clamav的学习

API

头文件 #include<clamav.h>

初始化

cl_init()

创建一个新的扫描引擎 cl_engine_new().

释放扫描引擎资源 cl_engine_free()

int cl_init(unsigned int options);
struct cl_engine *cl_engine_new(void);
int cl_engine_free(struct cl_engine *engine);

下载病毒库：

const char *cl_retdbdir(void);
int cl_load(const char *path, struct cl_engine *engine,
unsigned int *signo, unsigned int options);

cl_retdbdir()返回数据库的路径，cl_laod()加载数据库文件。

cl_laod()最后一个参数： 

CL DB STDOPT
This is an alias for a recommended set of scan options.
CL DB PHISHING
Load phishing signatures.
CL DB PHISHING URLS
Initialize the phishing detection module and load .wdb and .pdb files.
CL DB PUA
Load signatures for Potentially Unwanted Applications.
CL DB OFFICIAL ONLY
Only load official signatures from digitally signed databases.
CL DB BYTECODE
Load bytecode.

错误处理：

cl_strerror()返回错误编码

引擎结构：数据库下好以后应该检测引擎cl_engine_compile()：

int cl_engine_compile(struct cl_engine *engine);

修改一些值。。。

int cl_engine_set_num(struct cl_engine *engine,
enum cl_engine_field field, long long num);
long long cl_engine_get_num(const struct cl_engine *engine,
enum cl_engine_field field, int *err);
int cl_engine_set_str(struct cl_engine *engine,
enum cl_engine_field field, const char *str);
const char *cl_engine_get_str(const struct cl_engine *engine,
enum cl_engine_field field, int *err);

数据库检测：

int cl_statinidir(const char *dirname, struct cl_stat *dbstat);//初始化
int cl_statchkdir(const struct cl_stat *dbstat);//检测数据库有木有发生变化，返回0为没有，1有
int cl_statfree(struct cl_stat *dbstat);

cl_stat..()是数据库的操作。

数据扫描功能：

int cl_scanfile(const char *filename, const char **virname,
unsigned long int *scanned, const struct cl_engine *engine,
unsigned int options);
int cl_scandesc(int desc, const char **virname, unsigned
long int *scanned, const struct cl_engine *engine,
unsigned int options);

病毒名称存放在virname里，options里面是如下的值：

CL SCAN STDOPT

CL SCAN RAW

CL SCAN ARCHIVE

CL SCAN BLOCKENCRYPTED

CL SCAN MAIL

CL SCAN OLE2

CL SCAN PDF

CL SCAN SWF

CL SCAN PE

CL SCAN ELF

CL SCAN BLOCKBROKEN

CL SCAN HTML

CL SCAN ALGORITHMIC

CL SCAN PHISHING BLOCKSSL

CL SCAN PHISHING BLOCKCLOAK

CL SCAN STRUCTURED

CL SCAN STRUCTURED SSN NORMAL

CL SCAN STRUCTURED SSN STRIPPED

CL SCAN PARTIAL MESSAGE

CL SCAN HEURISTIC PRECEDENCE

CL SCAN BLOCKMACROS