All Data Structures Files Functions Variables Enumerations Enumerator Macros Groups
bytecode_api.h
Go to the documentation of this file.
1 /*
2  * Copyright (C) 2009-2013 Sourcefire, Inc.
3  * Copyright (C) 2014 Cisco Systems, Inc. and/or its affiliates.
4  * All rights reserved.
5  * Authors: Török Edvin, Kevin Lin
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  * notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  * notice, this list of conditions and the following disclaimer in the
14  * documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
30 #ifndef BYTECODE_API_H
31 #define BYTECODE_API_H
32 
33 #ifdef __CLAMBC__
34 #include "bytecode_execs.h"
35 #include "bytecode_pe.h"
36 #include "bytecode_disasm.h"
37 #include "bytecode_detect.h"
38 #endif
39 
40 #ifndef __CLAMBC__
41 struct cli_exe_section;
42 struct DISASM_RESULT;
43 #endif
44 
54  _BC_START_HOOKS=256,
64  _BC_LAST_HOOK
65 };
66 
67 enum {
72  PE_INVALID_RVA = 0xFFFFFFFF
73 };
74 
81  FUNC_LEVEL_096_dev = 52,
84  FUNC_LEVEL_096_1_dev = 54,
86  FUNC_LEVEL_096_2_dev = 55,
94  FUNC_LEVEL_097_3 = 63, /*last bcc changes as former team resigns*/
100  FUNC_LEVEL_098_1 = 76, /*last syncing to clamav*/
104  FUNC_LEVEL_100 = 100 /*future release candidate*/
105 };
106 
111 enum pdf_phase {
112  PDF_PHASE_NONE, /* not a PDF */
117 };
118 
123 enum pdf_flag {
124  BAD_PDF_VERSION=0,
125  BAD_PDF_HEADERPOS,
126  BAD_PDF_TRAILER,
127  BAD_PDF_TOOMANYOBJS,
128  BAD_STREAM_FILTERS,
129  BAD_FLATE,
130  BAD_FLATESTART,
131  BAD_STREAMSTART,
132  BAD_ASCIIDECODE,
133  BAD_INDOBJ,
134  UNTERMINATED_OBJ_DICT,
135  ESCAPED_COMMON_PDFNAME,
136  HEX_JAVASCRIPT,
137  UNKNOWN_FILTER,
138  MANY_FILTERS,
139  HAS_OPENACTION,
140  BAD_STREAMLEN,
141  ENCRYPTED_PDF,
142  LINEARIZED_PDF, /* not bad, just as flag */
143  DECRYPTABLE_PDF,
144  HAS_LAUNCHACTION
145 };
146 
152  OBJ_STREAM=0,
153  OBJ_DICT,
154  OBJ_EMBEDDED_FILE,
155  OBJ_FILTER_AH,
156  OBJ_FILTER_A85,
157  OBJ_FILTER_FLATE,
158  OBJ_FILTER_LZW,
159  OBJ_FILTER_RL,
160  OBJ_FILTER_FAX,
161  OBJ_FILTER_JBIG2,
162  OBJ_FILTER_DCT,
163  OBJ_FILTER_JPX,
164  OBJ_FILTER_CRYPT,
165  OBJ_FILTER_UNKNOWN,
166  OBJ_JAVASCRIPT,
167  OBJ_OPENACTION,
168  OBJ_HASFILTERS,
169  OBJ_SIGNED,
170  OBJ_IMAGE,
171  OBJ_TRUNCATED,
172  OBJ_FORCEDUMP,
173  OBJ_FILTER_STANDARD,
174  OBJ_LAUNCHACTION,
175  OBJ_PAGE,
176  OBJ_CONTENTS
177 };
178 
184  JSON_TYPE_NULL=0,
185  JSON_TYPE_BOOLEAN,
186  JSON_TYPE_DOUBLE,
187  JSON_TYPE_INT,
188  JSON_TYPE_OBJECT,
189  JSON_TYPE_ARRAY,
190  JSON_TYPE_STRING
191 };
192 
193 #ifdef __CLAMBC__
194 
195 /* --------------- BEGIN GLOBALS -------------------------------------------- */
202 extern const uint32_t __clambc_match_counts[64];
203 
210 extern const uint32_t __clambc_match_offsets[64];
211 
216 extern const struct cli_pe_hook_data __clambc_pedata;
221 extern const uint32_t __clambc_filesize[1];
222 
227 const uint16_t __clambc_kind;
228 /* ---------------- END GLOBALS --------------------------------------------- */
229 /* ---------------- BEGIN 0.96 APIs (don't touch) --------------------------- */
236 uint32_t test1(uint32_t a, uint32_t b);
237 
246 int32_t read(uint8_t *data, int32_t size);
247 
251 enum {
258 };
259 
270 int32_t write(uint8_t *data, int32_t size);
271 
280 int32_t seek(int32_t pos, uint32_t whence);
281 
289 uint32_t setvirusname(const uint8_t *name, uint32_t len);
290 
298 uint32_t debug_print_str(const uint8_t *str, uint32_t len);
299 
