30 #define NULL (void*)0x0
32 #define force_inline inline __attribute__((always_inline))
33 #define overloadable_func __attribute__((overloadable))
36 #if defined(DOXYGEN) || __has_feature(attribute_overloadable)
45 static force_inline
void overloadable_func
debug(
const char * str)
57 static force_inline
void overloadable_func
debug(
const uint8_t* str)
69 static force_inline
void overloadable_func
debug(uint32_t a)
82 void debug(...) __attribute__((overloadable, unavailable));
92 #define VIRUSNAME_PREFIX(name) const char __clambc_virusname_prefix[] = name;
98 #define VIRUSNAMES(...) const char *const __clambc_virusnames[] = {__VA_ARGS__};
102 typedef struct signature {
111 #define PE_UNPACKER_DECLARE const uint16_t __clambc_kind = BC_PE_UNPACKER;
121 #define PDF_HOOK_DECLARE const uint16_t __clambc_kind = BC_PDF;
127 #define BYTECODE_ABORT_HOOK 0xcea5e
137 #define PE_HOOK_DECLARE const uint16_t __clambc_kind = BC_PE_ALL;
143 #define SIGNATURES_DECL_BEGIN \
144 struct __Signatures {
149 #define DECLARE_SIGNATURE(name) \
150 const char *name##_sig;\
156 #define SIGNATURES_DECL_END };
163 #define TARGET(tgt) const unsigned short __Target = (tgt);
170 #define COPYRIGHT(c) const char *const __Copyright = (c);
177 #define ICONGROUP1(group) const char *const __IconGroup1 = (group);
184 #define ICONGROUP2(group) const char *const __IconGroup2 = (group);
193 #define FUNCTIONALITY_LEVEL_MIN(m) const unsigned short __FuncMin = (m);
202 #define FUNCTIONALITY_LEVEL_MAX(m) const unsigned short __FuncMax = (m);
204 #define LDB_ADDATTRIBUTES(x) const char * __ldb_rawattrs = (x);
206 #define CONTAINER(x) const char * __ldb_container = (x);
215 #define SIGNATURES_DEF_BEGIN \
216 static const unsigned __signature_bias = __COUNTER__+1;\
217 const struct __Signatures Signatures = {\
225 #define DEFINE_SIGNATURE(name, hex) \
226 .name##_sig = (hex),\
227 .name = {__COUNTER__ - __signature_bias},
231 #define SIGNATURES_END };
237 #define SIGNATURES_DEF_END };
256 static force_inline uint32_t
matches(__Signature sig)\
273 if (pos <= 0) pos = 0;
292 const char *static_start,
298 int32_t cpos =
file_find_limit(static_start, static_len, pos + goback);
300 debug(
"Engine reported match, but we couldn't find it! Engine reported (after fixup):");
307 debug(
"wrong match pos reported by engine, real match pos:");
309 debug(
"reported by engine:");
311 debug(
"but goback fixed it up!");
323 static force_inline overloadable_func
void foundVirus(
const char *virusname)
328 #if defined(DOXYGEN) || __has_feature(attribute_overloadable)
349 } __attribute__((packed));
354 } __attribute__((packed));
372 bool __is_bigendian(
void) __attribute__((const)) __attribute__((nothrow));
386 uint32_t swapped = __builtin_bswap32(v);
402 uint32_t swapped = __builtin_bswap32(v);
415 uint64_t swapped = __builtin_bswap64(v);
428 uint64_t swapped = __builtin_bswap64(v);
441 uint16_t swapped = ((v & 0xff) << 8) | ((v >> 8) & 0xff);
454 uint16_t swapped = ((v & 0xff) << 8) | ((v >> 8) & 0xff);
466 uint32_t v = ((
const union unaligned_32 *)buff)->una_s32;
478 uint16_t v = ((
const union unaligned_16 *)buff)->una_s16;
490 ((
union unaligned_32 *)offset)->una_u32 =
le32_to_host(v);
515 #define NEED_PE_INFO { \
517 __fail_missing_PE_HOOK_DECLARE__or__PE_UNPACKER_DECLARE();\
1011 if (
read(name, 8) != 8)
1104 static force_inline
bool readRVA(uint32_t
rva,
void *buf,
size_t bufsize)
1112 if (
read(buf, bufsize) != bufsize) {
1131 static force_inline
void*
memchr(
