *str16; char *decoded; unsigned int i, p = 0, wildcard = 0, len = strlen(hex) / 2; str16 = cli_hex2ui(hex); if (!str16) return NULL; for (i = 0; i < len; i++) if (str16[i] & CLI_MATCH_WILDCARD) wildcard++; decoded = calloc(len + 1 + wildcard * 32, sizeof(char)); if (!decoded) { free(str16); mprintf("!decodehexstr: Can't allocate memory for decoded\n"); return NULL; } for (i = 0; i < len; i++) { if (str16[i] & CLI_MATCH_WILDCARD) { switch (str16[i] & CLI_MATCH_WILDCARD) { case CLI_MATCH_IGNORE: p += sprintf(decoded + p, "{WILDCARD_IGNORE}"); break; case CLI_MATCH_NIBBLE_HIGH: p += sprintf(decoded + p, "{WILDCARD_NIBBLE_HIGH:0x%x}", str16[i] & 0x00f0); break; case CLI_MATCH_NIBBLE_LOW: p += sprintf(decoded + p, "{WILDCARD_NIBBLE_LOW:0x%x}", str16[i] & 0x000f); break; default: mprintf("!decodehexstr: Unknown wildcard (0x%x@%u)\n", str16[i] & CLI_MATCH_WILDCARD, i); free(decoded); free(str16); return NULL; } } else { decoded[p] = str16[i]; p++; } } if (dlen) *dlen = p; free(str16); return decoded; } inline static char *get_paren_end(char *hexstr) { char *pt; int level = 0; pt = hexstr; while (*pt != '\0') { if (*pt == '(') { level++; } else if (*pt == ')') { if (!level) return pt; level--; } pt++; } return NULL; } static char *decodehexspecial(const char *hex, unsigned int *dlen) { char *pt, *start, *hexcpy, *decoded, *h, *e, *c, op, lop; unsigned int len = 0, hlen, negative; int level; char *buff; hexcpy = NULL; buff = NULL; hexcpy = strdup(hex); if (!hexcpy) { mprintf("!decodehexspecial: strdup(hex) failed\n"); return NULL; } pt = strchr(hexcpy, '('); if (!pt) { free(hexcpy); return decodehexstr(hex, dlen); } else { buff = calloc(strlen(hex) + 512, sizeof(char)); if (!buff) { mprintf("!decodehexspecial: Can't allocate memory for buff\n"); free(hexcpy); return NULL; } start = hexcpy; do { negative = 0; *pt++ = 0; if (!start) { mprintf("!decodehexspecial: Unexpected EOL\n"); free(hexcpy); free(buff); return NULL; } if (pt >= hexcpy + 2) { if (pt[-2] == '!') { negative = 1; pt[-2] = 0; } } if (!(decoded = decodehexstr(start, &hlen))) { mprintf("!Decoding failed (1): %s\n", pt); free(hexcpy); free(buff); return NULL; } memcpy(&buff[len], decoded, hlen); len += hlen; free(decoded); if (!(start = get_paren_end(pt))) { mprintf("!decodehexspecial: Missing closing parenthesis\n"); free(hexcpy); free(buff); return NULL; } *start++ = 0; if (!strlen(pt)) { mprintf("!decodehexspecial: Empty block\n"); free(hexcpy); free(buff); return NULL; } if (!strcmp(pt, "B")) { if (!*start) { if (negative) len += sprintf(buff + len, "{NOT_BOUNDARY_RIGHT}"); else len += sprintf(buff + len, "{BOUNDARY_RIGHT}"); continue; } else if (pt - 1 == hexcpy) { if (negative) len += sprintf(buff + len, "{NOT_BOUNDARY_LEFT}"); else len += sprintf(buff + len, "{BOUNDARY_LEFT}"); continue; } } else if (!strcmp(pt, "L")) { if (!*start) { if (negative) len += sprintf(buff + len, "{NOT_LINE_MARKER_RIGHT}"); else len += sprintf(buff + len, "{LINE_MARKER_RIGHT}"); continue; } else if (pt - 1 == hexcpy) { if (negative) len += sprintf(buff + len, "{NOT_LINE_MARKER_LEFT}"); else len += sprintf(buff + len, "{LINE_MARKER_LEFT}"); continue; } } else if (!strcmp(pt, "W")) { if (!*start) { if (negative) len += sprintf(buff + len, "{NOT_WORD_MARKER_RIGHT}"); else len += sprintf(buff + len, "{WORD_MARKER_RIGHT}"); continue; } else if (pt - 1 == hexcpy) { if (negative) len += sprintf(buff + len, "{NOT_WORD_MARKER_LEFT}"); else len += sprintf(buff + len, "{WORD_MARKER_LEFT}"); continue; } } else { if (!strlen(pt)) { mprintf("!decodehexspecial: Empty block\n"); free(hexcpy); free(buff); return NULL; } /* TODO: analyze string alternative for typing */ if (negative) len += sprintf(buff + len, "{EXCLUDING_STRING_ALTERNATIVE:"); else len += sprintf(buff + len, "{STRING_ALTERNATIVE:"); level = 0; h = e = pt; op = '\0'; while ((level >= 0) && (e = strpbrk(h, "()|"))) { lop = op; op = *e; *e++ = 0; if (op != '(' && lop != ')' && !strlen(h)) { mprintf("!decodehexspecial: Empty string alternative block\n"); free(hexcpy); free(buff); return NULL; } //mprintf("decodehexspecial: %s\n", h); if (!(c = cli_hex2str(h))) { mprintf("!Decoding failed (3): %s\n", h); free(hexcpy); free(buff); return NULL; } memcpy(&buff[len], c, strlen(h) / 2); len += strlen(h) / 2; free(c); switch (op) { case '(': level++; negative = 0; if (e >= pt + 2) { if (e[-2] == '!') { negative = 1; e[-2] = 0; } } if (negative) len += sprintf(buff + len, "{EXCLUDING_STRING_ALTERNATIVE:"); else len += sprintf(buff + len, "{STRING_ALTERNATIVE:"); break; case ')': level--; buff[len++] = '}'; break; case '|': buff[len++] = '|'; break; default:; } h = e; } if (!(c = cli_hex2str(h))) { mprintf("!Decoding failed (4): %s\n", h); free(hexcpy); free(buff); return NULL; } memcpy(&buff[len], c, strlen(h) / 2); len += strlen(h) / 2; free(c); buff[len++] = '}'; if (level != 0) { mprintf("!decodehexspecial: Invalid string alternative nesting\n"); free(hexcpy); free(buff); return NULL; } } } while ((pt = strchr(start, '('))); if (start) { if (!(decoded = decodehexstr(start, &hlen))) { mprintf("!Decoding failed (2)\n"); free(buff); free(hexcpy); return NULL; } memcpy(&buff[len], decoded, hlen); len += hlen; free(decoded); } } free(hexcpy); if (dlen) *dlen = len; return buff; } static int decodehex(const char *hexsig) { char *pt, *hexcpy, *start, *n, *decoded, *wild; int asterisk = 0; unsigned int i, j, hexlen, dlen, parts = 0, bw; int mindist = 0, maxdist = 0, error = 0; hexlen = strlen(hexsig); if ((wild = strchr(hexsig, '/'))) { /* ^offset:trigger-logic/regex/options$ */ char *trigger, *regex, *regex_end, *cflags; size_t tlen = wild - hexsig, rlen, clen; /* check for trigger */ if (!tlen) { mprintf("!pcre without logical trigger\n"); return -1; } /* locate end of regex for options start, locate options length */ if ((regex_end = strchr(wild + 1, '/')) == NULL) { mprintf("!missing regex expression terminator /\n"); return -1; } rlen = regex_end - wild - 1; clen = hexlen - tlen - rlen - 2; /* 2 from regex boundaries '/' */ /* get the trigger statement */ trigger = cli_calloc(tlen + 1, sizeof(char)); if (!trigger) { mprintf("!cannot allocate memory for trigger string\n"); return -1; } strncpy(trigger, hexsig, tlen); trigger[tlen] = '\0'; /* get the regex expression */ regex = cli_calloc(rlen + 1, sizeof(char)); if (!regex) { mprintf("!cannot allocate memory for regex expression\n"); free(trigger); return -1; } strncpy(regex, hexsig + tlen + 1, rlen); regex[rlen] = '\0'; /* get the compile flags */ if (clen) { cflags = cli_calloc(clen + 1, sizeof(char)); if (!cflags) { mprintf("!cannot allocate memory for compile flags\n"); free(trigger); free(regex); return -1; } strncpy(cflags, hexsig + tlen + rlen + 2, clen); cflags[clen] = '\0'; } else { cflags = NULL; } /* print components of regex subsig */ mprintf(" +-> TRIGGER: %s\n", trigger); mprintf(" +-> REGEX: %s\n", regex); mprintf(" +-> CFLAGS: %s\n", cflags); free(trigger); free(regex); if (cflags) free(cflags); #if HAVE_PCRE return 0; #else mprintf("!PCRE subsig cannot be loaded without PCRE support\n"); return -1; #endif } else if (strchr(hexsig, '{') || strchr(hexsig, '[')) { if (!(hexcpy = strdup(hexsig))) return -1; for (i = 0; i < hexlen; i++) if (hexsig[i] == '{' || hexsig[i] == '[' || hexsig[i] == '*') parts++; if (parts) parts++; start = pt = hexcpy; for (i = 1; i <= parts; i++) { if (i != parts) { for (j = 0; j < strlen(start); j++) { if (start[j] == '{' || start[j] == '[') { asterisk = 0; pt = start + j; break; } if (start[j] == '*') { asterisk = 1; pt = start + j; break; } } *pt++ = 0; } if (mindist && maxdist) { if (mindist == maxdist) mprintf("{WILDCARD_ANY_STRING(LENGTH==%u)}", mindist); else mprintf("{WILDCARD_ANY_STRING(LENGTH>=%u&&<=%u)}", mindist, maxdist); } else if (mindist) mprintf("{WILDCARD_ANY_STRING(LENGTH>=%u)}", mindist); else if (maxdist) mprintf("{WILDCARD_ANY_STRING(LENGTH<=%u)}", maxdist); if (!