30 #define NULL (void*)0x0
32 #define force_inline inline __attribute__((always_inline))
33 #define overloadable_func __attribute__((overloadable))
36 #if defined(DOXYGEN) || __has_feature(attribute_overloadable)
45 static force_inline
void overloadable_func
debug(
const char * str)
57 static force_inline
void overloadable_func
debug(
const uint8_t* str)
69 static force_inline
void overloadable_func
debug(uint32_t a)
82 void debug(...) __attribute__((overloadable, unavailable));
92 #define VIRUSNAME_PREFIX(name) const char __clambc_virusname_prefix[] = name;
98 #define VIRUSNAMES(...) const char *const __clambc_virusnames[] = {__VA_ARGS__};
102 typedef struct signature {
111 #define PE_UNPACKER_DECLARE const uint16_t __clambc_kind = BC_PE_UNPACKER;
121 #define PDF_HOOK_DECLARE const uint16_t __clambc_kind = BC_PDF;
127 #define BYTECODE_ABORT_HOOK 0xcea5e
137 #define PE_HOOK_DECLARE const uint16_t __clambc_kind = BC_PE_ALL;
145 #define PRECLASS_HOOK_DECLARE const uint16_t __clambc_kind = BC_PRECLASS;
151 #define SIGNATURES_DECL_BEGIN \
152 struct __Signatures {
157 #define DECLARE_SIGNATURE(name) \
158 const char *name##_sig;\
164 #define SIGNATURES_DECL_END };
171 #define TARGET(tgt) const unsigned short __Target = (tgt);
178 #define COPYRIGHT(c) const char *const __Copyright = (c);
185 #define ICONGROUP1(group) const char *const __IconGroup1 = (group);
192 #define ICONGROUP2(group) const char *const __IconGroup2 = (group);
201 #define FUNCTIONALITY_LEVEL_MIN(m) const unsigned short __FuncMin = (m);
210 #define FUNCTIONALITY_LEVEL_MAX(m) const unsigned short __FuncMax = (m);
212 #define LDB_ADDATTRIBUTES(x) const char * __ldb_rawattrs = (x);
214 #define CONTAINER(x) const char * __ldb_container = (x);
223 #define SIGNATURES_DEF_BEGIN \
224 static const unsigned __signature_bias = __COUNTER__+1;\
225 const struct __Signatures Signatures = {\
233 #define DEFINE_SIGNATURE(name, hex) \
234 .name##_sig = (hex),\
235 .name = {__COUNTER__ - __signature_bias},
239 #define SIGNATURES_END };
245 #define SIGNATURES_DEF_END };
264 static force_inline uint32_t
matches(__Signature sig)\
281 if (pos <= 0) pos = 0;
300 const char *static_start,
306 int32_t cpos =
file_find_limit(static_start, static_len, pos + goback);
308 debug(
"Engine reported match, but we couldn't find it! Engine reported (after fixup):");
315 debug(
"wrong match pos reported by engine, real match pos:");
317 debug(
"reported by engine:");
319 debug(
"but goback fixed it up!");
331 static force_inline overloadable_func
void foundVirus(
const char *virusname)
336 #if defined(DOXYGEN) || __has_feature(attribute_overloadable)
357 } __attribute__((packed));
362 } __attribute__((packed));
380 bool __is_bigendian(
void) __attribute__((const)) __attribute__((nothrow));
394 uint32_t swapped = __builtin_bswap32(v);
410 uint32_t swapped = __builtin_bswap32(v);
423 uint64_t swapped = __builtin_bswap64(v);
436 uint64_t swapped = __builtin_bswap64(v);
449 uint16_t swapped = ((v & 0xff) << 8) | ((v >> 8) & 0xff);
462 uint16_t swapped = ((v & 0xff) << 8) | ((v >> 8) & 0xff);
474 uint32_t v = ((
const union unaligned_32 *)buff)->una_s32;
486 uint16_t v = ((
const union unaligned_16 *)buff)->una_s16;
498 ((
union unaligned_32 *)offset)->una_u32 =
le32_to_host(v);
523 #define NEED_PE_INFO { \
525 __fail_missing_PE_HOOK_DECLARE__or__PE_UNPACKER_DECLARE();\
1019 if (
read(name, 8) != 8)
1112 static force_inline
bool readRVA(uint32_t
rva,
void *buf,
size_t bufsize)
1120 if (
read(buf, bufsize) != bufsize) {
1139 static force_inline
void*
memchr(
const void* s,
int c,
size_t n)
1141 unsigned char cc = c;
1142 const char *end, *p = s;
1144 for (end=p+n; p < end; p++)
1158 void*
memset(
void *src,
int c, uintptr_t n) __attribute__((nothrow)) __attribute__((__nonnull__((1))));
1168 void *
memmove (
void *dst, const
void *src, uintptr_t n)
1169 __attribute__ ((__nothrow__)) __attribute__ ((__nonnull__ (1, 2)));
1179 void *
memcpy (
void *restrict dst, const
void *restrict src, uintptr_t n)
1180 __attribute__ ((__nothrow__)) __attribute__ ((__nonnull__ (1, 2)));
1191 int memcmp (const
void *s1, const
void *s2, uint32_t n)
1192 __attribute__ ((__nothrow__)) __attribute__ ((__pure__)) __attribute__ ((__nonnull__ (1, 2)));
1240 static force_inline uint32_t
1246 offset =
disasm_x86(&res, len <
sizeof(res) ? len :
sizeof(res));
1250 result->
segment = res.segment;
1266 uint64_t x =
cli_readint32((
const uint32_t*)&res.arg[i][6]);
1276 #define RE2C_BSIZE 1024
1278 unsigned char *cur, *lim, *mrk, *ctx, *eof, *tok;
1281 unsigned char buffer[RE2C_BSIZE];
1284 #define YYCTYPE unsigned char
1285 #define YYCURSOR re2c_scur
1286 #define YYLIMIT re2c_slim
1287 #define YYMARKER re2c_smrk
1288 #define YYCONTEXT re2c_sctx
1289 #define YYFILL(n) { \
1290 RE2C_FILLBUFFER(n);\
1291 if (re2c_sres <= 0) break;\
1294 #define REGEX_SCANNER unsigned char *re2c_scur, *re2c_stok, *re2c_smrk, *re2c_sctx, *re2c_slim;\
1295 int re2c_sres; int32_t re2c_stokstart;\
1296 unsigned char re2c_sbuffer[RE2C_BSIZE];\
1297 re2c_scur = re2c_slim = re2c_smrk = re2c_sctx = &re2c_sbuffer[0];\
1301 #define REGEX_POS (-(re2c_slim - re2c_scur) + seek(0, SEEK_CUR))
1302 #define REGEX_LOOP_BEGIN do { re2c_stok = re2c_scur; re2c_stokstart = REGEX_POS;} while (0);
1303 #define REGEX_RESULT (re2c_sres)
1305 #define RE2C_DEBUG_PRINT \
1308 uint32_t here = seek(0, SEEK_CUR);\
1309 uint32_t d = re2c_slim - re2c_scur;\
1310 uint32_t end = here - d;\
1311 unsigned len = end - re2c_stokstart;\
1313 unsigned skipped = len - 74;\
1314 seek(re2c_stokstart, SEEK_SET);\
1315 if (read(buf, 37) == 37)\
1317 memcpy(buf+37, "[...]", 5);\
1318 seek(end-37, SEEK_SET);\
1319 if (read(buf, 37) != 37)\
1323 seek(re2c_stokstart, SEEK_SET);\
1324 if (read(buf, len) != len)\
1329 debug_print_str(buf, 0);\
1330 seek(here, SEEK_SET);\
1333 #define DEBUG_PRINT_REGEX_MATCH RE2C_DEBUG_PRINT
1335 #define BUFFER_FILL(buf, cursor, need, limit) do {\
1336 (limit) = fill_buffer((buf), sizeof((buf)), (limit), (cursor), (need));\
1339 #define BUFFER_ENSURE(buf, cursor, need, limit) do {\
1340 if ((cursor) + (need) >= (limit)) {\
1341 BUFFER_FILL(buf, cursor, need, limit)\
1349 #define RE2C_FILLBUFFER(need) do {\
1350 uint32_t cursor = re2c_stok - &re2c_sbuffer[0];\
1351 int32_t limit = re2c_slim - &re2c_sbuffer[0];\
1352 limit = fill_buffer(re2c_sbuffer, sizeof(re2c_sbuffer), limit, (cursor), (need));\
1355 } else if (limit <= (need)) {\
1358 uint32_t curoff = re2c_scur - re2c_stok;\
1359 uint32_t mrkoff = re2c_smrk - re2c_stok;\
1360 uint32_t ctxoff = re2c_sctx - re2c_stok;\
1361 re2c_slim = &re2c_sbuffer[0] + limit;\
1362 re2c_stok = &re2c_sbuffer[0];\
1363 re2c_scur = &re2c_sbuffer[0] + curoff;\
1364 re2c_smrk = &re2c_sbuffer[0] + mrkoff;\
1365 re2c_sctx = &re2c_sbuffer[0] + ctxoff;\
1379 uint32_t c = a > b ? a : b;
1382 uint32_t scale = 2048/c;
1387 uint32_t scale = (c+2047) / 2048;
1392 return ilog_table[a] - ilog_table[b];
static force_inline uint32_t getPECheckSum(void)
Definition: bytecode_local.h:771
DIS_SIZE
Definition: bytecode_disasm.h:334
uint32_t PointerToSymbolTable
Definition: bytecode_pe.h:41
uint32_t SectionAlignment
Definition: bytecode_pe.h:108
Definition: bytecode_api.h:259
uint16_t MajorOperatingSystemVersion
Definition: bytecode_pe.h:73
static force_inline uint32_t matches(__Signature sig)
Definition: bytecode_local.h:264
Definition: bytecode_api.h:75
Definition: bytecode_local.h:1224
static force_inline uint32_t getPESizeOfHeaders(void)
Definition: bytecode_local.h:759
uint16_t nsections
Definition: bytecode_pe.h:161
struct pe_image_optional_hdr64 opt64
Definition: bytecode_pe.h:166
uint32_t SectionAlignment
Definition: bytecode_pe.h:71
static force_inline uint16_t getPESubsystem(void)
Definition: bytecode_local.h:783
Definition: bytecode_pe.h:98
uint32_t SizeOfUninitializedData
Definition: bytecode_pe.h:104
uint16_t MinorOperatingSystemVersion
Definition: bytecode_pe.h:111
DIS_ACCESS
Definition: bytecode_disasm.h:325
static force_inline uint32_t match_location(__Signature sig, uint32_t goback)
Definition: bytecode_local.h:275
enum DIS_SIZE address_size
Definition: bytecode_local.h:1227
static force_inline uint32_t getPEBaseOfCode(void)
Definition: bytecode_local.h:604
const uint32_t __clambc_match_counts[64]
This is a low-level variable, use the Macros in bytecode_local.h instead to access it...
uint32_t rva
Definition: bytecode_execs.h:40
static force_inline uint16_t getPEMinorSubsystemVersion(void)
Definition: bytecode_local.h:723
Definition: bytecode_api.h:58
uint32_t SizeOfUninitializedData
Definition: bytecode_pe.h:66
static uint16_t force_inline cli_readint16(const void *buff)
Definition: bytecode_local.h:484
static uint16_t force_inline le16_to_host(uint16_t v)
Definition: bytecode_local.h:447
static force_inline uint16_t getPESizeOfOptionalHeader()
Definition: bytecode_local.h:912
Definition: bytecode_local.h:1210
static force_inline bool getPEisDLL()
Definition: bytecode_local.h:936
static force_inline uint32_t getPEFileAlignment(void)
Definition: bytecode_local.h:652
static uint32_t force_inline cli_readint32(const void *buff)
Definition: bytecode_local.h:472
enum X86REGS scale_reg
Definition: bytecode_local.h:1200
enum X86REGS add_reg
Definition: bytecode_local.h:1201
static force_inline bool readRVA(uint32_t rva, void *buf, size_t bufsize)
Definition: bytecode_local.h:1112
static uint32_t getVirtualEntryPoint(void)
Definition: bytecode_local.h:1065
Definition: bytecode_pe.h:36
static force_inline bool hasPEInfo(void)
Definition: bytecode_local.h:517
uint32_t NumberOfSymbols
Definition: bytecode_pe.h:42
struct pe_image_optional_hdr32 opt32
Definition: bytecode_pe.h:164
static force_inline uint32_t getPESizeOfImage(void)
Definition: bytecode_local.h:747
struct DIS_arg arg[3]
Definition: bytecode_local.h:1229
uint32_t disasm_x86(struct DISASM_RESULT *result, uint32_t len)
static force_inline uint8_t getPEMajorLinkerVersion(void)
Definition: bytecode_local.h:544
uint16_t MajorOperatingSystemVersion
Definition: bytecode_pe.h:110
static force_inline uint32_t getPESizeOfInitializedData(void)
Definition: bytecode_local.h:580
uint32_t CheckSum
Definition: bytecode_pe.h:119
uint32_t vsz
Definition: bytecode_execs.h:41
int32_t get_pe_section(struct cli_exe_section *section, uint32_t num)
static force_inline uint32_t getPESizeOfUninitializedData(void)
Definition: bytecode_local.h:592
Definition: bytecode_pe.h:135
const uint16_t __clambc_kind
Definition: bytecode_api.h:233
uint32_t ep
Definition: bytecode_pe.h:160
uint8_t MinorLinkerVersion
Definition: bytecode_pe.h:63
static force_inline uint32_t getPESizeOfHeapReserve(void)
Definition: bytecode_local.h:831
static force_inline uint32_t getEntryPoint(void)
Definition: bytecode_local.h:1030
static uint32_t getSectionVirtualSize(unsigned i)
Definition: bytecode_local.h:1093
static force_inline uint32_t getPESizeOfCode(void)
Definition: bytecode_local.h:568
static force_inline uint32_t getPESizeOfStackReserve(void)
Definition: bytecode_local.h:807
uint32_t SizeOfInitializedData
Definition: bytecode_pe.h:65
static force_inline uint32_t getPESectionAlignment(void)
Definition: bytecode_local.h:640
static uint32_t force_inline be32_to_host(uint32_t v)
Definition: bytecode_local.h:405
uint32_t CheckSum
Definition: bytecode_pe.h:82
enum DIS_SIZE operation_size
Definition: bytecode_local.h:1226
static force_inline uint16_t getPEMinorImageVersion(void)
Definition: bytecode_local.h:699
static force_inline uint16_t getPEMajorOperatingSystemVersion(void)
Definition: bytecode_local.h:664
Definition: bytecode_api.h:63
Definition: bytecode_execs.h:39
static force_inline int32_t match_location_check(__Signature sig, uint32_t goback, const char *static_start, uint32_t static_len)
Definition: bytecode_local.h:298
int32_t displacement
Definition: bytecode_local.h:1203
static force_inline uint32_t getPEWin32VersionValue(void)
Definition: bytecode_local.h:735
uint8_t MajorLinkerVersion
Definition: bytecode_pe.h:100
static uint32_t getPELFANew(void)
Definition: bytecode_local.h:989
static force_inline uint32_t getPENumberOfSymbols()
Definition: bytecode_local.h:901
static force_inline uint16_t getPEMajorSubsystemVersion(void)
Definition: bytecode_local.h:711
Definition: bytecode_pe.h:51
static force_inline uint32_t getPEDataDirSize(unsigned n)
Definition: bytecode_local.h:964
uint32_t engine_functionality_level(void)
Definition: bytecode_api.h:85
static force_inline uint32_t DisassembleAt(struct DIS_fixed *result, uint32_t offset, uint32_t len)
Definition: bytecode_local.h:1241
static force_inline overloadable_func void foundVirus(const char *virusname)
Definition: bytecode_local.h:331
enum DIS_SIZE access_size
Definition: bytecode_local.h:1199
static force_inline uint64_t getPEImageBase(void)
Definition: bytecode_local.h:628
const struct cli_pe_hook_data __clambc_pedata
void * memset(void *src, int c, uintptr_t n) __attribute__((nothrow)) __attribute__((__nonnull__((1))))
uint8_t MinorLinkerVersion
Definition: bytecode_pe.h:101
bool __is_bigendian(void) __attribute__((const )) __attribute__((nothrow))
uint32_t TimeDateStamp
Definition: bytecode_pe.h:40
static force_inline uint32_t getPELoaderFlags(void)
Definition: bytecode_local.h:855
uint64_t other
Definition: bytecode_local.h:1216
uint32_t setvirusname(const uint8_t *name, uint32_t len)
static force_inline int readPESectionName(unsigned char name[8], unsigned n)
Definition: bytecode_local.h:1003
static force_inline uint32_t getPEDataDirRVA(unsigned n)
Definition: bytecode_local.h:947
int32_t read(uint8_t *data, int32_t size)
static uint32_t getSectionRVA(unsigned i)
Definition: bytecode_local.h:1079
struct DIS_mem_arg mem
Definition: bytecode_local.h:1214
static force_inline uint16_t getPEMinorOperatingSystemVersion(void)
Definition: bytecode_local.h:676
Definition: bytecode_disasm.h:329
Definition: bytecode_local.h:1198
const uint32_t __clambc_match_offsets[64]
This is a low-level variable, use the Macros in bytecode_local.h instead to access it...
