next up previous contents
Next: Compatible software Up: Usage Previous: Output format   Contents

Signature Tool

sigtool automates signature creation. If you have an infected file, which isn't detected by ClamAV, but it is by another anti-virus scanner working in the console, you can create the signature easily. Example of usage: Create a random file and put the test1 file content into it. We will use clamscan to generate the signature, it's just an example. Scan it with clamscan -stdout testfile, the output is
	testfile: ClamAV-Test-Signature FOUND

	----------- SCAN SUMMARY -----------
	Known viruses: 7734
	Scanned directories: 0
	Scanned files: 1
	Data scanned: 0.95 Mb
	Infected files: 1
	I/O buffer size: 131072 bytes
	Time: 0.245 sec (0 m 0 s)
The unique string in this output is "ClamAV-Test-Signature". Run sigtool with the following parameters:
	$ sigtool -c "clamscan --stdout" -f testfile -s "ClamAV-Test"
The program will concatenate arguments for -c (-command) and -f (-file), that's why the scanner's options must be given in the proper order. At the end it will generate a file testfile.sig, which should contain 100 bytes in our example. It contains the proper signature.
	...
	...
	Detected at 12103, moving backward.
	Detected at 11983, moving backward.
	Detected at 11923, moving backward.
	Not detected, increasing pos 11893 -> 11923
	Detected at 11923, moving backward.
	Not detected, increasing pos 11908 -> 11923
	Detected at 11923, moving backward.
	Not detected, increasing pos 11915 -> 11923
	Detected at 11923, moving backward.
	Detected at 11919, moving backward.
	Detected at 11917, moving backward.
	Detected at 11916, moving backward.
	Starting precise loop
	 *** Found signature end at 11916

	The scanner was executed 46 times.
	Signature length is 50, so length of hex string should be 100
	Saving signature in testfile.sig file.



Tomasz Kojm 2003-06-21