(decoded = decodehexspecial(start, &dlen))) { mprintf("!Decoding failed\n"); free(hexcpy); return -1; } bw = write(1, decoded, dlen); free(decoded); if (i == parts) break; if (asterisk) mprintf("{WILDCARD_ANY_STRING}"); mindist = maxdist = 0; if (asterisk) { start = pt; continue; } if (!(start = strchr(pt, '}')) && !(start = strchr(pt, ']'))) { error = 1; break; } *start++ = 0; if (!pt) { error = 1; break; } if (!strchr(pt, '-')) { if (!cli_isnumber(pt) || (mindist = maxdist = atoi(pt)) < 0) { error = 1; break; } } else { if ((n = cli_strtok(pt, 0, "-"))) { if (!cli_isnumber(n) || (mindist = atoi(n)) < 0) { error = 1; free(n); break; } free(n); } if ((n = cli_strtok(pt, 1, "-"))) { if (!cli_isnumber(n) || (maxdist = atoi(n)) < 0) { error = 1; free(n); break; } free(n); } if ((n = cli_strtok(pt, 2, "-"))) { /* strict check */ error = 1; free(n); break; } } } free(hexcpy); if (error) return -1; } else if (strchr(hexsig, '*')) { for (i = 0; i < hexlen; i++) if (hexsig[i] == '*') parts++; if (parts) parts++; for (i = 1; i <= parts; i++) { if ((pt = cli_strtok(hexsig, i - 1, "*")) == NULL) { mprintf("!Can't extract part %u of partial signature\n", i); return -1; } if (!(decoded = decodehexspecial(pt, &dlen))) { mprintf("!Decoding failed\n"); free(pt); return -1; } bw = write(1, decoded, dlen); free(decoded); if (i < parts) mprintf("{WILDCARD_ANY_STRING}"); free(pt); } } else { if (!(decoded = decodehexspecial(hexsig, &dlen))) { mprintf("!Decoding failed\n"); return -1; } bw = write(1, decoded, dlen); free(decoded); } mprintf("\n"); return 0; } static int decodesigmod(const char *sigmod) { size_t i; for (i = 0; i < strlen(sigmod); i++) { mprintf(" "); switch (sigmod[i]) { case 'i': mprintf("NOCASE"); break; case 'f': mprintf("FULLWORD"); break; case 'w': mprintf("WIDE"); break; case 'a': mprintf("ASCII"); break; default: mprintf("UNKNOWN"); return -1; } } mprintf("\n"); return 0; } static int decodecdb(char **tokens) { int sz = 0; char *range[2]; if (!tokens) return -1; mprintf("VIRUS NAME: %s\n", tokens[0]); mprintf("CONTAINER TYPE: %s\n", (strcmp(tokens[1], "*") ? tokens[1] : "ANY")); mprintf("CONTAINER SIZE: "); if (!cli_isnumber(tokens[2])) { if (!strcmp(tokens[2], "*")) { mprintf("ANY\n"); } else if (strchr(tokens[2], '-')) { sz = cli_strtokenize(tokens[2], '-', 2 + 1, (const char **)range); if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) { mprintf("!decodesig: Invalid container size range\n"); return -1; } mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]); } else { mprintf("!decodesig: Invalid container size\n"); return -1; } } else { mprintf("%s\n", tokens[2]); } mprintf("FILENAME REGEX: %s\n", tokens[3]); mprintf("COMPRESSED FILESIZE: "); if (!cli_isnumber(tokens[4])) { if (!strcmp(tokens[4], "*")) { mprintf("ANY\n"); } else if (strchr(tokens[4], '-')) { sz = cli_strtokenize(tokens[4], '-', 2 + 1, (const char **)range); if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) { mprintf("!decodesig: Invalid container size range\n"); return -1; } mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]); } else { mprintf("!decodesig: Invalid compressed filesize\n"); return -1; } } else { mprintf("%s\n", tokens[4]); } mprintf("UNCOMPRESSED FILESIZE: "); if (!cli_isnumber(tokens[5])) { if (!strcmp(tokens[5], "*")) { mprintf("ANY\n"); } else if (strchr(tokens[5], '-')) { sz = cli_strtokenize(tokens[5], '-', 2 + 1, (const char **)range); if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) { mprintf("!decodesig: Invalid container size range\n"); return -1; } mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]); } else { mprintf("!decodesig: Invalid uncompressed filesize\n"); return -1; } } else { mprintf("%s\n", tokens[5]); } mprintf("ENCRYPTION: "); if (!cli_isnumber(tokens[6])) { if (!strcmp(tokens[6], "*")) { mprintf("IGNORED\n"); } else { mprintf("!decodesig: Invalid encryption flag\n"); return -1; } } else { mprintf("%s\n", (atoi(tokens[6]) ? "YES" : "NO")); } mprintf("FILE POSITION: "); if (!cli_isnumber(tokens[7])) { if (!strcmp(tokens[7], "*")) { mprintf("ANY\n"); } else if (strchr(tokens[7], '-')) { sz = cli_strtokenize(tokens[7], '-', 2 + 1, (const char **)range); if (sz != 2 || !cli_isnumber(range[0]) || !cli_isnumber(range[1])) { mprintf("!decodesig: Invalid container size range\n"); return -1; } mprintf("WITHIN RANGE %s to %s\n", range[0], range[1]); } else { mprintf("!decodesig: Invalid file position\n"); return -1; } } else { mprintf("%s\n", tokens[7]); } if (!strcmp(tokens[1], "CL_TYPE_ZIP") || !strcmp(tokens[1], "CL_TYPE_RAR")) { if (!strcmp(tokens[8], "*")) { mprintf("CRC SUM: ANY\n"); } else { errno = 0; sz = (int)strtol(tokens[8], NULL, 16); if (!sz && errno) { mprintf("!decodesig: Invalid cyclic redundancy check sum\n"); return -1; } else { mprintf("CRC SUM: %d\n", sz); } } } return 0; } static int decodeftm(char **tokens, int tokens_count) { mprintf("FILE TYPE NAME: %s\n", tokens[3]); mprintf("FILE SIGNATURE TYPE: %s\n", tokens[0]); mprintf("FILE MAGIC OFFSET: %s\n", tokens[1]); mprintf("FILE MAGIC HEX: %s\n", tokens[2]); mprintf("FILE MAGIC DECODED:\n"); decodehex(tokens[2]); mprintf("FILE TYPE REQUIRED: %s\n", tokens[4]); mprintf("FILE TYPE DETECTED: %s\n", tokens[5]); if (tokens_count == 7) mprintf("FTM FLEVEL: >=%s\n", tokens[6]); else if (tokens_count == 8) mprintf("FTM FLEVEL: %s..%s\n", tokens[6], tokens[7]); return 0; } static int decodesig(char *sig, int fd) { char *pt; char *tokens[68], *subtokens[4], *subhex; int tokens_count, subtokens_count, subsigs, i, bc = 0; if (*sig == '[') { if (!(pt = strchr(sig, ']'))) { mprintf("!decodesig: Invalid input\n"); return -1; } sig = &pt[2]; } if (strchr(sig, ';')) { /* lsig */ tokens_count = cli_ldbtokenize(sig, ';', 67 + 1, (const char **)tokens, 2); if (tokens_count < 4) { mprintf("!decodesig: Invalid or not supported signature format\n"); return -1; } mprintf("VIRUS NAME: %s\n", tokens[0]); if (strlen(tokens[0]) && strstr(tokens[0], ".{") && tokens[0][strlen(tokens[0]) - 1] == '}') bc = 1; mprintf("TDB: %s\n", tokens[1]); mprintf("LOGICAL EXPRESSION: %s\n", tokens[2]); subsigs = cli_ac_chklsig(tokens[2], tokens[2] + strlen(tokens[2]), NULL, NULL, NULL, 1); if (subsigs == -1) { mprintf("!decodesig: Broken logical expression\n"); return -1; } subsigs++; if (subsigs > 64) { mprintf("!decodesig: Too many subsignatures\n"); return -1; } if (!bc && subsigs != tokens_count - 3) { mprintf("!decodesig: The number of subsignatures (==%u) doesn't match the IDs in the logical expression (==%u)\n", tokens_count - 3, subsigs); return -1; } for (i = 0; i < tokens_count - 3; i++) { if (i >= subsigs) mprintf(" * BYTECODE SUBSIG\n"); else mprintf(" * SUBSIG ID %d\n", i); subtokens_count = cli_ldbtokenize(tokens[3 + i], ':', 4, (const char **)subtokens, 0); if (!subtokens_count) { mprintf("!decodesig: Invalid or not supported subsignature format\n"); return -1; } if ((subtokens_count % 2) == 0) mprintf(" +-> OFFSET: %s\n", subtokens[0]); else mprintf(" +-> OFFSET: ANY\n"); if (subtokens_count == 3) { mprintf(" +-> SIGMOD:"); decodesigmod(subtokens[2]); } else if (subtokens_count == 4) { mprintf(" +-> SIGMOD:"); decodesigmod(subtokens[3]); } else { mprintf(" +-> SIGMOD: NONE\n"); } subhex = (subtokens_count % 2) ? subtokens[0] : subtokens[1]; if (fd == -1) { mprintf(" +-> DECODED SUBSIGNATURE:\n"); decodehex(subhex); } else { mprintf(" +-> "); matchsig(subhex, subhex, fd); } } } else if (strchr(sig, ':')) { /* ndb or cdb or ftm*/ tokens_count = cli_strtokenize(sig, ':', 12 + 1, (const char **)tokens); if (tokens_count > 9 && tokens_count < 13) { /* cdb*/ return decodecdb(tokens); } if (tokens_count > 5 && tokens_count < 9) { /* ftm */ long ftmsigtype; char *end; ftmsigtype = strtol(tokens[0], &end, 10); if (end == tokens[0] + 1 && (ftmsigtype == 0 || ftmsigtype == 1 || ftmsigtype == 4)) return decodeftm(tokens, tokens_count); } if (tokens_count < 4 || tokens_count > 6) { mprintf("!decodesig: Invalid or not supported signature format\n"); mprintf("TOKENS COUNT: %u\n", tokens_count); return -1; } mprintf("VIRUS NAME: %s\n", tokens[0]); if (tokens_count == 5) mprintf("FUNCTIONALITY LEVEL: >=%s\n", tokens[4]); else if (tokens_count == 6) mprintf("FUNCTIONALITY LEVEL: %s..%s\n", tokens[4], tokens[5]); if (!cli_isnumber(tokens[1])) { mprintf("!decodesig: Invalid target type\n"); return -1; } mprintf("TARGET TYPE: "); switch (atoi(tokens[1])) { case 0: mprintf("ANY FILE\n"); break; case 1: mprintf("PE\n"); break; case 2: mprintf("OLE2\n"); break; case 3: mprintf("HTML\n"); break; case 4: mprintf("MAIL\n"); break; case 5: mprintf("GRAPHICS\n"); break; case 6: mprintf("ELF\n"); break; case 7: mprintf("NORMALIZED ASCII TEXT\n"); break; case 8: mprintf("DISASM DATA\n"); break; case 9: mprintf("MACHO\n"); break; case 10: mprintf("PDF\n"); break; case 11: mprintf("FLASH\n"); break; case 12: mprintf("JAVA CLASS\n"); break; default: mprintf("!decodesig: Invalid target type\n"); return -1; } mprintf("OFFSET: %s\n", tokens[2]); if (fd == -1) { mprintf("DECODED SIGNATURE:\n"); decodehex(tokens[3]); } else { matchsig(tokens[3], strcmp(tokens[2], "*") ? tokens[2] : NULL, fd); } } else if ((pt = strchr(sig, '='))) { *pt++ = 0; mprintf("VIRUS NAME: %s\n", sig); if (fd == -1) { mprintf("DECODED SIGNATURE:\n"); decodehex(pt); } else { matchsig(pt, NULL, fd); } } else { mprintf("decodesig: Not supported signature format\n"); return -1; } return 0; } static int decodesigs(void) { char buffer[32769]; fflush(stdin); while (fgets(buffer, sizeof(buffer), stdin)) { cli_chomp(buffer); if (!strlen(buffer)) break; if (decodesig(buffer, -1) == -1) return -1; } return 0; } static int testsigs(const struct optstruct *opts) { char buffer[32769]; FILE *sigs; int ret = 0, fd; if (!opts->filename) { mprintf("!--test-sigs requires two arguments\n"); return -1; } sigs = fopen(optget(opts, "test-sigs")->strarg, "rb"); if (!sigs) { mprintf("!testsigs: Can't open file %s\n", optget(opts, "test-sigs")->strarg); return -1; } fd = open(opts->filename[0], O_RDONLY | O_BINARY); if (fd == -1) { mprintf("!testsigs: Can't open file %s\n", optget(opts, "test-sigs")->strarg); fclose(sigs); return -1; } while (fgets(buffer, sizeof(buffer), sigs)) { cli_chomp(buffer); if (!strlen(buffer)) break; if (decodesig(buffer, fd) == -1) { ret = -1; break; } } close(fd); fclose(sigs); return ret; } static int diffdirs(const char *old, const char *new, const char *patch) { FILE *diff; DIR *dd; struct dirent *dent; char cwd[512], path[1024]; if (!getcwd(cwd, sizeof(cwd))) { mprintf("!diffdirs: getcwd() failed\n"); return -1; } if (!(diff = fopen(patch, "wb"))) { mprintf("!diffdirs: Can't open %s for writing\n", patch); return -1; } if (chdir(new) == -1) { mprintf("!diffdirs: Can't chdir to %s\n", new); fclose(diff); return -1; } if ((dd = opendir(new)) == NULL) { mprintf("!diffdirs: Can't open directory %s\n", new); fclose(diff); return -1; } while ((dent = readdir(dd))) { if (dent->d_ino) { if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, "..")) continue; snprintf(path, sizeof(path), "%s" PATHSEP "%s", old, dent->d_name); if (compare(path, dent->d_name, diff) == -1) { if (chdir(cwd) == -1) mprintf("^diffdirs: Can't chdir to %s\n", cwd); fclose(diff); unlink(patch); closedir(dd); return -1; } } } closedir(dd); /* check