enum DIS_ACCESS access_type
Definition: bytecode_local.h:1211
static force_inline uint32_t getPESizeOfHeapCommit(void)
Definition: bytecode_local.h:843
static void force_inline cli_writeint32(void *offset, uint32_t v)
Definition: bytecode_local.h:496
uint16_t MajorImageVersion
Definition: bytecode_pe.h:75
int32_t file_find_limit(const uint8_t *data, uint32_t len, int32_t maxpos)
static force_inline uint32_t count_match(__Signature sig)
Definition: bytecode_local.h:255
int32_t seek(int32_t pos, uint32_t whence)
uint16_t SizeOfOptionalHeader
Definition: bytecode_pe.h:43
Definition: bytecode_disasm.h:330
uint32_t debug_print_uint(uint32_t a)
void void * memcpy(void *restrict dst, const void *restrict src, uintptr_t n) __attribute__((__nothrow__)) __attribute__((__nonnull__(1
uint32_t pe_rawaddr(uint32_t rva)
Definition: bytecode_disasm.h:357
const uint32_t __clambc_filesize[1]
static force_inline uint32_t getPETimeDateStamp()
Definition: bytecode_local.h:879
uint16_t MinorOperatingSystemVersion
Definition: bytecode_pe.h:74
static force_inline uint16_t getPEMajorImageVersion(void)
Definition: bytecode_local.h:688
static force_inline uint32_t getImageBase(void)
Definition: bytecode_local.h:1054
static force_inline uint32_t getPEPointerToSymbolTable()
Definition: bytecode_local.h:890
X86OPS
Definition: bytecode_disasm.h:32
uint16_t MajorImageVersion
Definition: bytecode_pe.h:112
uint16_t Machine
Definition: bytecode_pe.h:38
uint8_t MajorLinkerVersion
Definition: bytecode_pe.h:62
static force_inline uint32_t getFilesize(void)
Definition: bytecode_local.h:349
uint8_t scale
Definition: bytecode_local.h:1202
uint32_t SizeOfCode
Definition: bytecode_pe.h:64
uint32_t debug_print_str(const uint8_t *str, uint32_t len)
void * memmove(void *dst, const void *src, uintptr_t n) __attribute__((__nothrow__)) __attribute__((__nonnull__(1
uint16_t MinorImageVersion
Definition: bytecode_pe.h:113
static force_inline uint32_t getPESizeOfStackCommit(void)
Definition: bytecode_local.h:819
static uint64_t force_inline be64_to_host(uint64_t v)
Definition: bytecode_local.h:434
enum X86REGS reg
Definition: bytecode_local.h:1215
static force_inline uint16_t getPEDllCharacteristics(void)
Definition: bytecode_local.h:795
static uint64_t force_inline le64_to_host(uint64_t v)
Definition: bytecode_local.h:421
static uint16_t force_inline be16_to_host(uint16_t v)
Definition: bytecode_local.h:460
static force_inline bool hasExeInfo(void)
Definition: bytecode_local.h:507
static force_inline uint32_t getPEBaseOfData(void)
Definition: bytecode_local.h:616
uint32_t FileAlignment
Definition: bytecode_pe.h:109
X86REGS
Definition: bytecode_disasm.h:345
static force_inline uint32_t getExeOffset(void)
Definition: bytecode_local.h:1041
static force_inline bool isPE64(void)
Definition: bytecode_local.h:533
struct pe_image_file_hdr file_hdr
Definition: bytecode_pe.h:163
uint32_t FileAlignment
Definition: bytecode_pe.h:72
static force_inline uint8_t getPEMinorLinkerVersion(void)
Definition: bytecode_local.h:556
static force_inline void * memchr(const void *s, int c, size_t n)
Definition: bytecode_local.h:1139
uint32_t ImageBase
Definition: bytecode_pe.h:70
static force_inline void overloadable_func debug(const char *str)
Definition: bytecode_local.h:45
uint8_t segment
Definition: bytecode_local.h:1228
enum DIS_SIZE access_size
Definition: bytecode_local.h:1212
static force_inline uint16_t getPECharacteristics()
Definition: bytecode_local.h:923
uint32_t SizeOfInitializedData
Definition: bytecode_pe.h:103
uint64_t ImageBase
Definition: bytecode_pe.h:107
static force_inline uint16_t getNumberOfSections(void)
Definition: bytecode_local.h:978
uint32_t e_lfanew
Definition: bytecode_pe.h:168
uint32_t SizeOfCode
Definition: bytecode_pe.h:102
void void int memcmp(const void *s1, const void *s2, uint32_t n) __attribute__((__nothrow__)) __attribute__((__pure__)) __attribute__((__nonnull__(1
uint16_t MinorImageVersion
Definition: bytecode_pe.h:76
static uint32_t force_inline le32_to_host(uint32_t v)
Definition: bytecode_local.h:389
enum X86OPS x86_opcode
Definition: bytecode_local.h:1225
static force_inline uint16_t getPEMachine()
Definition: bytecode_local.h:868
static int32_t ilog2_compat(uint32_t a, uint32_t b)
Definition: bytecode_local.h:1377