Commit graph

632 commits

Author SHA1 Message Date
Steven Morgan
312b7e5391 bb11522 - enable clamscan option --blockmax to flag files as virus Heuristic.Limits.Exceeded when --max-filesize, --max-scansize, or --max-recursion is exceeded. 2016-08-24 17:39:20 -04:00
Kevin Lin
dbd2653d83 bb#11613 - dump vba project data to file with leave-temps 2016-07-26 16:39:40 -04:00
Kevin Lin
984f90ca4f bb#11587 - track linked bcs on matchers for target 7 normalization 2016-06-28 15:19:50 -04:00
Steven Morgan
f5bc94cf01 bb11549 - fix temp file cleanup issue. 2016-06-09 14:08:56 -04:00
Steven Morgan
7a307529d8 bb11580 - make cli_matchmeta() respect allmatch. 2016-06-08 16:25:34 -04:00
Steven Morgan
ce6becd511 bb11471 - add clamscan parameter --normalize=no for yara compatibility. 2016-06-02 18:09:25 -04:00
Kevin Lin
8e58605338 jsonapi: add object ownership manipulation and deletion 2016-05-26 17:05:35 -04:00
Kevin Lin
05f58cfa89 add mhtml files to preclass set 2016-05-26 17:05:35 -04:00
Kevin Lin
ef48d7cbeb MHTML: added filetype and switch case 2016-05-26 17:05:35 -04:00
Kevin Lin
09b1357a6a preclass: scanning condition includes ac_patterns and pcre_metas 2016-05-17 16:44:21 -04:00
Kevin Lin
0183d24245 bb#11514 - initialize ARJ metadata structures 2016-03-10 16:08:04 -05:00
Kevin Lin
9f8539db4f whitespace fix 2016-03-01 12:33:54 -05:00
Kevin Lin
ea9ffd291b add scanning options for scanning xml-based documents (MSXML, OOXML, HWPML) and HWP3 2016-02-02 14:23:19 -05:00
Kevin Lin
21f6478f26 add dconfs for XDP, MBR, GPT, APM, OOXML, MSXML, and HWP formats 2016-02-02 12:58:22 -05:00
Steven Morgan
433c3bb410 bb11466 - let html be scanned raw when --scan-html=no is in effect. 2016-01-12 17:20:26 -05:00
Kevin Lin
c6f7be5536 ooxml_hwp: add support for filetyping and preclassification 2015-12-17 16:18:17 -05:00
Kevin Lin
6cd5a9dc4e hwpole2: new filetype and handler for hwp embedded ole2 files 2015-12-17 16:18:17 -05:00
Kevin Lin
d2eea44a6d HWPML: added hwpml_keys for hwpml parsing 2015-12-16 16:16:01 -05:00
Kevin Lin
9103b7e984 various name changes and dereference fix 2015-12-09 10:41:53 -05:00
Steven Morgan
7d4213a729 bb11420 - fix preclass/cache interaction. 2015-11-04 14:46:46 -05:00
Steven Morgan
881d6f349f bb11419 - fix valgrind-detected uninitialized value when caching is disabled. 2015-10-30 13:34:56 -04:00
Steven Morgan
1f1bf36b8e Add 'virus found' callback. Refactor scan-all API. 2015-10-01 17:47:37 -04:00
Steven Morgan
5f1ada67a3 Change preclass signature warning message to debug level. 2015-09-21 12:07:19 -04:00
Mickey Sola
46a35abe56 mass update of copyright headers 2015-09-17 13:41:26 -04:00
Steven Morgan
d4742bb19e Move code for Windows compile. 2015-09-01 13:42:53 -04:00
Steven Morgan
5e608548b0 remove development testing code. 2015-08-28 13:25:19 -04:00
Steven Morgan
f7106b36f6 make retcode passed to post-scan callback to be CL_VIRUS when an heuristic virus was detected. 2015-08-24 15:20:30 -04:00
Steven Morgan
09994378a5 Fix for NULL virus name passed to post scan callback for heuristic viruses. 2015-08-21 14:35:43 -04:00
Kevin Lin
059e90fcb4 tiff: added heuristic check for invalid tiff IFD fields 2015-07-30 17:37:05 -04:00
Kevin Lin
1e3e56e702 bb#11196 - autoit script file misclassified as HTML 2015-07-28 13:44:41 -04:00
Kevin Lin
e7b3198df2 bb#9858 - added target 14 for binary (unidentified) files 2015-07-23 16:37:15 -04:00
Mickey Sola
dabc8c316e bb11219: Fixing scanscript to scan on a normalized map when using relative offsets with type 7 signatures. 2015-07-09 15:36:24 -04:00
Kevin Lin
83ffa06712 Merge branch 'master' into features/yara 2015-06-09 15:13:48 -04:00
Mickey Sola
3842442004 bb-11149: Fixing bzip2 scan to cease scanning after reaching max filesize. 2015-06-04 17:14:26 -04:00
Kevin Lin
e267652d6d Revert "removed offset 0 limitation on cli_scanraw (revert change from 0.95.2)"
This reverts commit 7600b5cf6b.
2015-06-03 15:29:13 -04:00
Kevin Lin
7600b5cf6b removed offset 0 limitation on cli_scanraw (revert change from 0.95.2) 2015-06-01 17:58:39 -04:00
Steven Morgan
8bbaf7f9e5 Revert "bb11092: fix up printf format with LFS using patch by Sebastian Andrzej Siewior."
- Unit test failing and no windows support.

This reverts commit 8f50c4a179.
2015-05-11 19:10:45 -04:00
Steven Morgan
8f50c4a179 bb11092: fix up printf format with LFS using patch by Sebastian Andrzej Siewior. 2015-05-11 16:25:39 -04:00
Steven Morgan
a80453e6e9 Merge master to features/yara. 2015-05-01 18:36:48 -04:00
Kevin Lin
20a3b53b6c converted cb_file_props from using engine-based ctx to file-based ctx 2015-03-27 13:21:49 -04:00
Kevin Lin
56895e2595 added CL_TYPE_XML_WORD and CL_TYPE_XML_XL to preclass set 2015-03-12 13:46:59 -04:00
Kevin Lin
4823482e9d added basic framework for msxml processing 2015-03-10 15:42:02 -04:00
Kevin Lin
514dfa1e96 backwards compatibility for target type 13 json scanning 2015-03-04 12:08:55 -05:00
Steven Morgan
9de400559d refactor and simplify cli_lsig_eval, add new function cli_exp_eval to loop thru the lsig table and call either lsig_eval or yara_eval. 2015-03-03 19:25:13 -05:00
Kevin Lin
116169833d generates fmap from desc if no map is NULL 2015-03-03 17:47:55 -05:00
Kevin Lin
47c2d618cd added BC_PRECLASS hook support; replaces target type 13 2015-03-03 15:00:55 -05:00
Kevin Lin
f66533de48 fixed an incorrect return value for magic_scandesc 2015-01-15 15:15:01 -08:00
Kevin Lin
f82b5e3e2e engine bb#12710 - added missing break statements 2014-12-12 14:33:41 -05:00
Kevin Lin
93a9a942f7 ooxml: fixed a number of potential memory issues 2014-11-25 13:29:39 -05:00
Kevin Lin
a2e6dcee33 bb#11208 - added engine limit checks to ooxml parsing 2014-11-25 12:06:55 -05:00