ClamAV工作

工作流程图

引用库

zlib

bzlib

关键函数

int scanmanager(const struct optstruct *opts)

内容扫描入口

static void scanfile(const char *filename, struct cl_engine *engine, const struct optstruct *opts, unsigned int options)

内容扫描

int cl_scandesc_callback(int desc, const char **virname, unsigned long int *scanned, const struct cl_engine *engine, unsigned int scanoptions, void *context)

扫描封装函数

int cli_map_scandesc(cl_fmap_t *map, off_t offset, size_t length, cli_ctx *ctx, cli_file_t type)

扫描封装函数

static int magic_scandesc(cli_ctx *ctx, cli_file_t type)

扫描内容

cli_file_t cli_filetype2(fmap_t *map, const struct cl_engine *engine, cli_file_t basetype)

查找文件类型

扫描文件类型

DCONF_ARCH 压缩文件

#define ARCH_CONF_RAR       0x1
#define ARCH_CONF_ZIP       0x2
#define ARCH_CONF_GZ        0x4
#define ARCH_CONF_BZ        0x8
#define ARCH_CONF_SZDD      0x10
#define ARCH_CONF_CAB       0x20
#define ARCH_CONF_CHM       0x40
#define ARCH_CONF_OLE2      0x80
#define ARCH_CONF_TAR       0x100
#define ARCH_CONF_BINHEX    0x200
#define ARCH_CONF_SIS       0x400
#define ARCH_CONF_NSIS      0x800
#define ARCH_CONF_ARJ       0x1000
#define ARCH_CONF_AUTOIT    0x2000
#define ARCH_CONF_CPIO      0x4000
#define ARCH_CONF_ISHIELD   0x8000
#define ARCH_CONF_7Z        0x10000
#define ARCH_CONF_ISO9660   0x20000
#define ARCH_CONF_DMG       0x40000
#define ARCH_CONF_XAR       0x80000
#define ARCH_CONF_HFSPLUS   0x100000
#define ARCH_CONF_XZ        0x200000
#define ARCH_CONF_PASSWD    0x400000
#define ARCH_CONF_MBR       0x800000
#define ARCH_CONF_GPT       0x1000000
#define ARCH_CONF_APM       0x2000000

DCONF_DOC 文档

#define DOC_CONF_HTML       0x1
#define DOC_CONF_RTF        0x2
#define DOC_CONF_PDF        0x4
#define DOC_CONF_SCRIPT     0x8
#define DOC_CONF_HTML_SKIPRAW   0x10
#define DOC_CONF_JSNORM         0x20
#define DOC_CONF_SWF        0x40
#define DOC_CONF_MSXML      0x80
#define DOC_CONF_OOXML      0x100
#define DOC_CONF_HWP        0x200

DCONF_MAIL 邮件

#define MAIL_CONF_MBOX      0x1
#define MAIL_CONF_TNEF      0x2

DCONF_OTHER 其他

#define OTHER_CONF_UUENC    0x1
#define OTHER_CONF_SCRENC   0x2
#define OTHER_CONF_RIFF     0x4
#define OTHER_CONF_JPEG     0x8
#define OTHER_CONF_CRYPTFF  0x10
#define OTHER_CONF_DLP      0x20
#define OTHER_CONF_MYDOOMLOG    0x40
#define OTHER_CONF_PREFILTERING 0x80
#define OTHER_CONF_PDFNAMEOBJ   0x100
#define OTHER_CONF_PRTNINTXN    0x200