1
1
<?php
2
2
/**
3
- * SigTool v0.2.1 (last modified: 2018.06.20 ).
3
+ * SigTool v0.2.1 (last modified: 2018.06.28 ).
4
4
* Generates signatures for phpMussel using main.cvd and daily.cvd from ClamAV.
5
5
*
6
6
* Package location: GitHub <https://github.com/phpMussel/SigTool>.
16
16
class SigTool
17
17
{
18
18
/** Script version. */
19
- public $ Ver = '0.2.0 ' ;
19
+ public $ Ver = '0.2.1 ' ;
20
+
21
+ /** Last modified date. */
22
+ public $ Modified = '2018.06.28 ' ;
20
23
21
24
/** Script user agent. */
22
25
public $ UA = 'SigTool v%s (https://github.com/phpMussel/SigTool) ' ;
@@ -391,22 +394,25 @@ public function fixPath($Path) {
391
394
/** Fetch arguments. */
392
395
$ RunMode = !empty ($ argv [1 ]) ? strtolower ($ argv [1 ]) : '' ;
393
396
397
+ /** Initialise SigTool object. */
398
+ $ SigTool = new SigTool ();
399
+
394
400
/** L10N. */
395
401
$ L10N = [
396
- 'Help ' =>
397
- " SigTool v0.2.0-DEV (last modified: 2017.09.05). \n" .
398
- " Generates signatures for phpMussel using main.cvd and daily.cvd from ClamAV. \n\n" .
399
- " Syntax: \n" .
400
- " \$ php sigtool.php [arguments] \n" .
401
- " Example: \n" .
402
- " php sigtool.php xpmd \n" .
403
- " Arguments (all are OFF by default; include to turn ON): \n" .
404
- " - No arguments: Display this help information. \n" .
405
- " - x Extract signature files from daily.cvd and main.cvd. \n" .
406
- " - p Process signature files for use with phpMussel . \n" .
407
- " - m Download main .cvd before processing. \n" .
408
- " - d Download daily.cvd before processing . \n" .
409
- " - u Update SigTool (redownloads sigtool.php and dies; no checks performed). \n\n" ,
402
+ 'Help ' => sprintf (
403
+ ' SigTool v%1$s (last modified: %2$s).%3$s%4$s%5$s%6$s%7$s%8$s%9$s%10$s%11$s ' ,
404
+ $ SigTool -> Ver ,
405
+ $ SigTool -> Modified ,
406
+ "\n Generates signatures for phpMussel using main.cvd and daily.cvd from ClamAV. \n\n" ,
407
+ " Syntax: \n \$ php sigtool.php [arguments] \n Example: \n php sigtool.php xpmd \n" ,
408
+ " Arguments (all are OFF by default; include to turn ON): \n" ,
409
+ " - No arguments: Display this help information. \n" ,
410
+ " - x Extract signature files from daily.cvd and main.cvd. \n" ,
411
+ " - p Process signature files for use with phpMussel. \n" ,
412
+ " - m Download main.cvd before processing . \n" ,
413
+ " - d Download daily .cvd before processing. \n" ,
414
+ " - u Update SigTool (redownloads sigtool.php and dies; no checks performed) . \n\n"
415
+ ) ,
410
416
'Accessing ' => ' Accessing %s ... ' ,
411
417
'Deleting ' => ' Deleting %s ... ' ,
412
418
'Done ' => " Done! \n" ,
@@ -432,9 +438,6 @@ public function fixPath($Path) {
432
438
die ($ L10N ['Help ' ]);
433
439
}
434
440
435
- /** Initialise SigTool object. */
436
- $ SigTool = new SigTool ();
437
-
438
441
/**
439
442
* We'll use Zürich time for our timezone (closest approximate to CET, and
440
443
* required for our "Y.z.B" dates to actually make sense).
