1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
/*
* Copyright (C) 2015 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2007-2013 Sourcefire, Inc.
*
* Authors: Tomasz Kojm
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
#ifndef __FILETYPES_H
#define __FILETYPES_H
#include <sys/types.h>
#include "clamav.h"
#include "cltypes.h"
#include "fmap.h"
#define CL_FILE_MBUFF_SIZE 1024
#define CL_PART_MBUFF_SIZE 1028
/* MAGIC_BUFFER_SIZE must be the bigger of the two sizes above */
#define MAGIC_BUFFER_SIZE 1028
#define CL_TYPENO 500
#define MAX_EMBEDDED_OBJ 10
typedef enum {
CL_TYPE_ANY = 0,
CL_TYPE_TEXT_ASCII = CL_TYPENO, /* X3.4, ISO-8859, non-ISO ext. ASCII */
CL_TYPE_TEXT_UTF8,
CL_TYPE_TEXT_UTF16LE,
CL_TYPE_TEXT_UTF16BE,
CL_TYPE_BINARY_DATA,
/* Please do not add any new types above this line */
CL_TYPE_ERROR,
CL_TYPE_MSEXE,
CL_TYPE_ELF,
CL_TYPE_MACHO,
CL_TYPE_MACHO_UNIBIN,
CL_TYPE_POSIX_TAR,
CL_TYPE_OLD_TAR,
CL_TYPE_CPIO_OLD,
CL_TYPE_CPIO_ODC,
CL_TYPE_CPIO_NEWC,
CL_TYPE_CPIO_CRC,
CL_TYPE_GZ,
CL_TYPE_ZIP,
CL_TYPE_BZ,
CL_TYPE_RAR,
CL_TYPE_ARJ,
CL_TYPE_MSSZDD,
CL_TYPE_MSOLE2,
CL_TYPE_MSCAB,
CL_TYPE_MSCHM,
CL_TYPE_SIS,
CL_TYPE_SCRENC,
CL_TYPE_GRAPHICS,
CL_TYPE_RIFF,
CL_TYPE_BINHEX,
CL_TYPE_TNEF,
CL_TYPE_CRYPTFF,
CL_TYPE_PDF,
CL_TYPE_UUENCODED,
CL_TYPE_SCRIPT,
CL_TYPE_HTML_UTF16,
CL_TYPE_RTF,
CL_TYPE_7Z,
CL_TYPE_SWF,
CL_TYPE_JAVA,
CL_TYPE_XAR,
CL_TYPE_XZ,
CL_TYPE_OOXML_WORD,
CL_TYPE_OOXML_PPT,
CL_TYPE_OOXML_XL,
CL_TYPE_INTERNAL,
/* Section for partition types */
CL_TYPE_PART_ANY, /* unknown partition type */
CL_TYPE_PART_HFSPLUS,
/* bigger numbers have higher priority (in o-t-f detection) */
CL_TYPE_MBR,
CL_TYPE_HTML, /* on the fly */
CL_TYPE_MAIL, /* magic + on the fly */
CL_TYPE_SFX, /* foo SFX marker */
CL_TYPE_ZIPSFX, /* on the fly */
CL_TYPE_RARSFX, /* on the fly */
CL_TYPE_7ZSFX,
CL_TYPE_CABSFX,
CL_TYPE_ARJSFX,
CL_TYPE_NULSFT, /* on the fly */
CL_TYPE_AUTOIT,
CL_TYPE_ISHIELD_MSI,
CL_TYPE_ISO9660,
CL_TYPE_DMG,
CL_TYPE_GPT,
CL_TYPE_APM,
CL_TYPE_XDP,
CL_TYPE_XML_WORD,
CL_TYPE_XML_XL,
CL_TYPE_OTHER, /* on-the-fly, used for target 14 (OTHER) */
CL_TYPE_IGNORED /* please don't add anything below */
} cli_file_t;
struct cli_ftype {
cli_file_t type;
uint32_t offset;
unsigned char *magic;
char *tname;
struct cli_ftype *next;
uint16_t length;
};
struct cli_matched_type {
struct cli_matched_type *next;
off_t offset;
cli_file_t type;
unsigned short cnt;
};
cli_file_t cli_ftcode(const char *name);
const char *cli_ftname(cli_file_t code);
void cli_ftfree(const struct cl_engine *engine);
cli_file_t cli_filetype(const unsigned char *buf, size_t buflen, const struct cl_engine *engine);
cli_file_t cli_filetype2(fmap_t *map, const struct cl_engine *engine, cli_file_t basetype);
int cli_addtypesigs(struct cl_engine *engine);
#endif
|
