Skip to content

@zaddach zaddach released this Sep 12, 2018

This release brings support for IDA Pro 7.1, improves the SigAnalyzer signature parser to understand more signatures, and fixes a couple of bugs.

To install, either pick one of the installation packages and unzip them into your IDA Pro directory, or get the source and build the installation packages yourself.

If you just want to use the CASC functionality without SigAnalyzer, you can pick the archive. The plugin will degrade gracefully to CASC-only mode if supporting libraries are missing.

Assets 7

@demonduck demonduck released this Aug 2, 2017 · 17 commits to dev since this release

Bundled projects:

Assets 5

@demonduck demonduck released this Feb 2, 2017 · 41 commits to master since this release

The ClamAV Signature Creator (CASC), is an IDA Pro plug-in to aid reverse engineers in creating ClamAV NDB and LDB signatures from IDA Pro's Disassembly, Strings, and Imports windows.

This version decoupled the masking UI and masking operations from the dialog boxes and Assembly class. Update allows for new architecture parsers and masking options to be created and used in a plug-in like fashion. The method for saving sub signature data has changed since CASC's initial release, thus, old IDBs with CASC data will not load up old CASC saved data.


  • Added a minimized Intel parser to break out more instruction fields and options
  • Added a Intel mask UI to provide more options for masking opcodes/disassembly
  • Added signature decoding view in non disassembly GUI dialog boxes
  • Added minimized version of sigtool --decode to help understand the signature composition in a meaningful way (uses masked disassembly for assembly based sub signatures)
  • Added Original Opcodes view to Assembly dialog box to help with conducting customized masking/alterations to disassembly opcodes
  • Added right click menu to Imports window to allow imports to be used as a sub signature
  • Added Intel Masking
    • Corrections and refinements to masking global offsets, Jcc and JMP conditions
    • Can mask off individual register values for most instructions (instructions that use a fixed register will not alter)
  • Updated signature creation and validation to work with currently support ClamAV versions (0.98 and above)
    • Sub signatures now support alternate streams. Single or multi-byte fixed length alternate streams can be used
    • Hexsigs anchored to a byte are now supported (HEXSIG[x-y]aa or aa[x-y]HEXSIG)
  • Updated message and signature generated for ClamAV addition email
  • Fixed bug with CASC data storage and updated underlying storage mechanism to support storing data longer than 1024 characters
  • Fixed random IDA crash issues by ensuring thread safe coding practices for interaction with IDA components
  • Fixed misc. bugs and typos
Assets 2
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.