ClamAV Integration

ClamAV Integration

HydraDragonAV Mobile integrates ClamAV signatures directly into the native Rust scan engine.

Database Filtering

Since ClamAV's full signature database includes many Windows and macOS-specific signatures, the clam_juice.py script filters the database to keep only Android-relevant platforms:

python clam_juice.py --directory database_non_filtered --output database_filtered --profile cross-platform

Included platforms:

• Andr — Android malware
• Unix — Multi-platform / Unix malware
• Linux — Linux malware
• PUA — Potentially Unwanted Applications
• All Phishing signatures (platform-independent)

Excluded platforms:

• Win — Windows-specific malware
• Osx — macOS-specific malware
• Java — Cross-platform Java (with .jar extension) malware

Database Storage

Filtered databases are stored in:

• database/ — ClamAV daily/main/bytecode .cld and .cdb files
• database_non_filtered/ — Original unfiltered databases (source for clam_juice.py)

Integration with Rust Engine

The native engine (hydradragonclamav) links against libclamav and performs signature matching directly in memory — no temporary files are written to disk.

File-Type Gating

Filtering the signature database by platform isn't enough on its own — a signature's Target: field only rejects a mismatched file after the buffer has already paid for the atom prefilter pass and any per-signature candidate work. To avoid that cost entirely, the engine first classifies the file being scanned (via .ftm magic rules, falling back to built-in magic checks) and only runs the ClamAV engine (prefilter + extended + logical signatures) at all when the file is confidently one of:

• APK/ZIP, DEX, ELF, HTML, ASCII text, PDF, images (graphics)

Anything else — a confidently-identified desktop-only format (Windows PE, OLE2/Office, Mail, Mach-O, SWF, Java) or a file whose type can't be determined at all — skips the ClamAV engine (and the YARA-X engine, which uses the same gate) entirely. This is a deliberate policy, not just an optimization: since the signature database itself is filtered to Android-relevant platforms (see above), running it against a format that can never execute on Android would only add scan latency without ever producing a meaningful detection.

Performance

• Signature database is loaded once at engine initialization
• Matching is multi-threaded for parallel scanning
• Filtered database is approximately 60-70% smaller than the full ClamAV database

See Also

• Detection-Engines — Overview of all engines
• YARA-X-Usage — YARA-X pattern matching
• Data-Pipeline — Signature generation workflow