@@ -450,11 +453,10 @@ public function fixPath($Path) {
450
453
$ Terminate ();
451
454
}
452
455
echo $ L10N ['Done ' ] . sprintf ($ L10N ['Writing ' ], 'sigtool.php ' );
453
- if (file_put_contents ($ SigTool ->fixPath (__DIR__ . '/sigtool.php ' ), $ Data )) {
454
- echo $ L10N ['Done ' ];
455
- } else {
456
+ if (!file_put_contents ($ SigTool ->fixPath (__DIR__ . '/sigtool.php ' ), $ Data )) {
456
457
$ Terminate ();
457
458
}
459
+ echo $ L10N ['Done ' ];
458
460
die;
459
461
}
460
462
@@ -467,11 +469,10 @@ public function fixPath($Path) {
467
469
$ Terminate ();
468
470
}
469
471
echo $ L10N ['Done ' ] . sprintf ($ L10N ['Writing ' ], 'main.cvd ' );
470
- if (file_put_contents ($ SigTool ->fixPath (__DIR__ . '/main.cvd ' ), $ Data )) {
471
- echo $ L10N ['Done ' ];
472
- } else {
472
+ if (!file_put_contents ($ SigTool ->fixPath (__DIR__ . '/main.cvd ' ), $ Data )) {
473
473
$ Terminate ();
474
474
}
475
+ echo $ L10N ['Done ' ];
475
476
unset($ Data );
476
477
}
477
478
@@ -484,11 +485,10 @@ public function fixPath($Path) {
484
485
$ Terminate ();
485
486
}
486
487
echo $ L10N ['Done ' ] . sprintf ($ L10N ['Writing ' ], 'daily.cvd ' );
487
- if (file_put_contents ($ SigTool ->fixPath (__DIR__ . '/daily.cvd ' ), $ Data )) {
488
- echo $ L10N ['Done ' ];
489
- } else {
488
+ if (!file_put_contents ($ SigTool ->fixPath (__DIR__ . '/daily.cvd ' ), $ Data )) {
490
489
$ Terminate ();
491
490
}
491
+ echo $ L10N ['Done ' ];
492
492
unset($ Data );
493
493
}
494
494
@@ -624,8 +624,8 @@ public function fixPath($Path) {
624
624
625
625
/** Main sequence. */
626
626
foreach ([
627
- ['daily.hdb ' , 'main.hdb ' , '~([0-9a- f]{32}\:[0-9] +\:)([^\n]+)\n~ ' , "\\1 \x1A\x20\x10\x10\\2 \n" , 'clamav.hdb ' , "\x20" , 16777216 ],
628
- ['daily.mdb ' , 'main.mdb ' , '~([0-9] +\:[0-9a -f]{32}\:)([^\n]+)\n~ ' , "\\1 \x1A\x20\x10\x10\\2 \n" , 'clamav.mdb ' , "\xA0" , 16777216 ],
627
+ ['daily.hdb ' , 'main.hdb ' , '~([\da- f]{32}\:\d +\:)([^\n]+)\n~ ' , "\\1 \x1A\x20\x10\x10\\2 \n" , 'clamav.hdb ' , "\x20" , 16777216 ],
628
+ ['daily.mdb ' , 'main.mdb ' , '~(\d +\:[\da -f]{32}\:)([^\n]+)\n~ ' , "\\1 \x1A\x20\x10\x10\\2 \n" , 'clamav.mdb ' , "\xA0" , 16777216 ],
629
629
['daily.ndb ' , 'main.ndb ' , '~^([^:\n]+\:)~m ' , "\x1A\x20\x10\x10\\1 " , 'clamav.ndb ' , false , 0 ],
630
630
] as $ Set ) {
631
631
@@ -769,6 +769,54 @@ public function fixPath($Path) {
769
769
$ SigsThis = 0 ;
770
770
$ Percent = '' ;
771
771
772
+ /** Signature type to standard signature file pointer correlations. */
773
+ $ CorrelationsStandard = [
774
+ 'clamav.db ' ,
775
+ 'clamav_exe.db ' ,
776
+ 'clamav_ole.db ' ,
777