const void* s,
int c,
size_t n)
1133 unsigned char cc = c;
1134 const char *end, *p = s;
1136 for (end=p+n; p < end; p++)
1150 void*
memset(
void *src,
int c, uintptr_t n) __attribute__((nothrow)) __attribute__((__nonnull__((1))));
1160 void *
memmove (
void *dst, const
void *src, uintptr_t n)
1161 __attribute__ ((__nothrow__)) __attribute__ ((__nonnull__ (1, 2)));
1171 void *
memcpy (
void *restrict dst, const
void *restrict src, uintptr_t n)
1172 __attribute__ ((__nothrow__)) __attribute__ ((__nonnull__ (1, 2)));
1183 int memcmp (const
void *s1, const
void *s2, uint32_t n)
1184 __attribute__ ((__nothrow__)) __attribute__ ((__pure__)) __attribute__ ((__nonnull__ (1, 2)));
1232 static force_inline uint32_t
1238 offset =
disasm_x86(&res, len <
sizeof(res) ? len :
sizeof(res));
1242 result->
segment = res.segment;
1258 uint64_t x =
cli_readint32((
const uint32_t*)&res.arg[i][6]);
1268 #define RE2C_BSIZE 1024
1270 unsigned char *cur, *lim, *mrk, *ctx, *eof, *tok;
1273 unsigned char buffer[RE2C_BSIZE];
1276 #define YYCTYPE unsigned char
1277 #define YYCURSOR re2c_scur
1278 #define YYLIMIT re2c_slim
1279 #define YYMARKER re2c_smrk
1280 #define YYCONTEXT re2c_sctx
1281 #define YYFILL(n) { \
1282 RE2C_FILLBUFFER(n);\
1283 if (re2c_sres <= 0) break;\
1286 #define REGEX_SCANNER unsigned char *re2c_scur, *re2c_stok, *re2c_smrk, *re2c_sctx, *re2c_slim;\
1287 int re2c_sres; int32_t re2c_stokstart;\
1288 unsigned char re2c_sbuffer[RE2C_BSIZE];\
1289 re2c_scur = re2c_slim = re2c_smrk = re2c_sctx = &re2c_sbuffer[0];\
1293 #define REGEX_POS (-(re2c_slim - re2c_scur) + seek(0, SEEK_CUR))
1294 #define REGEX_LOOP_BEGIN do { re2c_stok = re2c_scur; re2c_stokstart = REGEX_POS;} while (0);
1295 #define REGEX_RESULT (re2c_sres)
1297 #define RE2C_DEBUG_PRINT \
1300 uint32_t here = seek(0, SEEK_CUR);\
1301 uint32_t d = re2c_slim - re2c_scur;\
1302 uint32_t end = here - d;\
1303 unsigned len = end - re2c_stokstart;\
1305 unsigned skipped = len - 74;\
1306 seek(re2c_stokstart, SEEK_SET);\
1307 if (read(buf, 37) == 37)\
1309 memcpy(buf+37, "[...]", 5);\
1310 seek(end-37, SEEK_SET);\
1311 if (read(buf, 37) != 37)\
1315 seek(re2c_stokstart, SEEK_SET);\
1316 if (read(buf, len) != len)\
1321 debug_print_str(buf, 0);\
1322 seek(here, SEEK_SET);\
1325 #define DEBUG_PRINT_REGEX_MATCH RE2C_DEBUG_PRINT
1327 #define BUFFER_FILL(buf, cursor, need, limit) do {\
1328 (limit) = fill_buffer((buf), sizeof((buf)), (limit), (cursor), (need));\
1331 #define BUFFER_ENSURE(buf, cursor, need, limit) do {\
1332 if ((cursor) + (need) >= (limit)) {\
1333 BUFFER_FILL(buf, cursor, need, limit)\
1341 #define RE2C_FILLBUFFER(need) do {\
1342 uint32_t cursor = re2c_stok - &re2c_sbuffer[0];\
1343 int32_t limit = re2c_slim - &re2c_sbuffer[0];\
1344 limit = fill_buffer(re2c_sbuffer, sizeof(re2c_sbuffer), limit, (cursor), (need));\
1347 } else if (limit <= (need)) {\
1350 uint32_t curoff = re2c_scur - re2c_stok;\
1351 uint32_t mrkoff = re2c_smrk - re2c_stok;\
1352 uint32_t ctxoff = re2c_sctx - re2c_stok;\
1353 re2c_slim = &re2c_sbuffer[0] + limit;\
1354 re2c_stok = &re2c_sbuffer[0];\
1355 re2c_scur = &re2c_sbuffer[0] + curoff;\
1356 re2c_smrk = &re2c_sbuffer[0] + mrkoff;\
1357 re2c_sctx = &re2c_sbuffer[0] + ctxoff;\
1371 uint32_t c = a > b ? a : b;
1374 uint32_t scale = 2048/c;
1379 uint32_t scale = (c+2047) / 2048;
1384 return ilog_table[a] - ilog_table[b];
static force_inline uint32_t getPECheckSum(void)
Definition: bytecode_local.h:763
DIS_SIZE
Definition: bytecode_disasm.h:334