307 uint32_t debug_print_uint(uint32_t a);
308 
322 uint32_t disasm_x86(struct DISASM_RESULT* result, uint32_t len);
323 
324 /* tracing API, private */
325 
326 /* a scope: lexical block, function, or compile unit */
327 uint32_t trace_directory(const uint8_t* directory, uint32_t dummy);
328 uint32_t trace_scope(const uint8_t* newscope, uint32_t scopeid);
329 uint32_t trace_source(const uint8_t* srcfile, uint32_t line);
330 uint32_t trace_op(const uint8_t* opname, uint32_t column);
331 uint32_t trace_value(const uint8_t* name, uint32_t v);
332 uint32_t trace_ptr(const uint8_t* ptr, uint32_t dummy);
333 
342 uint32_t pe_rawaddr(uint32_t rva);
343 
351 int32_t file_find(const uint8_t* data, uint32_t len);
352 
360 int32_t file_byteat(uint32_t offset);
361 
369 void* malloc(uint32_t size);
370 
376 uint32_t test2(uint32_t a);
377 
386 int32_t get_pe_section(struct cli_exe_section *section, uint32_t num);
387 
401 int32_t fill_buffer(uint8_t* buffer, uint32_t len, uint32_t filled,
402  uint32_t cursor, uint32_t fill);
403 
411 int32_t extract_new(int32_t id);
412 
420 int32_t read_number(uint32_t radix);
421 
427 int32_t hashset_new(void);
428 
436 int32_t hashset_add(int32_t hs, uint32_t key);
437 
445 int32_t hashset_remove(int32_t hs, uint32_t key);
446 
456 int32_t hashset_contains(int32_t hs, uint32_t key);
457 
468 int32_t hashset_done(int32_t id);
469 
476 int32_t hashset_empty(int32_t id);
477 
484 int32_t buffer_pipe_new(uint32_t size);
485 
493 int32_t buffer_pipe_new_fromfile(uint32_t pos);
494 
501 uint32_t buffer_pipe_read_avail(int32_t id);
502 
513 //uint8_t *buffer_pipe_read_get(int32_t id, uint32_t amount);
514 const uint8_t *buffer_pipe_read_get(int32_t id, uint32_t amount);
515 
523 int32_t buffer_pipe_read_stopped(int32_t id, uint32_t amount);
524 
531 uint32_t buffer_pipe_write_avail(int32_t id);
532 
543 uint8_t *buffer_pipe_write_get(int32_t id, uint32_t size);
544 
552 int32_t buffer_pipe_write_stopped(int32_t id, uint32_t amount);
553 
563 int32_t buffer_pipe_done(int32_t id);
564 
574 int32_t inflate_init(int32_t from_buffer, int32_t to_buffer, int32_t windowBits);
575 
588 int32_t inflate_process(int32_t id);
589 
599 int32_t inflate_done(int32_t id);
600 
607 int32_t bytecode_rt_error(int32_t locationid);
608 
618 int32_t jsnorm_init(int32_t from_buffer);
619 
628 int32_t jsnorm_process(int32_t id);
629 
636 int32_t jsnorm_done(int32_t id);
637 
638 /* ---------------- END 0.96 APIs (don't touch) --------------------------- */
639 /* ---------------- BEGIN 0.96.1 APIs ------------------------------------- */
640 
641 /* ---------------- Math -------------------------------------------------- */
642 
650 int32_t ilog2(uint32_t a, uint32_t b);
651 
660 int32_t ipow(int32_t a, int32_t b, int32_t c);
661 
670 uint32_t iexp(int32_t a, int32_t b, int32_t c);
671 
680 int32_t isin(int32_t a, int32_t b, int32_t c);
681 
690 int32_t icos(int32_t a, int32_t b, int32_t c);
691 
692 /* ---------------- String operations --------------------------------------- */
702 int32_t memstr(const uint8_t* haystack, int32_t haysize,
703  const uint8_t* needle, int32_t needlesize);
704 
713 int32_t hex2ui(uint32_t hex1, uint32_t hex2);
714 
722 int32_t atoi(const uint8_t* str, int32_t size);
723 
732 uint32_t debug_print_str_start(const uint8_t *str, uint32_t len);
733 
742 uint32_t debug_print_str_nonl(const uint8_t *str, uint32_t len);
743 
751 uint32_t entropy_buffer(uint8_t* buffer, int32_t size);
752 
753 /* ------------------ Data Structures --------------------------------------- */
761 int32_t map_new(int32_t keysize, int32_t valuesize);
762 
773 int32_t map_addkey(const uint8_t *key, int32_t ksize, int32_t id);
774 
784 int32_t map_setvalue(const uint8_t *value, int32_t vsize, int32_t id);
785 
796 int32_t map_remove(const uint8_t* key, int32_t ksize, int32_t id);
797 
810 int32_t map_find(const uint8_t* key, int32_t ksize, int32_t id);
811 
818 int32_t map_getvaluesize(int32_t id);
819 
827 uint8_t* map_getvalue(int32_t id, int32_t size);
828 
839 int32_t map_done(int32_t id);
840 
841 /* -------------- File Operations ------------------------------------------- */
853 int32_t file_find_limit(const uint8_t *data, uint32_t len, int32_t maxpos);
854 
855 /* ------------- Engine Query ----------------------------------------------- */
862 uint32_t engine_functionality_level(void);
863 
871 uint32_t engine_dconf_level(void);
872 
878 uint32_t engine_scan_options(void);
879 
885 uint32_t engine_db_options(void);
886 
887 /* ---------------- Scan Control -------------------------------------------- */
894 int32_t extract_set_container(uint32_t container);
895 
907 int32_t input_switch(int32_t extracted_file);
908 
909 /* ---------------- END 0.96.1 APIs ------------------------------------- */
910 /* ---------------- BEGIN 0.96.2 APIs ----------------------------------- */
911 
921 uint32_t get_environment(struct cli_environment *env, uint32_t len);
922 
934 uint32_t disable_bytecode_if(const int8_t *reason, uint32_t len, uint32_t cond);
935 
947 uint32_t disable_jit_if(const int8_t* reason, uint32_t len, uint32_t cond);
948 
960 int32_t version_compare(const uint8_t* lhs, uint32_t lhs_len,
961  const uint8_t* rhs, uint32_t rhs_len);
962 
973 uint32_t check_platform(uint32_t a, uint32_t b, uint32_t c);
974 
975 /* --------------------- PDF APIs ----------------------------------- */
982 int32_t pdf_get_obj_num(void);
983 
990 int32_t pdf_get_flags(void);
991 
999 int32_t pdf_set_flags(int32_t flags);
1000 
1008 int32_t pdf_lookupobj(uint32_t id);
1009 
1016 uint32_t pdf_getobjsize(int32_t objidx);
1017 
1026 //uint8_t *pdf_getobj(int32_t objidx, uint32_t amount);
1027 const uint8_t *pdf_getobj(int32_t objidx, uint32_t amount);
1028 
1036 int32_t pdf_getobjid(int32_t objidx);
1037 
1045 int32_t pdf_getobjflags(int32_t objidx);
1046 
1057 int32_t pdf_setobjflags(int32_t objidx, int32_t flags);
1058 
1066 int32_t pdf_get_offset(int32_t objidx);
1067 
1074 int32_t pdf_get_phase(void);
1075 
1083 int32_t pdf_get_dumpedobjid(void);
1084 
1085 /* ----------------------------- Icon APIs -------------------------- */
1098 int32_t matchicon(const uint8_t* group1, int32_t group1_len,
1099  const uint8_t* group2, int32_t group2_len);
1100 /* ---------------- END 0.96.2 APIs ----------------------------------- */
1101 /* ----------------- BEGIN 0.96.4 APIs ---------------------------------- */
1109 int32_t running_on_jit(void);
1110 
1119 int32_t get_file_reliability(void);
1120 
1121 /* ----------------- END 0.96.4 APIs ---------------------------------- */
1122 /* ----------------- BEGIN 0.98.4 APIs -------------------------------- */
1123 /* ----------------- JSON Parsing APIs -------------------------------- */
1129 int32_t json_is_active(void);
1130 
1141 int32_t json_get_object(const int8_t* name, int32_t name_len, int32_t objid);
1142 
1149 int32_t json_get_type(int32_t objid);
1150 
1158 int32_t json_get_array_length(int32_t objid);
1159 
1169 int32_t json_get_array_idx(int32_t idx, int32_t objid);
1170 
1178 int32_t json_get_string_length(int32_t objid);
1179 
1191 int32_t json_get_string(int8_t* str, int32_t str_len, int32_t objid);
1192 
1198 int32_t json_get_boolean(int32_t objid);
1199 
1205 int32_t json_get_int(int32_t objid);
1206 
1207 //int64_t json_get_int64(int32_t objid);
1208 /* bytecode does not support double type */
1209 //double json_get_double(int32_t objid);
1210 
1211 /* ----------------- END 0.98.4 APIs ---------------------------------- */
1212 #endif
1213 #endif
uint32_t debug_print_str_start(const uint8_t *str, uint32_t len)
pdf_objflags
Definition: bytecode_api.h:151
int32_t map_remove(const uint8_t *key, int32_t ksize, int32_t id)
FunctionalityLevels
Definition: bytecode_api.h:79
int32_t running_on_jit(void)
Definition: bytecode_api.h:114
Definition: bytecode_api.h:253
int32_t json_get_string_length(int32_t objid)
Definition: bytecode_api.h:72
BytecodeKind
Definition: bytecode_api.h:49
bc_json_type
Definition: bytecode_api.h:183
uint32_t disable_jit_if(const int8_t *reason, uint32_t len, uint32_t cond)
Definition: bytecode_api.h:56
const uint32_t __clambc_match_counts[64]
This is a low-level variable, use the Macros in bytecode_local.h instead to access it...
Definition: bytecode_api.h:99
int32_t inflate_done(int32_t id)
Definition: bytecode_api.h:58
int32_t pdf_set_flags(int32_t flags)
Definition: bytecode_api.h:115
Definition: bytecode_api.h:51
uint32_t check_platform(uint32_t a, uint32_t b, uint32_t c)
int32_t json_get_array_length(int32_t objid)
Definition: bytecode_api.h:85
Definition: bytecode_api.h:95
pdf_flag
Definition: bytecode_api.h:123
uint32_t get_environment(struct cli_environment *env, uint32_t len)
int32_t buffer_pipe_read_stopped(int32_t id, uint32_t amount)
Definition: bytecode_api.h:116
uint32_t disasm_x86(struct DISASM_RESULT *result, uint32_t len)
Definition: bytecode_api.h:257
uint32_t test1(uint32_t a, uint32_t b)
int32_t get_pe_section(struct cli_exe_section *section, uint32_t num)
int32_t map_getvaluesize(int32_t id)
Definition: bytecode_api.h:53
int32_t json_is_active(void)
Definition: bytecode_api.h:101
int32_t json_get_string(int8_t *str, int32_t str_len, int32_t objid)
int32_t buffer_pipe_new_fromfile(uint32_t pos)
int32_t ilog2(uint32_t a, uint32_t b)
const uint16_t __clambc_kind
Definition: bytecode_api.h:227
int32_t extract_new(int32_t id)
int32_t pdf_getobjid(int32_t objidx)
int32_t hashset_empty(int32_t id)
int32_t input_switch(int32_t extracted_file)
Definition: bytecode_api.h:102
Definition: bytecode_api.h:103
int32_t atoi(const uint8_t *str, int32_t size)
int32_t bytecode_rt_error(int32_t locationid)
Definition: bytecode_api.h:91
int32_t map_new(int32_t keysize, int32_t valuesize)
int32_t file_find(const uint8_t *data, uint32_t len)
int32_t file_byteat(uint32_t offset)
Definition: bytecode_api.h:63
Definition: bytecode_execs.h:39
Definition: bytecode_api.h:97
Definition: bytecode_api.h:88
int32_t map_find(const uint8_t *key, int32_t ksize, int32_t id)
int32_t hashset_done(int32_t id)
uint32_t engine_scan_options(void)
int32_t icos(int32_t a, int32_t b, int32_t c)
int32_t memstr(const uint8_t *haystack, int32_t haysize, const uint8_t *needle, int32_t needlesize)
int32_t json_get_array_idx(int32_t idx, int32_t objid)
Definition: bytecode_api.h:113
int32_t hashset_add(int32_t hs, uint32_t key)
int32_t fill_buffer(uint8_t *buffer, uint32_t len, uint32_t filled, uint32_t cursor, uint32_t fill)
uint32_t engine_functionality_level(void)
Definition: bytecode_pe.h:158
Definition: bytecode_api.h:82
int32_t hashset_contains(int32_t hs, uint32_t key)
uint8_t * buffer_pipe_write_get(int32_t id, uint32_t size)
int32_t jsnorm_init(int32_t from_buffer)
const struct cli_pe_hook_data __clambc_pedata
int32_t pdf_get_obj_num(void)
int32_t json_get_boolean(int32_t objid)
int32_t read_number(uint32_t radix)
uint32_t entropy_buffer(uint8_t *buffer, int32_t size)
int32_t hashset_new(void)
int32_t isin(int32_t a, int32_t b, int32_t c)
uint32_t disable_bytecode_if(const int8_t *reason, uint32_t len, uint32_t cond)
int32_t pdf_lookupobj(uint32_t id)
uint32_t setvirusname(const uint8_t *name, uint32_t len)
int32_t read(uint8_t *data, int32_t size)
Definition: bytecode_api.h:94
const uint8_t * pdf_getobj(int32_t objidx, uint32_t amount)
int32_t inflate_init(int32_t from_buffer, int32_t to_buffer, int32_t windowBits)
uint32_t iexp(int32_t a, int32_t b, int32_t c)
int32_t pdf_get_offset(int32_t objidx)
const uint32_t __clambc_match_offsets[64]
This is a low-level variable, use the Macros in bytecode_local.h instead to access it...
int32_t map_done(int32_t id)
int32_t pdf_setobjflags(int32_t objidx, int32_t flags)
int32_t file_find_limit(const uint8_t *data, uint32_t len, int32_t maxpos)
uint32_t pdf_getobjsize(int32_t objidx)
int32_t seek(int32_t pos, uint32_t whence)
int32_t hex2ui(uint32_t hex1, uint32_t hex2)
uint32_t debug_print_uint(uint32_t a)
int32_t pdf_get_dumpedobjid(void)
uint8_t * map_getvalue(int32_t id, int32_t size)
void * malloc(uint32_t size)
int32_t json_get_int(int32_t objid)
int32_t buffer_pipe_done(int32_t id)
int32_t extract_set_container(uint32_t container)
uint32_t pe_rawaddr(uint32_t rva)
Definition: bytecode_disasm.h:357
int32_t pdf_get_flags(void)
const uint32_t __clambc_filesize[1]
int32_t pdf_getobjflags(int32_t objidx)
int32_t map_addkey(const uint8_t *key, int32_t ksize, int32_t id)
int32_t hashset_remove(int32_t hs, uint32_t key)
Definition: bytecode_api.h:92
uint32_t debug_print_str(const uint8_t *str, uint32_t len)
uint32_t test2(uint32_t a)
int32_t pdf_get_phase(void)
uint32_t debug_print_str_nonl(const uint8_t *str, uint32_t len)
Definition: bytecode_api.h:60
int32_t version_compare(const uint8_t *lhs, uint32_t lhs_len, const uint8_t *rhs, uint32_t rhs_len)
int32_t buffer_pipe_new(uint32_t size)
Definition: bytecode_api.h:100
pdf_phase
Definition: bytecode_api.h:111
Definition: bytecode_api.h:96
Definition: bytecode_api.h:98
int32_t get_file_reliability(void)
int32_t buffer_pipe_write_stopped(int32_t id, uint32_t amount)
uint32_t engine_db_options(void)
uint32_t engine_dconf_level(void)
const uint8_t * buffer_pipe_read_get(int32_t id, uint32_t amount)
Definition: bytecode_api.h:255
uint32_t buffer_pipe_read_avail(int32_t id)
Definition: bytecode_api.h:93
int32_t jsnorm_done(int32_t id)
int32_t map_setvalue(const uint8_t *value, int32_t vsize, int32_t id)
int32_t jsnorm_process(int32_t id)
Definition: bytecode_api.h:87
Definition: bytecode_api.h:80
int32_t inflate_process(int32_t id)
int32_t matchicon(const uint8_t *group1, int32_t group1_len, const uint8_t *group2, int32_t group2_len)
int32_t write(uint8_t *data, int32_t size)
Definition: bytecode_api.h:90
int32_t json_get_object(const int8_t *name, int32_t name_len, int32_t objid)
int32_t json_get_type(int32_t objid)
uint32_t buffer_pipe_write_avail(int32_t id)
int32_t ipow(int32_t a, int32_t b, int32_t c)