+ 'clamav.htdb ' ,
778
+ 'clamav_email.db ' ,
779
+ 'clamav_graphics.db ' ,
780
+ 'clamav_elf.db ' ,
781
+ 'clamav.ndb ' ,
782
+ 'clamav_macho.db ' ,
783
+ 'clamav_pdf.db ' ,
784
+ 'clamav_swf.db ' ,
785
+ 'clamav_java.db '
786
+ ];
787
+
788
+ /** Signature type to regex signature file pointer correlations. */
789
+ $ CorrelationsRegex = [
790
+ 'clamav_regex.db ' ,
791
+ 'clamav_exe_regex.db ' ,
792
+ 'clamav_ole_regex.db ' ,
793
+ 'clamav_regex.htdb ' ,
794
+ 'clamav_email_regex.db ' ,
795
+ 'clamav_graphics_regex.db ' ,
796
+ 'clamav_elf_regex.db ' ,
797
+ 'clamav_regex.ndb ' ,
798
+ 'clamav_macho_regex.db ' ,
799
+ 'clamav_pdf_regex.db ' ,
800
+ 'clamav_swf_regex.db ' ,
801
+ 'clamav_java_regex.db '
802
+ ];
803
+
804
+ /** Target guess to signature type correlations. */
805
+ $ CorrelationsTargetGuess = [
806
+ "\x11" => 1 ,
807
+ "\x12" => 1 ,
808
+ "\x13" => 1 ,
809
+ "\x14" => 6 ,
810
+ "\x15" => 9 ,
811
+ "\x17" => 4 ,
812
+ "\x19" => 12 ,
813
+ "\x1B" => 5 ,
814
+ "\x1C" => 2 ,
815
+ "\x1D" => 3 ,
816
+ "\x25" => 10 ,
817
+ "\x26" => 11
818
+ ];
819
+
772
820
while (($ Pos = strpos ($ FileData , "\n" , $ Offset )) !== false ) {
773
821
$ Last = $ Percent ;
774
822
$ Percent = number_format (($ SigsThis / $ SigsNDB ) * 100 , 2 ) . '% ' ;
@@ -821,31 +869,13 @@ public function fixPath($Path) {
821
869
/** Try to avoid dumping into general signatures whenever possible. */
822
870
if ($ SigType === 0 ) {
823
871
$ TargetGuess = substr ($ SigName , 2 , 1 );
824
- if ($ TargetGuess === "\x11" || $ TargetGuess === "\x12" || $ TargetGuess === "\x13" ) {
825
- $ SigType = 1 ;
826
- } elseif ($ TargetGuess === "\x14" ) {
827
- $ SigType = 6 ;
828
- } elseif ($ TargetGuess === "\x15" ) {
829
- $ SigType = 9 ;
830
- } elseif ($ TargetGuess === "\x17" ) {
831
- $ SigType = 4 ;
832
- } elseif ($ TargetGuess === "\x19" ) {
833
- $ SigType = 12 ;
834
- } elseif ($ TargetGuess === "\x1B" ) {
835
- $ SigType = 5 ;
836
- } elseif ($ TargetGuess === "\x1C" ) {
837
- $ SigType = 2 ;
838
- } elseif ($ TargetGuess === "\x1D" ) {
839
- $ SigType = 3 ;
840
- } elseif ($ TargetGuess === "\x25" ) {
841
- $ SigType = 10 ;
842
- } elseif ($ TargetGuess === "\x26" ) {
843
- $ SigType = 11 ;
872
+ if (!empty ($ CorrelationsTargetGuess [$ TargetGuess ])) {
873
+ $ SigType = $ CorrelationsTargetGuess [$ TargetGuess ];
844
874
}
845
875
}
846
876
847
877
/** Assign to the appropriate signature file (regex). */
848
- if (preg_match ('/[^a-f0-9 *]/i ' , $ SigHex )) {
878
+ if (preg_match ('/[^a-f\d *]/i ' , $ SigHex )) {
849
879
850
880
/**
851
881
* Handle PCRE conversion here (ClamAV to phpMussel formats).