uint32_t PointerToSymbolTable
Definition: bytecode_pe.h:41
uint32_t SectionAlignment
Definition: bytecode_pe.h:108
Definition: bytecode_api.h:253
uint16_t MajorOperatingSystemVersion
Definition: bytecode_pe.h:73
static force_inline uint32_t matches(__Signature sig)
Definition: bytecode_local.h:256
Definition: bytecode_api.h:72
Definition: bytecode_local.h:1216
static force_inline uint32_t getPESizeOfHeaders(void)
Definition: bytecode_local.h:751
uint16_t nsections
Definition: bytecode_pe.h:161
struct pe_image_optional_hdr64 opt64
Definition: bytecode_pe.h:166
uint32_t SectionAlignment
Definition: bytecode_pe.h:71
static force_inline uint16_t getPESubsystem(void)
Definition: bytecode_local.h:775
Definition: bytecode_pe.h:98
uint32_t SizeOfUninitializedData
Definition: bytecode_pe.h:104
uint16_t MinorOperatingSystemVersion
Definition: bytecode_pe.h:111
DIS_ACCESS
Definition: bytecode_disasm.h:325
static force_inline uint32_t match_location(__Signature sig, uint32_t goback)
Definition: bytecode_local.h:267
enum DIS_SIZE address_size
Definition: bytecode_local.h:1219
static force_inline uint32_t getPEBaseOfCode(void)
Definition: bytecode_local.h:596
const uint32_t __clambc_match_counts[64]
This is a low-level variable, use the Macros in bytecode_local.h instead to access it...
uint32_t rva
Definition: bytecode_execs.h:40
static force_inline uint16_t getPEMinorSubsystemVersion(void)
Definition: bytecode_local.h:715
Definition: bytecode_api.h:58
uint32_t SizeOfUninitializedData
Definition: bytecode_pe.h:66
static uint16_t force_inline cli_readint16(const void *buff)
Definition: bytecode_local.h:476
static uint16_t force_inline le16_to_host(uint16_t v)
Definition: bytecode_local.h:439
static force_inline uint16_t getPESizeOfOptionalHeader()
Definition: bytecode_local.h:904
Definition: bytecode_local.h:1202
static force_inline bool getPEisDLL()
Definition: bytecode_local.h:928
static force_inline uint32_t getPEFileAlignment(void)
Definition: bytecode_local.h:644
static uint32_t force_inline cli_readint32(const void *buff)
Definition: bytecode_local.h:464
enum X86REGS scale_reg
Definition: bytecode_local.h:1192
enum X86REGS add_reg
Definition: bytecode_local.h:1193
static force_inline bool readRVA(uint32_t rva, void *buf, size_t bufsize)
Definition: bytecode_local.h:1104
static uint32_t getVirtualEntryPoint(void)
Definition: bytecode_local.h:1057
Definition: bytecode_pe.h:36
static force_inline bool hasPEInfo(void)
Definition: bytecode_local.h:509
uint32_t NumberOfSymbols
Definition: bytecode_pe.h:42
struct pe_image_optional_hdr32 opt32
Definition: bytecode_pe.h:164
static force_inline uint32_t getPESizeOfImage(void)
Definition: bytecode_local.h:739
struct DIS_arg arg[3]
Definition: bytecode_local.h:1221
uint32_t disasm_x86(struct DISASM_RESULT *result, uint32_t len)
static force_inline uint8_t getPEMajorLinkerVersion(void)
Definition: bytecode_local.h:536
uint16_t MajorOperatingSystemVersion
Definition: bytecode_pe.h:110
static force_inline uint32_t getPESizeOfInitializedData(void)
Definition: bytecode_local.h:572
uint32_t CheckSum
Definition: bytecode_pe.h:119
uint32_t vsz
Definition: bytecode_execs.h:41
int32_t get_pe_section(struct cli_exe_section *section, uint32_t num)
static force_inline uint32_t getPESizeOfUninitializedData(void)
Definition: bytecode_local.h:584
Definition: bytecode_pe.h:135
const uint16_t __clambc_kind
Definition: bytecode_api.h:227
uint32_t ep
Definition: bytecode_pe.h:160
