New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Error parsing ldb file #12
Comments
Hi! Thanks for your report. Let's break down the rule that makes the script crash: So far, so good. From my understanding of the documentation, the "subsigN" can either be structured as "[offset]:[hex string]" or "[hex-string]". So based on my understanding of the structure of ClamAV signatures (which is likely to be flawed and/or incomplete), the rules you linked to are indeed invalid, as several of them contain the "::i" suffix. |
After talking with the owner of the Clam rules, it sounds like there are some newer features in 0.99 that the signatures are utilizing. The direct quote from him is: So it sounds like converting these rules might be a wash and just require some manual by hand conversion (when it's applicable) |
YARA supports regular expressions so there might actually a way to convert those signatures. |
Not sure if I need to open a new issue since the error title it's valid also in my case.
The value of the line that generate error [The first one really] is: It seems that comment lines are not skipped. |
Thanks a lot! That looks new, I'll fix this ASAP. |
Hello,
This might be a case of user error, but when I try to run parse_clamav.py against a custom set of clam rules (https://raw.githubusercontent.com/wmetcalf/clam-punch/master/miscreantpunch099.ldb) it'll generate an error
Unable to understand the following offset: 48344426616d703b48354126616d703b*48353426616d703b48363826616d703b48363926616d703b48373326616d703b48323026616d703b48373026616d703b48373226616d703b48366626616d703b48363726616d703b48373226616d703b48363126616d703b48366426616d703b
This appears to be from this line in the ldb file.
MiscreantPunch.EXEInsideOfDoc.ASASCII.2;Target:0;(0);48344426616d703b48354126616d703b*48353426616d703b48363826616d703b48363926616d703b48373326616d703b48323026616d703b48373026616d703b48373226616d703b48366626616d703b48363726616d703b48373226616d703b48363126616d703b48366426616d703b::i
Any help you can give would be greatly appreciated!
The text was updated successfully, but these errors were encountered: