tentative patch for Trophie to show new extended pattern numbers
Alain Fauconnet <[email protected]> Wed, 11 Aug 2004 16:53:39 +0700
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Hello, I've come up with the attached patch to Trophie v1.12 so that it displays the new, extended pattern numbers. Trophie's output will have the following extra line: Initializing : Pattern extended number 195409 (1.954.09) which shows the full, extended pattern number. This has little interest and Trophie will most likely continue to work nicely with the new pattern numbers without this patch, but I just felt like trying to figure this one out :-) I've found out that there's a new VSGetVirusPatternInfoEx() API function, that takes a value that is filled up by VSReadVirusPattern() (4th argument as a pointer, set to NULL (0) in the original Trophie v1.12 sources). VSGetVirusPatternInfoEx() will then fill up a structure its 1st argument points to with 3 unknown dwords and a 4th one that is the new extended pattern number in decimal as shown above. See the comments in the patch if you're interested. This patch has been lighty tested... don't break your Trophie set-up unless you really want to try it out and like the idea of having the full pattern number displayed. Greets, _Alain_ -- Alain Fauconnet IT Security Specialist & CISO -- ITServ Asian Institute of Technology _______________________________________________ vtools mailing list [email protected] http://www.vanja.com/list/listinfo.cgi/vtools
trophie-extended-pattern-number.patch
(text/plain, 5 KB)
--- trophie.c.org Wed Aug 11 15:26:28 2004
+++ trophie.c Wed Aug 11 16:32:13 2004
@@ -5,7 +5,9 @@
int PROC_COUNT = 0;
int vs_ret;
int vs_addr;
-
+/* 11-Aug-2004 AlainF Next two used to call VSGetVirusPatternInfoEx() */
+int vs_ptr; /* VSReadVirusPattern() is passed a pointer to this one */
+struct pattern_info_ex_type pattern_info_ex; /* Structure filled up by VSGetVirusPatternInfoEx() */
/* Print the usage */
void usage(void)
--- trophie_init.c.org Wed Aug 11 13:59:05 2004
+++ trophie_init.c Wed Aug 11 16:36:44 2004
@@ -230,6 +230,12 @@
/* Initialize VSAPI */
void trophie_init(void)
{
+ /* 11-Aug-2004 AlainF These used to call VSGetVirusPatternInfoEx() */
+ /* vscan has it zeroed before calling VSGetVirusPatternInfoEx(), so we do the same */
+ memset((void *) &pattern_info_ex, 0, sizeof(pattern_info_ex));
+ /* vscan has it zeroed before calling VSReadVirusPattern(), so we do the same */
+ vs_ptr = 0;
+
if((vs_ret = VSInit(getpid(), "VSCAN", -1, &vs_addr)) != 0)
{
fprintf(stderr, "ERROR: VSInit() failed (return code: [%d])\n", vs_ret);
@@ -237,7 +243,9 @@
}
/* Should work... ;) */
- if ((vs_ret = VSReadVirusPattern(vs_addr, -1, 0, 0)) != 0)
+ /* 11-Aug-2004 AlainF Added passing of a pointer to vs_ptr, used later to call VSGetVirusPatternInfoEx() */
+ /* VSReadVirusPattern() puts some obscure value in vs_ptr */
+ if ((vs_ret = VSReadVirusPattern(vs_addr, -1, 0, (int *) &vs_ptr)) != 0)
{
fprintf(stderr, "VSReadVirusPattern() failed (return code: [%d])\n", vs_ret);
exit(-1);
@@ -251,6 +259,12 @@
fprintf(stderr, "VSGetVSCInfo() failed (return code: [%d])\n", vs_ret);
exit(-1);
}
+ /* 11-Aug-2004 AlainF Added call to VSGetVirusPatternInfoEx() to get extended pattern number */
+ if ((vs_ret = VSGetVirusPatternInfoEx(vs_ptr, (int *) &pattern_info_ex)) != 0)
+ {
+ fprintf(stderr, "VSGetVirusPatternInfoEx() failed (return code: [%d])\n", vs_ret);
+ exit(-1);
+ }
/* Set the callback function */
if ((vs_ret = VSSetProcessFileCallBackFunc(vs_addr, &vs_virus_scan_file_callback_function)) != 0)
@@ -284,8 +298,16 @@
/* Show the VSAPI version & pattern details */
void trophie_version(void)
{
+ int major, number, version;
+
trophie_print(0, "Initializing : VSAPI version %s", trophie_vs.version_string);
trophie_print(0, "Initializing : Pattern version %d (pattern number %lu)", trophie_vs.pattern_version, trophie_vs.pattern_number);
+ /* 11-Aug-2004 AlainF Display the extended pattern number (x.xxx.xx) */
+ /* Split integer value in 3 parts */
+ major = pattern_info_ex.info / 100000;
+ number = pattern_info_ex.info / 100 - major * 1000;
+ version = pattern_info_ex.info - major * 100000 - number * 100;
+ trophie_print(0, "Initializing : Pattern extended number %d (%d.%.3d.%.2d)", pattern_info_ex.info, major, number, version);
trophie_print(0, "Socket path : %s", TROPHIE_SOCKET_NAME);
trophie_print(0, "Timeout : %d seconds", TROPHIE_TIMEOUT);
trophie_print(0, "Running as user : %s", RUNAS_USER);
--- trophie.h.org Wed Aug 11 15:32:52 2004
+++ trophie.h Wed Aug 11 16:36:51 2004
@@ -47,9 +47,20 @@
int vs_ret;
int vs_addr;
+/* 11-Aug-2004 AlainF Added vs_ptr and pattern_info_ex that are used to call VSGetVirusPatternInfoEx */
+/* This variable is used to hold some obscure value
+ * that is returned by VSReadVirusPattern() and
+ * must be passed to VSGetVirusPatternInfoEx()
+ */
+int vs_ptr;
/* Our lame structure goes in here */
struct trophie_vs_type trophie_vs;
+
+/* This structure is passed to VSGetVirusPatternInfoEx and will receive the
+ * extended pattern info
+ */
+struct pattern_info_ex_type pattern_info_ex;
/* --- FUNCTIONS --- */
--- trophie_vsapi.h.org Wed Aug 11 15:43:01 2004
+++ trophie_vsapi.h Wed Aug 11 16:38:28 2004
@@ -20,6 +20,19 @@
char *current_filename; /* Filename being checked */
};
+/* 11-Aug-2004 AlainF Added structure for VSGetVirusPatternInfoEx */
+/* For VSGetVirusPatternInfoEx() */
+struct pattern_info_ex_type {
+ unsigned int unknown_1;
+ unsigned int unknown_2;
+ unsigned int unknown_3;
+ unsigned int info; /* As a decimal number: MNNNVV
+ M: major number
+ NNN: pattern number
+ VV: pattern version
+ E.g. 195409 is 1.954.09 */
+};
+
/* mostly used for trophie_show_settings() */
int VSGetLogFlag(int);
int VSGetScanJavaFlag(int);
@@ -66,13 +79,16 @@
/* trophie_init() */
int VSInit(pid_t, char *, int, int *);
-int VSReadVirusPattern(int, int, int, int);
+/* 11-Aug-2004 AlainF 4th argument to VSReadVirusPattern() really is a pointer */
+int VSReadVirusPattern(int, int, int, int *);
int VSGetVSCInfo(struct trophie_vs_type *);
/* int VSSetProcessFileCallBackFunc(int, XXX); */
int (VSSetProcessFileCallBackFunc)();
int VSSetProcessAllFileInArcFlag(int, int);
int VSSetProcessAllFileFlag(int, int);
int VSQuit(int);
+/* 11-Aug-2004 AlainF Added VSGetVirusPatternInfoEx */
+int VSGetVirusPatternInfoEx(int, int *);
/* trophie_scandir() */
/* int VSScanDir(int, char *, XXX, XXX , int *); */