uint8_t MinorLinkerVersion
Definition: bytecode_pe.h:63
static force_inline uint32_t getPESizeOfHeapReserve(void)
Definition: bytecode_local.h:823
static force_inline uint32_t getEntryPoint(void)
Definition: bytecode_local.h:1022
static uint32_t getSectionVirtualSize(unsigned i)
Definition: bytecode_local.h:1085
static force_inline uint32_t getPESizeOfCode(void)
Definition: bytecode_local.h:560
static force_inline uint32_t getPESizeOfStackReserve(void)
Definition: bytecode_local.h:799
uint32_t SizeOfInitializedData
Definition: bytecode_pe.h:65
static force_inline uint32_t getPESectionAlignment(void)
Definition: bytecode_local.h:632
static uint32_t force_inline be32_to_host(uint32_t v)
Definition: bytecode_local.h:397
uint32_t CheckSum
Definition: bytecode_pe.h:82
enum DIS_SIZE operation_size
Definition: bytecode_local.h:1218
static force_inline uint16_t getPEMinorImageVersion(void)
Definition: bytecode_local.h:691
static force_inline uint16_t getPEMajorOperatingSystemVersion(void)
Definition: bytecode_local.h:656
Definition: bytecode_api.h:63
Definition: bytecode_execs.h:39
static force_inline int32_t match_location_check(__Signature sig, uint32_t goback, const char *static_start, uint32_t static_len)
Definition: bytecode_local.h:290
int32_t displacement
Definition: bytecode_local.h:1195
static force_inline uint32_t getPEWin32VersionValue(void)
Definition: bytecode_local.h:727
uint8_t MajorLinkerVersion
Definition: bytecode_pe.h:100
static uint32_t getPELFANew(void)
Definition: bytecode_local.h:981
static force_inline uint32_t getPENumberOfSymbols()
Definition: bytecode_local.h:893
static force_inline uint16_t getPEMajorSubsystemVersion(void)
Definition: bytecode_local.h:703
Definition: bytecode_pe.h:51
static force_inline uint32_t getPEDataDirSize(unsigned n)
Definition: bytecode_local.h:956
uint32_t engine_functionality_level(void)
Definition: bytecode_api.h:82
static force_inline uint32_t DisassembleAt(struct DIS_fixed *result, uint32_t offset, uint32_t len)
Definition: bytecode_local.h:1233
static force_inline overloadable_func void foundVirus(const char *virusname)
Definition: bytecode_local.h:323
enum DIS_SIZE access_size
Definition: bytecode_local.h:1191
static force_inline uint64_t getPEImageBase(void)
Definition: bytecode_local.h:620
const struct cli_pe_hook_data __clambc_pedata
void * memset(void *src, int c, uintptr_t n) __attribute__((nothrow)) __attribute__((__nonnull__((1))))
uint8_t MinorLinkerVersion
Definition: bytecode_pe.h:101
bool __is_bigendian(void) __attribute__((const )) __attribute__((nothrow))
uint32_t TimeDateStamp
Definition: bytecode_pe.h:40
static force_inline uint32_t getPELoaderFlags(void)
Definition: bytecode_local.h:847
uint64_t other
Definition: bytecode_local.h:1208
uint32_t setvirusname(const uint8_t *name, uint32_t len)
static force_inline int readPESectionName(unsigned char name[8], unsigned n)
Definition: bytecode_local.h:995
static force_inline uint32_t getPEDataDirRVA(unsigned n)
Definition: bytecode_local.h:939
int32_t read(uint8_t *data, int32_t size)
static uint32_t getSectionRVA(unsigned i)
Definition: bytecode_local.h:1071
struct DIS_mem_arg mem
Definition: bytecode_local.h:1206
static force_inline uint16_t getPEMinorOperatingSystemVersion(void)
Definition: bytecode_local.h:668
Definition: bytecode_disasm.h:329
Definition: bytecode_local.h:1190
const uint32_t __clambc_match_offsets[64]
This is a low-level variable, use the Macros in bytecode_local.h instead to access it...