@@ -892,30 +922,8 @@ public function fixPath($Path) {
892
922
$ ThisLine = $ SigName . ': ' . $ SigHex . $ StartStop . "\n" ;
893
923
894
924
/** Add to file based on signature type (regex). */
895
- if ($ SigType === 0 ) {
896
- $ FileSets ['clamav_regex.db ' ] .= $ ThisLine ;
897
- } elseif ($ SigType === 1 ) {
898
- $ FileSets ['clamav_exe_regex.db ' ] .= $ ThisLine ;
899
- } elseif ($ SigType === 2 ) {
900
- $ FileSets ['clamav_ole_regex.db ' ] .= $ ThisLine ;
901
- } elseif ($ SigType === 3 ) {
902
- $ FileSets ['clamav_regex.htdb ' ] .= $ ThisLine ;
903
- } elseif ($ SigType === 4 ) {
904
- $ FileSets ['clamav_email_regex.db ' ] .= $ ThisLine ;
905
- } elseif ($ SigType === 5 ) {
906
- $ FileSets ['clamav_graphics_regex.db ' ] .= $ ThisLine ;
907
- } elseif ($ SigType === 6 ) {
908
- $ FileSets ['clamav_elf_regex.db ' ] .= $ ThisLine ;
909
- } elseif ($ SigType === 7 ) {
910
- $ FileSets ['clamav_regex.ndb ' ] .= $ ThisLine ;
911
- } elseif ($ SigType === 9 ) {
912
- $ FileSets ['clamav_macho_regex.db ' ] .= $ ThisLine ;
913
- } elseif ($ SigType === 10 ) {
914
- $ FileSets ['clamav_pdf_regex.db ' ] .= $ ThisLine ;
915
- } elseif ($ SigType === 11 ) {
916
- $ FileSets ['clamav_swf_regex.db ' ] .= $ ThisLine ;
917
- } elseif ($ SigType === 12 ) {
918
- $ FileSets ['clamav_java_regex.db ' ] .= $ ThisLine ;
925
+ if (!empty ($ CorrelationsRegex [$ SigType ])) {
926
+ $ FileSets [$ CorrelationsRegex [$ SigType ]] .= $ ThisLine ;
919
927
}
920
928
921
929
/** Assign to the appropriate signature file (non-regex). */
@@ -928,30 +936,8 @@ public function fixPath($Path) {
928
936
$ ThisLine = $ SigName . ': ' . $ SigHex . $ StartStop . "\n" ;
929
937
930
938
/** Add to file based on signature type (non-regex). */
931
- if ($ SigType === 0 ) {
932
- $ FileSets ['clamav.db ' ] .= $ ThisLine ;
933
- } elseif ($ SigType === 1 ) {
934
- $ FileSets ['clamav_exe.db ' ] .= $ ThisLine ;
935
- } elseif ($ SigType === 2 ) {
936
- $ FileSets ['clamav_ole.db ' ] .= $ ThisLine ;
937
- } elseif ($ SigType === 3 ) {
938
- $ FileSets ['clamav.htdb ' ] .= $ ThisLine ;
939
- } elseif ($ SigType === 4 ) {
940
- $ FileSets ['clamav_email.db ' ] .= $ ThisLine ;
941
- } elseif ($ SigType === 5 ) {
942
- $ FileSets ['clamav_graphics.db ' ] .= $ ThisLine ;
943
- } elseif ($ SigType === 6 ) {
944
- $ FileSets ['clamav_elf.db ' ] .= $ ThisLine ;
945
- } elseif ($ SigType === 7 ) {
946
- $ FileSets ['clamav.ndb ' ] .= $ ThisLine ;
947
- } elseif ($ SigType === 9 ) {
948
- $ FileSets ['clamav_macho.db ' ] .= $ ThisLine ;
949
- } elseif ($ SigType === 10 ) {
950
- $ FileSets ['clamav_pdf.db ' ] .= $ ThisLine ;
951
- } elseif ($ SigType === 11 ) {
952
- $ FileSets ['clamav_swf.db ' ] .= $ ThisLine ;
953
- } elseif ($ SigType === 12 ) {
954
- $ FileSets ['clamav_java.db ' ] .= $ ThisLine ;
939
+ if (!empty ($ CorrelationsStandard [$ SigType ])) {
940
+ $ FileSets [$ CorrelationsStandard [$ SigType ]] .= $ ThisLine ;
955
941
}
956
942
957
943
}
0 commit comments