for removed files */ if ((dd = opendir(old)) == NULL) { mprintf("!diffdirs: Can't open directory %s\n", old); fclose(diff); return -1; } while ((dent = readdir(dd))) { if (dent->d_ino) { if (!strcmp(dent->d_name, ".") || !strcmp(dent->d_name, "..")) continue; snprintf(path, sizeof(path), "%s" PATHSEP "%s", new, dent->d_name); if (access(path, R_OK)) fprintf(diff, "UNLINK %s\n", dent->d_name); } } closedir(dd); fclose(diff); mprintf("Generated diff file %s\n", patch); if (chdir(cwd) == -1) mprintf("^diffdirs: Can't chdir to %s\n", cwd); return 0; } static int makediff(const struct optstruct *opts) { char *odir, *ndir, name[32], broken[32], dbname[32]; struct cl_cvd *cvd; unsigned int oldver, newver; int ret; if (!opts->filename) { mprintf("!makediff: --diff requires two arguments\n"); return -1; } if (!(cvd = cl_cvdhead(opts->filename[0]))) { mprintf("!makediff: Can't read CVD header from %s\n", opts->filename[0]); return -1; } newver = cvd->version; free(cvd); if (!(cvd = cl_cvdhead(optget(opts, "diff")->strarg))) { mprintf("!makediff: Can't read CVD header from %s\n", optget(opts, "diff")->strarg); return -1; } oldver = cvd->version; free(cvd); if (oldver + 1 != newver) { mprintf("!makediff: The old CVD must be %u\n", newver - 1); return -1; } odir = cli_gentemp(NULL); if (!odir) { mprintf("!makediff: Can't generate temporary name for odir\n"); return -1; } if (mkdir(odir, 0700) == -1) { mprintf("!makediff: Can't create directory %s\n", odir); free(odir); return -1; } if (cli_cvdunpack(optget(opts, "diff")->strarg, odir) == -1) { mprintf("!makediff: Can't unpack CVD file %s\n", optget(opts, "diff")->strarg); cli_rmdirs(odir); free(odir); return -1; } ndir = cli_gentemp(NULL); if (!ndir) { mprintf("!makediff: Can't generate temporary name for ndir\n"); cli_rmdirs(odir); free(odir); return -1; } if (mkdir(ndir, 0700) == -1) { mprintf("!makediff: Can't create directory %s\n", ndir); free(ndir); cli_rmdirs(odir); free(odir); return -1; } if (cli_cvdunpack(opts->filename[0], ndir) == -1) { mprintf("!makediff: Can't unpack CVD file %s\n", opts->filename[0]); cli_rmdirs(odir); cli_rmdirs(ndir); free(odir); free(ndir); return -1; } snprintf(name, sizeof(name), "%s-%u.script", getdbname(opts->filename[0], dbname, sizeof(dbname)), newver); ret = diffdirs(odir, ndir, name); cli_rmdirs(odir); cli_rmdirs(ndir); free(odir); free(ndir); if (ret == -1) return -1; if (verifydiff(name, optget(opts, "diff")->strarg, NULL) == -1) { snprintf(broken, sizeof(broken), "%s.broken", name); if (rename(name, broken)) { unlink(name); mprintf("!Generated file is incorrect, removed"); } else { mprintf("!Generated file is incorrect, renamed to %s\n", broken); } return -1; } return 0; } static int dumpcerts(const struct optstruct *opts) { char *filename = NULL; STATBUF sb; struct cl_engine *engine; cli_ctx ctx; struct cl_scan_options options; int fd; cl_error_t ret; logg_file = NULL; filename = optget(opts, "print-certs")->strarg; if (!filename) { mprintf("!dumpcerts: No filename!\n"); return -1; } /* build engine */ if (!(engine = cl_engine_new())) { mprintf("!dumpcerts: Can't create new engine\n"); return -1; } cl_engine_set_num(engine, CL_ENGINE_AC_ONLY, 1); if (cli_initroots(engine, 0) != CL_SUCCESS) { mprintf("!dumpcerts: cli_initroots() failed\n"); cl_engine_free(engine); return -1; } if (cli_parse_add(engine->root[0], "test", "deadbeef", 0, 0, 0, "*", 0, NULL, 0) != CL_SUCCESS) { mprintf("!dumpcerts: Can't parse signature\n"); cl_engine_free(engine); return -1; } if (cl_engine_compile(engine) != CL_SUCCESS) { mprintf("!dumpcerts: Can't compile engine\n"); cl_engine_free(engine); return -1; } cl_engine_set_num(engine, CL_ENGINE_PE_DUMPCERTS, 1); cl_debug(); /* prepare context */ memset(&ctx, '\0', sizeof(cli_ctx)); memset(&options, 0, sizeof(struct cl_scan_options)); ctx.engine = engine; ctx.options = &options; ctx.options->parse = ~0; ctx.containers = cli_calloc(sizeof(cli_ctx_container), engine->maxreclevel + 2); if (!ctx.containers) { cl_engine_free(engine); return -1; } ctx.containers[0].type = CL_TYPE_ANY; ctx.dconf = (struct cli_dconf *)engine->dconf; ctx.fmap = calloc(sizeof(fmap_t *), 1); if (!ctx.fmap) { free(ctx.containers); cl_engine_free(engine); return -1; } /* Prepare file */ fd = open(filename, O_RDONLY); if (fd < 0) { mprintf("!dumpcerts: Can't open file %s!