enum DIS_ACCESS access_type
Definition: bytecode_local.h:1203
static force_inline uint32_t getPESizeOfHeapCommit(void)
Definition: bytecode_local.h:835
static void force_inline cli_writeint32(void *offset, uint32_t v)
Definition: bytecode_local.h:488
uint16_t MajorImageVersion
Definition: bytecode_pe.h:75
int32_t file_find_limit(const uint8_t *data, uint32_t len, int32_t maxpos)
static force_inline uint32_t count_match(__Signature sig)
Definition: bytecode_local.h:247
int32_t seek(int32_t pos, uint32_t whence)
uint16_t SizeOfOptionalHeader
Definition: bytecode_pe.h:43
Definition: bytecode_disasm.h:330
uint32_t debug_print_uint(uint32_t a)
void void * memcpy(void *restrict dst, const void *restrict src, uintptr_t n) __attribute__((__nothrow__)) __attribute__((__nonnull__(1
uint32_t pe_rawaddr(uint32_t rva)
Definition: bytecode_disasm.h:357
const uint32_t __clambc_filesize[1]
static force_inline uint32_t getPETimeDateStamp()
Definition: bytecode_local.h:871
uint16_t MinorOperatingSystemVersion
Definition: bytecode_pe.h:74
static force_inline uint16_t getPEMajorImageVersion(void)
Definition: bytecode_local.h:680
static force_inline uint32_t getImageBase(void)
Definition: bytecode_local.h:1046
static force_inline uint32_t getPEPointerToSymbolTable()
Definition: bytecode_local.h:882
X86OPS
Definition: bytecode_disasm.h:32
uint16_t MajorImageVersion
Definition: bytecode_pe.h:112
uint16_t Machine
Definition: bytecode_pe.h:38
uint8_t MajorLinkerVersion
Definition: bytecode_pe.h:62
static force_inline uint32_t getFilesize(void)
Definition: bytecode_local.h:341
uint8_t scale
Definition: bytecode_local.h:1194
uint32_t SizeOfCode
Definition: bytecode_pe.h:64
uint32_t debug_print_str(const uint8_t *str, uint32_t len)
void * memmove(void *dst, const void *src, uintptr_t n) __attribute__((__nothrow__)) __attribute__((__nonnull__(1
uint16_t MinorImageVersion
Definition: bytecode_pe.h:113
static force_inline uint32_t getPESizeOfStackCommit(void)
Definition: bytecode_local.h:811
static uint64_t force_inline be64_to_host(uint64_t v)
Definition: bytecode_local.h:426
enum X86REGS reg
Definition: bytecode_local.h:1207
static force_inline uint16_t getPEDllCharacteristics(void)
Definition: bytecode_local.h:787
static uint64_t force_inline le64_to_host(uint64_t v)
Definition: bytecode_local.h:413
static uint16_t force_inline be16_to_host(uint16_t v)
Definition: bytecode_local.h:452
static force_inline bool hasExeInfo(void)
Definition: bytecode_local.h:499
static force_inline uint32_t getPEBaseOfData(void)
Definition: bytecode_local.h:608
uint32_t FileAlignment
Definition: bytecode_pe.h:109
X86REGS
Definition: bytecode_disasm.h:345
static force_inline uint32_t getExeOffset(void)
Definition: bytecode_local.h:1033
static force_inline bool isPE64(void)
Definition: bytecode_local.h:525
struct pe_image_file_hdr file_hdr
Definition: bytecode_pe.h:163
uint32_t FileAlignment
Definition: bytecode_pe.h:72
static force_inline uint8_t getPEMinorLinkerVersion(void)
Definition: bytecode_local.h:548
static force_inline void * memchr(const void *s, int c, size_t n)
Definition: bytecode_local.h:1131
uint32_t ImageBase
Definition: bytecode_pe.h:70
static force_inline void overloadable_func debug(const char *str)
Definition: bytecode_local.h:45
uint8_t segment
Definition: bytecode_local.h:1220
enum DIS_SIZE access_size
Definition: bytecode_local.h:1204
static force_inline uint16_t getPECharacteristics()
Definition: bytecode_local.h:915
uint32_t SizeOfInitializedData
Definition: bytecode_pe.h:103
uint64_t ImageBase
Definition: bytecode_pe.h:107
static force_inline uint16_t getNumberOfSections(void)
Definition: bytecode_local.h:970
uint32_t e_lfanew
Definition: bytecode_pe.h:168
uint32_t SizeOfCode
Definition: bytecode_pe.h:102
void void int memcmp(const void *s1, const void *s2, uint32_t n) __attribute__((__nothrow__)) __attribute__((__pure__)) __attribute__((__nonnull__(1
uint16_t MinorImageVersion
Definition: bytecode_pe.h:76
static uint32_t force_inline le32_to_host(uint32_t v)
Definition: bytecode_local.h:381
enum X86OPS x86_opcode
Definition: bytecode_local.h:1217
static force_inline uint16_t getPEMachine()
Definition: bytecode_local.h:860
static int32_t ilog2_compat(uint32_t a, uint32_t b)
Definition: bytecode_local.h:1369