\n", filename); free(ctx.containers); free(ctx.fmap); cl_engine_free(engine); return -1; } lseek(fd, 0, SEEK_SET); FSTAT(fd, &sb); if (!(*ctx.fmap = fmap(fd, 0, sb.st_size))) { free(ctx.containers); free(ctx.fmap); close(fd); cl_engine_free(engine); return -1; } ret = cli_check_auth_header(&ctx, NULL); switch (ret) { case CL_VERIFIED: case CL_VIRUS: // These shouldn't happen, since sigtool doesn't load in any sigs break; case CL_EVERIFY: // The Authenticode header was parsed successfully but there were // no applicable whitelist/blacklist rules break; case CL_BREAK: mprintf("*dumpcerts: No Authenticode signature detected\n"); break; case CL_EFORMAT: mprintf("!dumpcerts: An error occurred when parsing the file\n"); break; default: mprintf("!dumpcerts: Other error %d inside cli_check_auth_header.\n", ret); break; } /* Cleanup */ free(ctx.containers); funmap(*ctx.fmap); free(ctx.fmap); close(fd); cl_engine_free(engine); return 0; } static void help(void) { mprintf("\n"); mprintf(" Clam AntiVirus: Signature Tool %s\n", get_version()); mprintf(" By The ClamAV Team: https://www.clamav.net/about.html#credits\n"); mprintf(" (C) 2019 Cisco Systems, Inc.\n"); mprintf("\n"); mprintf(" sigtool [options]\n"); mprintf("\n"); mprintf(" --help -h Show this help\n"); mprintf(" --version -V Print version number and exit\n"); mprintf(" --quiet Be quiet, output only error messages\n"); mprintf(" --debug Enable debug messages\n"); mprintf(" --stdout Write to stdout instead of stderr. Does not affect 'debug' messages.\n"); mprintf(" --hex-dump Convert data from stdin to a hex\n"); mprintf(" string and print it on stdout\n"); mprintf(" --md5 [FILES] Generate MD5 checksum from stdin\n"); mprintf(" or MD5 sigs for FILES\n"); mprintf(" --sha1 [FILES] Generate SHA1 checksum from stdin\n"); mprintf(" or SHA1 sigs for FILES\n"); mprintf(" --sha256 [FILES] Generate SHA256 checksum from stdin\n"); mprintf(" or SHA256 sigs for FILES\n"); mprintf(" --mdb [FILES] Generate .mdb (section hash) sigs\n"); mprintf(" --imp [FILES] Generate .imp (import table hash) sigs\n"); mprintf(" --html-normalise=FILE Create normalised parts of HTML file\n"); mprintf(" --ascii-normalise=FILE Create normalised text file from ascii source\n"); mprintf(" --utf16-decode=FILE Decode UTF16 encoded files\n"); mprintf(" --info=FILE -i FILE Print database information\n"); mprintf(" --build=NAME [cvd] -b NAME Build a CVD file\n"); mprintf(" --max-bad-sigs=NUMBER Maximum number of mismatched signatures\n"); mprintf(" When building a CVD. Default: 3000\n"); mprintf(" --flevel=FLEVEL Specify a custom flevel.\n"); mprintf(" Default: %u\n", cl_retflevel()); mprintf(" --cvd-version=NUMBER Specify the version number to use for\n"); mprintf(" the build. Default is to use the value+1\n"); mprintf(" from the current CVD in --datadir.\n"); mprintf(" If no datafile is found the default\n"); mprintf(" behaviour is to prompt for a version\n"); mprintf(" number, this switch will prevent the\n"); mprintf(" prompt. NOTE: If a CVD is found in the\n"); mprintf(" --datadir its version+1 is used and\n"); mprintf(" this value is ignored.\n"); mprintf(" --no-cdiff Don't generate .cdiff file\n"); mprintf(" --unsigned Create unsigned database file (.cud)\n"); mprintf(" --hybrid Create a hybrid (standard and bytecode) database file\n"); mprintf(" --print-certs=FILE Print Authenticode details from a PE\n"); mprintf(" --server=ADDR ClamAV Signing Service address\n"); mprintf(" --datadir=DIR Use DIR as default database directory\n"); mprintf(" --unpack=FILE -u FILE Unpack a CVD/CLD file\n"); mprintf(" --unpack-current=SHORTNAME Unpack local CVD/CLD into cwd\n"); mprintf(" --list-sigs[=FILE] -l[FILE] List signature names\n"); mprintf(" --find-sigs=REGEX -fREGEX Find signatures matching REGEX\n"); mprintf(" --decode-sigs Decode signatures from stdin\n"); mprintf(" --test-sigs=DATABASE TARGET_FILE Test signatures from DATABASE against \n"); mprintf(" TARGET_FILE\n"); mprintf(" --vba=FILE Extract VBA/Word6 macro code\n"); mprintf(" --vba-hex=FILE Extract Word6 macro code with hex values\n"); mprintf(" --diff=OLD NEW -d OLD NEW Create diff for OLD and NEW CVDs\n"); mprintf(" --compare=OLD NEW -c OLD NEW Show diff between OLD and NEW files in\n"); mprintf(" cdiff format\n"); mprintf(" --run-cdiff=FILE -r FILE Execute update script FILE in cwd\n"); mprintf(" --verify-cdiff=DIFF CVD/CLD Verify DIFF against CVD/CLD\n"); mprintf("\n"); return; } int main(int argc, char **argv) { int ret; struct optstruct *opts; STATBUF sb; if (check_flevel()) exit(1); if ((ret = cl_init(CL_INIT_DEFAULT)) != CL_SUCCESS) { mprintf("!Can't initialize libclamav: %s\n", cl_strerror(ret)); return -1; } ret = 1; opts = optparse(NULL, argc, argv, 1, OPT_SIGTOOL, 0, NULL); if (!opts) { mprintf("!Can't parse command line options\n"); return 1; } if (optget(opts, "quiet")->enabled) mprintf_quiet = 1; if (optget(opts, "stdout")->enabled) mprintf_stdout = 1; if (optget(opts, "debug")->enabled) cl_debug(); if (optget(opts, "version")->enabled) { print_version(NULL); optfree(opts); return 0; } if (optget(opts, "help")->enabled) { optfree(opts); help(); return 0; } if (optget(opts, "hex-dump")->enabled) ret = hexdump(); else if (optget(opts, "md5")->enabled) ret = hashsig(opts, 0, 1); else if (optget(opts, "sha1")->enabled) ret = hashsig(opts, 0, 2); else if (optget(opts, "sha256")->enabled) ret = hashsig(opts, 0, 3); else if (optget(opts, "mdb")->enabled) ret = hashsig(opts, 1, 1); else if (optget(opts, "imp")->enabled) ret = hashsig(opts, 2, 1); else if (optget(opts, "html-normalise")->enabled) ret = htmlnorm(opts); else if (optget(opts, "ascii-normalise")->enabled) ret = asciinorm(opts); else if (optget(opts, "utf16-decode")->enabled) ret = utf16decode(opts); else if (optget(opts, "build")->enabled) ret = build(opts); else if (optget(opts, "unpack")->enabled) ret = unpack(opts); else if (optget(opts, "unpack-current")->enabled) ret = unpack(opts); else if (optget(opts, "info")->enabled) ret = cvdinfo(opts); else if (optget(opts, "list-sigs")->active) ret = listsigs(opts, 0); else if (optget(opts, "find-sigs")->active) ret = listsigs(opts, 1); else if (optget(opts, "decode-sigs")->active) ret = decodesigs(); else if (optget(opts, "test-sigs")->enabled) ret = testsigs(opts); else if (optget(opts, "vba")->enabled || optget(opts, "vba-hex")->enabled) ret = vbadump(opts); else if (optget(opts, "diff")->enabled) ret = makediff(opts); else if (optget(opts, "compare")->enabled) ret = compareone(opts); else if (optget(opts, "print-certs")->enabled) ret = dumpcerts(opts); else if (optget(opts, "run-cdiff")->enabled) ret = rundiff(opts); else if (optget(opts, "verify-cdiff")->enabled) { if (!opts->filename) { mprintf("!--verify-cdiff requires two arguments\n"); ret = -1; } else { if (CLAMSTAT(opts->filename[0], &sb) == -1) { mprintf("--verify-cdiff: Can't get status of %s\n", opts->filename[0]); ret = -1; } else { if (S_ISDIR(sb.st_mode)) ret = verifydiff(optget(opts, "verify-cdiff")->strarg, NULL, opts->filename[0]); else ret = verifydiff(optget(opts, "verify-cdiff")->strarg, opts->filename[0], NULL); } } } else help(); optfree(opts); return ret ? 1 : 0; }